Extract Bit-Precise Data from iPhone (Elcomsoft iOS Forensic Toolkit) tutorial

Perform physical and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image.

iOS Forensic Toolkit 2.40 is updated with enhanced support for lockdown records, enabling forensic experts to extract more information from locked down iPhones and iPads in “cold boot” situations. The new release can access advanced device information through the use of lockdown records even if the device is completely locked down and has never been unlocked since powered on or rebooted.

iOS Forensic Toolkit 2.40 extends the use of lockdown (pairing) records for the purpose of extracting additional device info from iPhone and iPad devices that are locked with an unknown passcode. In particular, the new build extracts more information from iOS devices that are locked and have never been unlocked after being powered off or rebooted (the “cold boot” situation). The ability to use lockdown records for extracting information from locked devices in “cold boot” state can be extremely important for investigations.

- Device model and name
- iOS version and build number
- Device ID
- MAC addresses of the phone’s Wi-Fi and Bluetooth adapters
- ICCI/IMEI/IMSI and phone number
- Whether or not an iTunes backup password is enabled
- Date and time of last iTunes and iCloud backups
- List of synced accounts including email address for Google accounts
- Various bits such as total and available disk space, time zone and language settings

If the iOS device has been unlocked at least once, iOS Forensic Toolkit 2.40 can additionally extract comprehensive information about the apps installed on the device. This includes app names and versions, access permissions, as well as the names of their data folders. While this information is also available via full local backups, a local backup may come out encrypted with an unknown password, in which case the data will be encrypted unless the password is known.

Read our blog post "The iPhone is Locked-Down: Dealing with Cold Boot Situations":
https://blog.elcomsoft.com/2017/11/the-iphone-is-locked-down-dealing-with-cold-boot-situations/

Read our blog post "What can be extracted from locked iPhones with new iOS Forensic Toolkit":
https://blog.elcomsoft.com/2017/11/what-can-be-extracted-from-locked-iphones-with-new-ios-forensic-toolkit/

Learn more about EIFT: https://www.elcomsoft.com/eift.html

Go social!
Twitter: https://twitter.com/elcomsoft/
LinkedIn: https://www.linkedin.com/company/152541/
Facebook: https://www.facebook.com/elcomsoft/
Instagram: https://www.instagram.com/elcomsoft/

Elcomsoft's official website:
https://www.elcomsoft.com

Elcomsoft's official blog:
https://blog.elcomsoft.com

All our news and updates:
https://www.elcomsoft.com/news.html

Play ELCOMSAFE!
iTunes: https://itunes.apple.com/us/app/elcom...
Google Play: https://play.google.com/store/apps/de...

Subscribe for more videos:
https://www.youtube.com/channel/UCwo1...

Get our book 'Mobile Forensics – Advanced Investigative Strategies' by Oleg Afonin and Vladimir Katalov:
https://www.elcomsoft.com/news/647.html

For more videos please visit www.youtube.com/user/sethioz

Thanks for watching! :)