Installing and Troubleshooting the Extraction Agent (2025)
July 2nd, 2025 by Oleg Afonin
Over the years, we’ve published numerous guides on installing the iOS Forensic Toolkit extraction agent and troubleshooting issues. As both the tool and its environment evolved, so did our documentation – often leading to outdated or scattered information. This article consolidates and updates everything in one place, detailing the correct installation and troubleshooting procedures.
iOS Forensic Toolkit Now Supports All Models of Apple Watch
May 15th, 2025 by Oleg Afonin
We’ve released an important update to iOS Forensic Toolkit: the Toolkit expands logical acquisition to all newer models of Apple Watch starting from Apple Watch Series 6 (with a wired third-party adapter), Apple Watch Series 7 through 10, SE2, Ultra, and Ultra 2 (via a special wireless adapter). With this update, the Toolkit supports the complete range of Apple Watch devices with no gaps or omissions.
Extraction Agent: Offline Extraction with All Developer Accounts
May 15th, 2025 by Oleg Afonin
We are excited to announce an update to Elcomsoft iOS Forensic Toolkit that solves a long-lasting issue connected to the installation and use of the low-level extraction agent. In version 8.70, we introduce a critical improvement: you can now sideload and launch the extraction agent completely offline using any Apple Developer account – regardless of when it was created. What exactly changed, and what does that mean for you? Read along to find out.
Microsoft Goes Passwordless: Forensic Implications of Passwordless Microsoft Accounts
May 14th, 2025 by Oleg Afonin
Microsoft has officially announced that newly created Microsoft Accounts will now be passwordless by default for “simpler, safer sign-ins”. This change extends the direction set by Windows 11, where traditional passwords have been gradually phased out in favor of more secure and user-friendly authentication methods – such as PIN codes, biometrics, and passkeys. In this article, we will evaluate the forensic implications of this move.
Forensic Implications of BitLocker-by-Default in Windows 11 24H2
May 8th, 2025 by Oleg Afonin
The Windows 11 24H2 update introduced a change in Microsoft’s approach to disk encryption, a shift that will have long lasting implications on digital forensics. In this release, BitLocker encryption is automatically enabled on most modern hardware when installing Windows when a Microsoft Account (MSA) is used during setup. Encryption starts seamlessly and silently in the background, covering even Home editions and consumer devices such as desktop computers that historically escaped full-disk encryption defaults.
What’s New in Elcomsoft System Recovery 8.34: More Data, Faster Imaging, BitLocker Key Extraction
April 29th, 2025 by Oleg Afonin
We updated Elcomsoft System Recovery to version 8.34. This release focuses on expanding the tool’s data acquisition capabilities, improving disk imaging performance, and adding BitLocker recovery key extraction for systems managed via Active Directory. Here’s a technical breakdown of the changes.
Forensic Implications of Apple’s “Stolen Device Protection”
March 10th, 2025 by Oleg Afonin
With the release of iOS 17.3, Apple introduced a new security feature called “Stolen Device Protection.” This functionality is designed to prevent unauthorized access to sensitive data in cases where a thief has gained knowledge of an iPhone’s passcode. While this feature significantly enhances security for end users, it simultaneously creates substantial obstacles for digital forensic experts, complicating lawful data extraction.
NVIDIA GeForce RTX 5090 Power Connectors Melting Again
March 6th, 2025 by Oleg Afonin
Just a week ago, we published an article about NVIDIA’s new generation of Blackwell-based graphics cards. Despite a noticeable price hike, performance gains in this generation are minimal, with one notable exception: the flagship GeForce RTX 5090 significantly outperforms its predecessor in all key aspects. However, this GPU has also revealed a potential issue that could make its use in workstations running 24/7 problematic and potentially unsafe.
NVIDIA Blackwell is Out: Should You Upgrade?
February 27th, 2025 by Oleg Afonin
The newly introduced NVIDIA GeForce RTX 50 series (Blackwell architecture) brings significant changes. Notably, NVIDIA claims a doubling of integer (INT32) computation throughput per clock cycle compared to the previous Ada Lovelace architecture; this is described in the company’s whitepaper.
Apple Disables Advanced Data Protection for iCloud in UK
February 25th, 2025 by Oleg Afonin
In the beginning of February, Apple may have received a secret order requiring the company to create an encryption backdoor. According to a leak, the UK government demanded blanket, covert access to all sorts of encrypted data globally. After that demand, Apple decided to disable Advanced Data Protection for iCloud in the UK, issuing an official statement. What does that mean for the law enforcement, and what consequences are expected for the end users?
The Evolution of iOS Passcode Security
January 31st, 2025 by Oleg Afonin
Over the years, Apple has continuously refined its security mechanisms to deter unauthorized access to their devices. One of the most significant aspects of this evolution is the increasingly sophisticated passcode protection system in iOS devices. This article explores how the delay between failed passcode attempts has evolved over time, highlighting changes that have made iOS screen lock protection more secure.
