Launch the Toolkit ( Toolkit.cmd on Windows or mand on macOS). If requested, you will have to unlock the device and enter the passcode for pairing. Do not forget to clear the ‘quarantine’ flag from DMG file on Catalina and Big Sur before mounting it (see Installing and using iOS Forensic Toolkit on macOS 10.15 Catalina).Ĭonnect the device in the powered-on state with a Lightning cable and establish trust relationship if needed. On macOS, the Toolkit is now distributed as password-protected DMG file (in older versions, the DMG was not protected with a password, but packed into RAR archive with a password). Install iOS Forensic Toolkit 6.60 or newer. To extract the file system and decrypt the keychain from an iOS device without a jailbreak, follow these steps.
Steps to extract the file system and decrypt the keychain This covers devices ranging from the iPhone 5s through iPhone 11 Pro Max if they run one of the versions of iOS mentioned above. Starting today, users of iOS Forensic Toolkit 6.60 and subsequent releases will be able to perform the complete extraction (file system and keychain) of Apple devices running all versions of iOS starting with iOS 9.0 through iOS 13.7 (up from the previously supported iOS 13.5). We are continuously working on extending the agent’s compatibility. Agent-based extraction provides numerous benefits over jailbreak-based acquisition, being a lot safer, a lot faster, and a lot more robust. Once installed, the agent automatically escapes sandbox, escalates privileges and establishes a communication channel with the computer. This all-in-one extraction method utilizes an extraction agent of our own development. We were never completely satisfied with the workflow, and so we developed a different method for accessing the data that does not require a jailbreak. While decidedly not forensically sound, this process was the only chance of accessing the full content of the device including all keychain records, private chats and application data not included in backups.
That workflow largely relied upon publicly available jailbreaks.
Years ago, we developed a workflow to allow experts imaging the device’s file system and decrypting the keychain. When extracting an iOS device, one needs low-level access to the device. For the first time, full file system extraction and keychain decryption are possible on all devices running these iOS versions. After adding jailbreak-free extraction for iOS 13.5.1 through 13.7, we now support every Apple device running any version of iOS from 9.0 through 13.7 with no gaps or exclusions.
0 kommentar(er)
