Elcomsoft iOS Forensic Toolkit 6.70 adds passcode unlocking and device imaging functionality for legacy iPhone devices. The software-based unlock brute-forces 4-digit and 6-digit screen lock PINs, while device imaging returns bit-precise image of the data partition.

In Elcomsoft iOS Forensic Toolkit 6.70, we are introducing the ability to unlock and image legacy iPhone models protected with an unknown screen lock passcode. At this time, we support the iPhone 4, 5 and 5c models (the iPhone 4s is currently not supported). All you need to get started is a Mac, a Lightning to USB cable (no Type-C please), and a copy of iOS Forensic Toolkit 6.70.

Unlocking the iPhone 4, 5 and iPhone 5c

Last year, we added passcode unlock for the iPhone 5c. Today, the unlocking support is extended to cover the iPhone 4 and 5. The Toolkit can try all possible 4-digit combinations in about 12 minutes, while 6-digit PIN codes take up to a day to complete. We’ve developed a smart attack to target these longer passcodes, trying the list of the most common passwords first in the 5-minute preliminary attack, followed by another attack trying all 6-digit combinations matching potential dates of birth during the next 1.5 hours. Only if both these attacks fail, the tool starts the full brute-force attack, which takes up to 21 hours to complete.

Physical Acquisition is Back

Physical acquisition (as in “imaging the data partition”) is back, albeit on a limited number of models. Currently supporting the iPhone 4, 5 and 5c (no iPhone 4s this time), the Toolkit can create and decrypt a bit-precise image of supported iPhone models. Moreover, if the iPhone is running iOS 4 through 7, the imaging works even without breaking the passcode! For newer versions of iOS you’ll have to break the passcode first, and image after. Needless to say that keychain decryption is also supported on these legacy models.

Release notes:

• Support for iPhone 4 is back due to popular request
• iPhone 4 and 5: passcode unlock is implemented
• iPhone 4, 5 and 5c: full physical acquisition (decryption of disk image) is implemented
• iPhone 4 and 5: keychain is now acquired in XML format