iCloud Extraction Turns Twelve

May 15th, 2024 by Oleg Afonin

Twelve years ago, we introduced an innovative way of accessing iPhone user data, retrieving iPhone backups straight from Apple iCloud. As our iCloud extraction technology celebrates its twelfth anniversary, it’s a fitting moment to reflect on the reactions it has provoked within the IT community. Let us commemorate the birth of the cloud extraction technology, recap the initial reactions from the forensic community, and talk about where this technology stands today.

Read the rest of this entry »

Changes to U.S. iOS App Store Policies Allow External Purchase Links

January 17th, 2024 by Vladimir Katalov

In a controversial move, Apple is implementing major changes to its U.S. iOS App Store policies, granting developers the ability to direct customers to non-App Store purchasing options for digital goods. This update permits users to make in-app purchases through an alternative method. However, Apple will continue to collect a commission ranging from 12 to 27 percent on content purchased through this avenue, providing only a 3 percentage points commission cut compared to purchases made through the official Apple App Store.

Read the rest of this entry »

When Extraction Meets Analysis: Cellebrite Physical Analyzer

January 12th, 2024 by Oleg Afonin

When equipping a forensic lab, having a diverse set of tools is extremely important due to their diverse, rarely overlapping capabilities, and the need for cross-checking the results. With that many tools, compatibility is crucial. This is why we went a long way to ensure that any data extracted with our mobile forensic tools can be opened in many popular forensic analysis tools.

Read the rest of this entry »

Forensically Sound Cold System Analysis

January 8th, 2024 by Oleg Afonin

In the world of digital forensics, there are various ways to analyze computer systems. You might be familiar live system analysis or investigating forensic disk images, but there’s yet another method called cold system analysis. Unlike live analysis where experts deal with active user sessions, cold system analysis works differently. It’s like a middle ground between live analysis and examining saved images of a computer’s storage. But why and when would someone use cold analysis? What can you do with it, and how does it compare to the usual methods?

Read the rest of this entry »

A Comprehensive Guide to Essential Tools for Elcomsoft iOS Forensic Toolkit

January 3rd, 2024 by Elcomsoft R&D

Elcomsoft iOS Forensic Toolkit (EIFT) is a powerful software designed to acquire data from various Apple devices, ranging from iPhones to HomePods. However, to make the most of this tool, you’ll need more than just the software itself. In this article, we will quickly review the mandatory and optional accessories that are essential for the effective use of the product.

Read the rest of this entry »

A Comprehensive Instruction Manual on Installing the Extraction Agent

December 27th, 2023 by Oleg Afonin

This guide covers the correct installation procedure for Elcomsoft low-level extraction agent, an integral part of iOS Forensic Toolkit that helps extracting the file system and keychain from supported iOS devices. This instruction manual provides a step-by-step guide for setting up a device and installing the extraction agent. We’ve included suggestions from troubleshooting scenarios and recommendations we derived during testing.

Read the rest of this entry »

iOS 17.3 Developer Preview: Stolen Device Protection

December 20th, 2023 by Oleg Afonin

The first developer beta of iOS 17.3 includes Stolen Device Protection, a major new security feature designed to protect the user’s sensitive information stored in the device and in iCloud account if their iPhone is stolen and the thief gets access to the phone’s passcode. This optional feature could represent a significant change in how Apple looks at security, where currently the passcode is king. At this time, no detailed documentation is available; developers are getting a prompt to test the feature when installing the new beta.

Read the rest of this entry »

iOS Forensic Toolkit: Exploring the Linux Edition

November 30th, 2023 by Oleg Afonin

The latest update of iOS Forensic Toolkit brought an all-new Linux edition, opening up a world of possibilities in mobile device analysis. The highly anticipated Linux edition preserves and expands the features previously available to macOS and Windows users. Forensic professionals can now perform advanced logical and low-level extractions with the aid of a custom extraction agent and extract information using the bootloader-level exploit, making forensic analysis more accessible on Linux platforms.

Read the rest of this entry »

Forensic Insights into Apple Watch Data Extraction

November 30th, 2023 by Oleg Afonin

The latest update to the iOS Forensic Toolkit has expanded data extraction support for older models of Apple Watch, introducing low-level extraction capabilities for Apple Watch Series 0, Series 1, and Series 2. In a landscape where new devices are released on a yearly schedule, we stand committed to a balanced approach. While it’s easy for many to dismiss older devices, we recognize their significance as they frequently reappear in the labs of forensic experts. It is important to emphasize that, unlike many, we cater to the needs of experts who have to deal with legacy devices. This enhancement enables macOS and Linux users to delve deeper into these watches, retrieving crucial information such as passwords and complete file systems.

Read the rest of this entry »

Using and Troubleshooting the checkm8 Exploit

October 31st, 2023 by Oleg Afonin

The bootloader vulnerability affecting several generations of Apple devices opens the door to forensically sound extraction. In today’s article we’ll discuss the compatibility and features of this exploit with different devices, iOS versions, and platforms. In addition, we’ll provide security professionals and researchers with valuable insight into potential issues and solutions when working with checkm8.

Read the rest of this entry »

iOS Forensic Toolkit 8 Lands on Windows

October 5th, 2023 by Oleg Afonin

We have exciting news: iOS Forensic Toolkit 8 is now available for Windows users in the all-new Windows edition. The new build maintains and extends the functionality of EIFT 7, which is now approaching the end of its life cycle. In addition, we’ve made the Toolkit portable, eliminating the need for installation. Learn what’s new in the eights version of the Toolkit!

Read the rest of this entry »