iOS Forensic Toolkit 4.10 adds support for the last generation of Apple devices including iPhone Xs, Xs Max, Xr and new iPad Pro. In addition, the tool can now utilize iOS DFU and Recovery modes to obtain device information.

iOS Forensic Toolkit receives a major update, adding support for the latest range of Apple iPhone devices. Version 4.10 supports all 64-bit iPhone and iPad devices starting with iPhone 5s. In this release, the Toolkit gained the ability to perform logical acquisition of iPhone Xs, Xs Max, and iPhone Xr devices. The advanced logical acquisition process obtains information available through iOS backup service, and additionally extracts extended device information, media files (photos and videos) regardless of backup password, as well as crash logs and shared files.

Support for DFU and Recovery Modes

Experts involved with iOS forensics are aware of DFU and Recovery modes available in Apple devices. The original purpose of DFU and Recovery modes is recovering iOS devices from various issues if the device becomes unusable, does not boot or has a problem installing an update.

Both DFU and Recovery modes load prior to iOS. For this reason, these modes are not affected by USB restrictions, allowing experts successfully connecting devices even if USB Restricted Mode has been engaged. Either mode allows for two-way communication between the device and the computer, returning a limited amount of information about the device.

iOS Forensic Toolkit 4.10 adds support for devices booted in the DFU or Recovery mode, accessing all available information about the connected device. The following information can be extracted through the Recovery mode: device model and model number, unique chip identifier (ECID), device serial number and IMEI. The DFU mode only returns device model and model number as well as unique chip identifier (ECID). More information about DFU and Recovery modes at https://blog.elcomsoft.com/2018/10/everything-about-ios-dfu-and-recovery-modes/