

The newly developed checkm8 extraction process supports a range of major OS releases from iOS 7 through iOS 16.2 in three different flavors (iOS, tvOS, watchOS) for three different architectures (arm64, armv7, armv7k).įor devices based on the armv7 and armv7k architecture full passcode unlock along with file system extraction and keychain decryption are available.

The forensically sound bootloader-level extraction process is available for 76 Apple devices ranging from the ancient iPhone 4 all the way up to the iPhone X, a large number of iPad, iPod Touch, Apple Watch, and Apple TV models.

The new extraction method is the cleanest yet, enabling repeatable, verifiable extractions and forensically sound workflow. IOS Forensic Toolkit 8 for Mac introduces a new extraction method for select iOS devices based on the modified bootloader. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image. Perform full file system and logical acquisition of iPhone, iPad and iPod Touch devices.
