Elcomsoft iOS Forensic Toolkit 8.23 expands bootloader-level checkm8-based extraction support, adding support for the latest available iOS 15 and 16 builds. The newly supported OS versions include iOS/iPadOS/tvOS 15.7.6 and 16.5. Thanks to the expanded range of supported OS versions, the tool now supports the full range of of iOS 15 and 16 builds on checkm8-vulnerable devices.

The latest update to Elcomsoft's iOS Forensic Toolkit 8.23 brings exciting news for investigators and forensic professionals. The new update adds low-level extraction support for devices vulnerable to checkm8 and running iOS versions 15.7.6 and 16.5, thus completely covering all publicly released builds of iOS/iPadOS/tvOS 15 and 16. The extraction is available on all supported devices, and is subject to limitations.

This new update offers enhanced capabilities for forensic professionals, providing them with the ability to extract and analyze data from Apple devices running all versions of iOS 15 and 16. With its expanded compatibility and comprehensive extraction features, Elcomsoft continues to offer one of the most powerful and efficient mobile forensic tools on the market.

In addition, we’ve done a lot of work under the hood to iron out the quirks arising on specific combinations of hardware and software, and resolve issues reported by our users.

Compatibility and limitations

Bootloader-level extraction now supports a wide range of hardware and iOS builds but is subject to limitations depending on the combination of hardware and software.

iOS 15 extraction is supported on all checkm8-vulnerable devices including all iPhone, iPad, and Apple TV models compatible with checkm8 extraction. Removing the screen lock passcode prior to extraction is required for iPhone 8, 8 Plus, and iPhone X devices running iOS 14 and 15; on these devices, we recommend using agent-based extraction.

tvOS 16 is supported for all Apple TV models compatible with checkm8. iPads running iPadOS 16 may require removing the screen lock passcode prior to extraction, while the extraction of iPhone 8, 8 Plus, and iPhone X devices is only supported if no screen lock passcode was ever used on the device since initial setup. For unsupported devices, agent-based low-level extraction is available for certain versions of iOS. We are working on adding support for iOS versions up to and including iOS 16.3.1, which is scheduled to be released later this summer.

Elcomsoft iOS Forensic Toolkit 8.23 release notes:

• checkm8: Added support for iOS/iPadOS 15.7.6
• checkm8: Added support for iOS/iPadOS 16.5
• bugfix: Fixed some specific issues with HFS decryption
• bugfix: Fixed some checkm8-related problems on specific devices
• Multiple other bugfixes and compatibility improvements