Full File System Extraction for iOS 13.3.1, 13.4 and 13.4.1

Elcomsoft iOS Forensic Toolkit 6.0 is out, adding direct, forensically sound extraction for Apple devices running some of the latest versions of iOS including iOS 13.3.1, 13.4 and 13.4.1. Supported devices include the entire iPhone 6s, 7, 8, X, Xr/Xs, 11, and 11 Pro (including Plus and Max versions) range, the iPhone SE, and corresponding iPad models. Let’s review the changes and talk about the new acquisition method in general.

Agent-based extraction: the technology

For a long time, we relied on publicly available jailbreaks to perform full file system and keychain acquisition. That is not a forensically sound method as there are risks (though minimal) to brick the device. Even if you are using the rootless jailbreak, some significant changes to the system are still being made, and they cannot be always rolled back.

👉 https://blog.elcomsoft.com/2020/05/full-file-system-acquisition-for-ios-13-3-1-13-4-and-13-4-1/

#ios #iphone #dfir