Elcomsoft Adds Forensically Sound Checkm8 Extraction for Select iPhone Models

ElcomSoft Co. Ltd. opens the beta testing of iOS Forensic Toolkit 8.0 for Mac, the company’s mobile forensic tool for extracting data from a range of Apple devices. The new macOS-only build expands the ability to perform full file system extraction from a range of iPhone and iPad devices by utilizing the checkm8 exploit.

Elcomsoft iOS Forensic Toolkit 8.0 beta for Mac offers forensically sound extraction of iPhone 5s, iPhone 6, 6 Plus, 6s, 6s Plus, and iPhone SE (original) devices with a known or empty screen lock passcode. Instead of deriving from the checkra1n jailbreak, our solution is based directly on the checkm8 exploit. All operations are performed completely in the device’s volatile RAM, and the operating system installed on the device is not utilized during the boot process.

The new extraction method is the cleanest yet. There are no log entries added on the device, and absolutely no changes are made to any area of the device storage.

ElcomSoft’s checkm8-based solution supports all versions of iOS that can or could be installed on supported hardware up to and including iOS 14.5.1 with the exception of iOS 7 range (iPhone 5s). Unofficial support is available for iPod touch 6, iPad Air 1, iPad mini 2/3/4, and iPad 5 devices.

The newly developed direct extraction process offers a number of benefits compared to other extraction methods and competing solutions. ElcomSoft offers a unique, forensically sound extraction process, with 100% of the patching occurring in the device RAM. The tool never boots the OS installed on the device, and never touches the system partition. Real-time guidance with instructions and countdowns is displayed to help install the exploit.

With this update, experts have received the widest range of extraction methods from logical acquisition to all possible ways of low-level extraction as well as advanced cloud acquisition enabling experts to even access information protected with end-to-end encryption. The applicability of each method depends on many factors, yet forensic experts finally have a universal tool for any situation, which will help speed up and simplify criminal investigations.

Pricing and Availability

The availability of the new build is limited. At this time, Elcomsoft iOS Forensic Toolkit 8.0 for Mac is available to existing customers who opt to receive pre-release builds and enroll in the beta testing program.

About Elcomsoft iOS Forensic Toolkit

Elcomsoft iOS Forensic Toolkit provides forensic access to encrypted information stored in popular Apple devices running iOS, offering file system imaging and keychain extraction from the latest generations of iOS devices. By performing low-level extraction of the device, the Toolkit offers instant access to all protected information including SMS and email messages, call history, contacts and organizer data, Web browsing history, voicemail and email accounts and settings, stored logins and passwords, geolocation history, the original plain-text Apple ID password, conversations carried over various instant messaging apps such as Skype or Viber, as well as all application-specific data saved in the device.

About ElcomSoft Co. Ltd.

Founded in 1990, ElcomSoft Co.Ltd. is a global industry-acknowledged expert in computer and mobile forensics providing tools, training, and consulting services to law enforcement, forensics, financial and intelligence agencies. ElcomSoft pioneered and patented numerous cryptography techniques, setting and exceeding expectations by consistently breaking the industry’s performance records. ElcomSoft is Microsoft Certrified Partner, and Intel Software Premier Elite Partner.