The latest update to Elcomsoft iOS Forensic Toolkit introduces full unlock and perfect acquisition capabilities for iPhone 6, iPhone 6 Plus, iPad Mini 4, iPad Air 2 and other A8/A8X devices, including on-device passcode recovery. In addition, low-level extraction is now supported for Apple TV 4 (HD), Apple TV 4K (1st gen) and HomePod devices running tvOS/audioOS 26.

Unlocking and extracting Apple A8/A8X devices with Perfect Acquisition

This update enables complete acquisition support for legacy devices - specifically, the iPhone 6, iPhone 6 Plus, iPod Touch 6, iPad Mini 4, iPad Air 2, Apple TV4 (HD), and Apple HomePod (1st gen) - even if the screen lock passcode is not known for those devices that support passcodes. Investigators can now perform full unlocks by running on-device passcode recovery for all possible versions of iOS running on these models; the recovery speed depends on the version of iOS and several other factors. This unlocking capability dramatically expands access to previously restricted devices.

Perfect Acquisition: the lowest-level extraction

Unlike traditional low-level extraction methods that acquire and decrypt a copy of the file system alongside the keychain, Perfect Acquisition captures and decrypts the entire disk image with bit precision. Perfect Acquisition is a unique technology we developed to enable precise and consistent low-level extraction for a limited set of devices. This new release finally brings passcode unlocking and low-level extraction to 64-bit devices equipped with Secure Enclave Processor, starting with Apple A8/A8X devices. In near future, support will be expanding to other models.

Low-level extraction for audioOS and tvOS 26

We finally added low-level extraction support via a bootloader exploit for Apple TV 4 (HD), Apple TV 4K (1st gen), and HomePod (1st gen) running all versions of audioOS and tvOS 26. Perfect Acquisition is supported for Apple TV 4 (HD) and HomePod, while Apple TV 4K relies on the traditional file system extraction.

iOS Forensic Toolkit 9.0 release notes

• unlocking: full passcode unlock with on-device passcode recovery for iPhone 6, 6 Plus, iPod Touch 6, iPad Mini 4, and iPad Air 2
• low-level extraction: Perfect Acquisition support for iPhone 6, 6 Plus, iPod Touch 6, iPad Mini 4, iPad Air 2, Apple TV 4 (HD), and HomePod (1st gen) with bit-precise data extraction and decryption
• tvOS/audioOS 26 support for Apple TV 4 (HD), Apple TV 4K (1st gen), and HomePod (1st gen)
• small bug fixes and improvements