Checkm8 Based Extraction of iPhone 7 and iPhone 7 Plus

Today, we are adding forensically sound low-level checkm8 extraction of the iPhone 7 and 7 Plus to previously supported range of iPhone devices.

What is “forensically sound” extraction and how our extraction process differs from competing implementations?

Our solution delivers true forensically sound extraction of the iPhone file system, incl. the keychain. Since all occurs entirely in the device’s RAM, we never boot (and don’t even need) the operating system installed on the device. The result is reliable, verifiable and repeatable extraction. If you use iOS Forensic Toolkit to image the iPhone file system and repeat the extractions, you are guaranteed to get exactly the same result; the checksums of the two images will match.

Learn more about supported phone models, DFU mode and the keychain in our blog:

👉 https://blog.elcomsoft.com/2021/12/checkm8-based-extraction-of-iphone-7-and-iphone-7-plus/

#mobileforensics #forensicallysound #dfir