Elcomsoft iOS Forensic Toolkit 8.56 makes an advance in checkm8-based bootloader-level extractions of certain Apple devices, now supporting iOS 7 on ARMv8 iPhones and iPads, and adding official support for iOS/iPadOS 16.7.8. In addition, the update can now cope with devices with an incorrect UDUD.

The update to Elcomsoft iOS Forensic Toolkit 8.56 brings several improvements to bootloader-level checkm8 extractions, adding support for iOS 7 on the iPhone 5s, iPad Mini 2/3, first-gen iPad Air, and introducing official support for iOS 16.7.8 and iPadOS 16.7.8.

Support for iOS 7 devices

This update added support for iOS 7 on specific devices. Previously, EIFT had a gap in its compatibility with iOS 7. Notably, pre-iPhone 6 models featured a unique architecture, leading to a lack of support for iOS 7 at that time. With this update, EIFT now fully supports iOS 7, ensuring gapless coverage across more devices.

Official support for iOS and iPadOS 16.7.8

The Toolkit now extends its bootloader-level extraction support to iOS/iPadOS 16.7.8, which is the latest iOS version available for iPhone 8 and iPhone X as well as some iPads. Notably, our implementation of checkm8 extraction generally supports new iOS versions out-of-the-box. However, for ‘unofficially compatible’ versions of iOS, the tool might not detect the correct OS version or provide download links, which applies to recent updates if they were released after your build of EIFT. This minor inconvenience has been addressed, ensuring that users can easily locate and obtain with the necessary firmware without having to manually search for it.

Please note that iOS 16 in general introduced a unique challenge with checkm8 support on iPhone 8, 8 Plus, and iPhone X devices. On these models, the extraction can only be performed if the device has never had a passcode set, a scenario that is quite rare in practice. The limitation does not apply to any iPad models. iOS 16.7.8 is available for the first-generation iPad Pro, iPad 5th and 6th generations, while newer models have already received iPadOS 17 and did not get the 16.7.8 update. Importantly, EIFT has implemented a unique feature where screen lock passcodes do not need to be removed on these iPad models, a functionality not offered by any other tool in the market.

Improved handling of problematic devices

The update also includes a bug fix that enhances EIFT’s performance with certain devices that do not return a correct UDID (Unique Device Identifier) when queried through standard protocols. The update ensures smoother operation and improved reliability when working with partially damaged or problematic devices.

iOS Forensic Toolkit 8.56 release notes

• checkm8: added support for iOS 7 on ARMv8 architecture devices (iPhone 5s, iPad Mini 2/3, first-gen iPad Air)
• checkm8: added support for iOS 16.7.8 and iPadOS 16.7.8
• checkm8: added support for devices with incorrect UUID