The iOS 27 Recovery Menu: What It Means for Forensics
August 5th, 2026 by Oleg Afonin
iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad. Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone.
Cracking Legacy ZIP Encryption: The Known-Plaintext Attack and Why It Still Sometimes Works
July 20th, 2026 by Oleg Afonin
When someone hands you a password-protected ZIP archive, one’s immediate thought is “I need to break the password”. For most modern archives, that is exactly the case, and the password is the whole game. But there is a family of ZIP archives where the password does not matter at all. It can be four characters or forty, random or memorable; if the archive uses the legacy ZIP encryption, the whole thing can be unlocked in minutes without ever guessing the password. This is one of the oldest tricks in our line of work, and it is worth telling the story properly, because it is equal parts computer history and practical forensics.
The Long, Strange History of PDF (In)Security – And the Arrest That Made It Personal
July 17th, 2026 by Oleg Afonin
PDF has a reputation as the boring, dependable file format – the one you reach for when you need a document to look exactly the same on every computer, forever. What gets forgotten is that PDF’s security model has been shaky since version 1.0, and its history includes an FBI arrest, a federal jury trial that helped define how the DMCA actually works, and – twenty years later – a fake GIF that hid a tiny working computer inside an image compression stream. This is that story, roughly in order, including the part where we were personally on the receiving end of it.
Two-Factor Authentication and iCloud: A Short History, and What We Fixed in Phone Breaker 11.03
July 16th, 2026 by Oleg Afonin
Two-factor authentication is the least glamorous security feature, and probably the most important one. A password is “something you know”, which really means “something that can be phished, reused, leaked, or guessed”. The second factor is “something you have”, and, while it can still be phished, it makes stolen passwords much less of a catastrophe they used to be. Everything else in account security is built on top of that. If the second factor is not there, or if it does not cover the data that actually matters, the rest is decoration.
A12 usbliter8 BootROM sigpatches
July 15th, 2026 by Elcomsoft R&D
BootROM exploits are an important part of modern low-level forensic acquisition, and our Elcomsoft iOS Forensic Toolkit is no stranger to it. It allows getting code execution at the earliest stage on the device and lets us then load custom software for data decryption and extraction. It has been almost 7 years since the last major BootROM exploit called checkm8 was released, which exploits Apple chips up to A11 (iPhone 8 / iPhone X).
Four Tools, One Workflow: Using Elcomsoft Desktop Forensic Tools on the Same Case
July 10th, 2026 by Oleg Afonin
Most people meet these four tools one product page at a time, which makes them look like four separate purchases for four separate problems. On a real desktop case they are closer to four stages of a single job. Each one hands its output to the next: Elcomsoft System Recovery and Elcomsoft Quick Triage pull the raw material off the machine, Forensic Disk Decryptor turns keys into mounted volumes, and Distributed Password Recovery grinds through whatever is left. In this article we will not go through the feature lists (the product pages do that job well enough); instead we will look at when to reach for each tool, and why the order in which you use them is not fixed but decided by the situation in front of you.
How to Buy a Reliable SSD, Continued
July 2nd, 2026 by Oleg Afonin
Over at the Atola blog, Vitaliy Mokosiy published How to buy a reliable SSD – and none of it is wrong. That’s the problem. Read it back and it boils down to buy a good drive, don’t buy a bad one, and make backups. Every line is true and every line is the line an AI would hand you from a one-sentence prompt.
Bypassing Stolen Device Protection: Alternative Ways of Installing the Extraction Agent
June 24th, 2026 by Oleg Afonin
Stated plainly: iOS Forensic Toolkit can now get past Stolen Device Protection. There is a catch, and it belongs up front: this is not a magic unlock, and anyone selling it as one is selling something. What we have built is a way to install the extraction agent without ever pairing the iPhone to the workstation over a USB port. Because the most disruptive thing SDP does to a forensic workflow is place Face ID or Touch ID in front of that pairing step, bypassing the pairing step bypasses the gate. You still need the device passcode, a paid Apple Developer account, and a device you are authorized to examine. With those in hand, SDP is no longer the wall it was a month ago.
Sideloading the extraction agent: a Stolen Device Protection workaround
June 24th, 2026 by Vladimir Katalov
A new update to iOS Forensic Toolkit is out. The headline feature is an alternative installation method for the extraction agent – that is, deploying it onto an iPhone while bypassing the mandatory pairing requirement. The agent can now be delivered across the network, which removes a number of limitations that came with the usual cable-based installation. One requirement up front: the device must already be unlocked – in other words, the passcode must be known. This method does not work with a fully locked iPhone.
“Get Verification Code” Is Missing in iOS 18 and iOS 26; Here’s Where It Went
June 19th, 2026 by Oleg Afonin
If you have an Apple device running iOS 18 or iOS 26 and gone looking for the old Get Verification Code option under Settings → [user name] → Sign-In & Security, you’ve probably noticed it’s no longer there. A quick search turns up forum threads, support comments, and even GitHub issues all reaching the same conclusion: Apple removed it. Some posts go further and call it “deprecated” or “Apple’s middle finger to users of older devices.” That conclusion is wrong. The option still exists in iOS 26. It just doesn’t show up the way it used to.
Downloading iOS 26 iCloud Backups
June 18th, 2026 by Oleg Afonin
Elcomsoft Phone Breaker 11.2 adds the ability to download iCloud backups created on devices running iOS and iPadOS 26 and, by extension, iOS/iPadOS 27 beta. With this release, Elcomsoft Phone Breaker becomes the first and only third-party tool capable of pulling these backups from Apple’s cloud. That might read like a routine compatibility update. It isn’t. In iOS 26, Apple reworked its iCloud backup mechanism from the ground up, breaking every third-party tool that relied on the previous scheme. Restoring access meant rebuilding a large part of our cloud extraction pipeline. Below is what changed, what we did about it, and where the current build still has rough edges.
