Elcomsoft iOS Forensic Toolkit – Advanced iOS Acquisition

Elcomsoft iOS Forensic Toolkit (EIFT)

The most complete and versatile toolkit for physical and logical acquisition of Apple devices.

View Pricing & Buy Now Request Trial Access

Acquire More Data Than Ever Before

EIFT provides deep, forensically sound access to iOS devices, regardless of device security status. It combines state-of-the-art physical imaging for legacy devices with advanced logical and Full File System (FFS) extraction for the latest models.

Physical Acquisition (Checkm8)

Leverage the Checkm8 exploit to perform a low-level, image-based acquisition of devices running on A7-A11 chips (iPhone 5s up to iPhone X), bypassing screen lock protection.

Full File System (FFS) Extraction

Acquire the full file system from modern iOS devices using advanced logical methods, including devices with jailbreaks or those in Developer Mode (iOS 17+).

Automated Keychain Decryption

Instantly decrypt and extract the contents of the iOS Keychain, recovering passwords, authentication tokens, Wi-Fi credentials, and encryption keys for applications.

Forensic Logical Acquisition

Extract iTunes backups, synchronized media, health data, and other sensitive information, ensuring the acquisition is tamper-proof and forensically verifiable.

Key Features for Forensic Investigators

Passcode Bypassing on Legacy Devices

The Checkm8 exploit allows physical data extraction even when the device is locked, providing access to a wide range of older iPhones and iPads.

Comprehensive iOS Version Coverage

Supports nearly all iOS versions, from legacy iOS 4 up to the latest public iOS releases, adapting acquisition methods to the specific security level of the OS.

Secure Enclave Data Extraction

Extracts all required encryption keys directly from the Secure Enclave processor during physical acquisition, enabling subsequent full-disk decryption.

Cross-Platform Command Line Tool

Provides a fast, scriptable, and highly reliable Command Line Interface (CLI) for macOS, Windows, and Linux, ensuring maximum compatibility across forensic workstations.

Targeted Data Acquisition

Allows forensic specialists to selectively download specific data categories (e.g., Photos, App Data) during logical extraction, saving time and storage space.

Evidence Integrity and Verification

Ensures operations are non-intrusive (read-only), generates SHA-256 hash digests for verification, and includes detailed logging for court reporting.

Technical & Coverage Details

Category Coverage
Acquisition Types Physical Image (Checkm8), Full File System (FFS), Advanced Logical (via Dev Mode), Standard Logical (iTunes backup).
Device Chip Support Checkm8: A7 through A11 Bionic (iPhone 5s - iPhone X). FFS/Logical: All chipsets (A12+ included) pending device preparation (e.g., jailbreak).
Key Artifacts Extracted iOS Keychain, Device Passcodes (hash), GPS History, Wi-Fi Connections, Safari History, Email, Messaging, and over 100 app databases.
Supported Platforms Fully portable Command Line Interface (CLI) for Windows, macOS, and Linux.
Data Integrity Read-only operation, generates secure hash digests (SHA-256) of all acquired data, comprehensive logging.

Uncover the Hidden Data in iOS Devices

Don't let Apple's security be a barrier. Access the deep evidence required for your investigation.

Order EIFT Now View System Requirements