ElcomSoft Co. Ltd. updates iOS Forensic Toolkit, enabling physical acquisition of certain iOS 5 and iOS 6 devices including iPhone 4S and 5, iPad 2 through 4, iPod Touch 4-5. Support for iPhone 4S and 5 has been highly demanded by forensic customers. By enabling physical acquisition of last-generation Apple devices, iOS Forensic Toolkit makes forensic analysis of these iOS devices once again a feasible enterprise.
The acquisition of jailbroken devices gets automated, eliminating previously required manual steps. The acquisition of legacy devices is now completely automated.
iOS Forensic Toolkit continues providing unrestricted support for legacy iOS devices such as iPhone 4 and earlier. However, physical acquisition support for last-generation iOS devices is subject to technical limitations. iPhone 4S and 5, iPad 2-4 can only be acquired if jailbroken or unlocked so that jailbreak code could be installed. Non-jailbroken devices locked with an unknown passcode cannot be acquired.
Passcode recovery speed on jailbroken iPhone 5 devices is increased to 15.5 passcodes per second, allowing iOS Forensic Toolkit to break typical 4-digit passcodes in about 10 minutes.
Physical acquisition preferable for accessing data in iOS devices, returning more information than any other method such as logical acquisition or backup analysis. Physical acquisition operates within a definite timeframe, delivering the entire content of a 32-GB device in under 40 minutes. All protected information including SMS, emails, call history, contacts, organizer data, Web browsing history, voicemail and email accounts and settings, stored logins and passwords, geolocation history etc. can be recovered even if the original passcode is unknown.
Windows and MacOS X versions are available. Physical acquisition support varies depending on lock state, jailbreak state and the version of iOS installed.
iPhone 4 and older; iPad 1; iPod Touch 1-3: no restrictions, all versions of iOS.
iPhone 4S, 5; iPad 2-4; iPod Touch 4-5: if already jailbroken, or jailbreak can be installed (iOS up to 6.1.2, device unlocked, passcode not set or known).