ElcomSoft iOS Forensic Toolkit 5.0-ios設備採集工具
ElcomSoftiOSForensicToolkit可執行iPhone，iPad和iPodTouch設備的物理和邏輯採集。圖像設備文件系統，提取設備機密（密碼，加密密鑰和受保護的數據）並解密文件系統映像，支持32位和64位iOS設備的物理採集，支持帶鎖定支持和鑰匙串提取的邏輯採集，即使設置了備份密碼，也可快速提取媒體文件和共享文件.

Languages:English| 
PerformphysicalandlogicalacquisitionofiPhone,iPadandiPodTouchdevices.Imagedevicefilesystem,extractdevicesecrets(passwords,encryptionkeysandprotecteddata)anddecryptthefilesystemimage.

-Physicalacquisitionfor64-bitiOSdevicesviajailbreak
-Logicalacquisitionextractsbackups,crashlogs,mediaandsharedfiles
-UnlocksiOSdeviceswithpairingrecords(lockdownfiles)
-Extractsanddecryptsprotectedkeychainitems
-Real-timefilesystemacquisition
-Automaticallydisablesscreenlockforsmooth,uninterruptedacquisition

EnhancedForensicAccesstoiPhone/iPad/iPodDevicesrunningAppleiOS
PerformthecompleteforensicacquisitionofuserdatastorediniPhone/iPad/iPoddevices.ElcomsoftiOSForensicToolkitallowsimagingdevices’filesystems,extractingdevicesecrets(passcodes,passwords,andencryptionkeys)anddecryptingthefilesystemimage.Accesstomostinformationisprovidedinstantly.Pleasenotethatsomemodelsrequirejailbreaking.SeeCompatibleDevicesandPlatformsfordetails.

PhysicalAcquisitionofiOSDevices
Physicalacquisitionistheonlyacquisitionmethodtoextractfullapplicationdata,protectedkeychainitems,downloadedmessagesandlocationhistory.Physicalacquisitionreturnsmoreinformationcomparedtologicalacquisitionduetodirectlow-levelaccesstodata.ElcomsoftiOSForensicToolkitsupportsjailbroken64-bitdevices(iPhone5sandnewer)runningmostversionsofiOS7through12.

LogicalAcquisitionwithKeychainExtraction
iOSForensicToolkitsupportslogicalacquisition,asimplerandsaferacquisitionmethodcomparedtophysical.LogicalacquisitionproducesastandardiTunes-stylebackupofinformationstoredinthedevice.Whilelogicalacquisitionreturnslessinformationthanphysical,expertsarerecommendedtocreatealogicalbackupofthedevicebeforeattemptingmoreinvasiveacquisitiontechniques.

LogicalacquisitionwithiOSForensicToolkitistheonlyacquisitionmethodsallowingaccesstoencryptedkeychainitems.Logicalacquisitionshouldbeusedincombinationwithphysicalforextractingallpossibletypesofevidence.

MediaandSharedFilesExtraction
iOSForensicToolkitofferstheabilitytoquicklyextractmediafilessuchasCameraRoll,books,voicerecordings,andiTunesmedialibrary.Asopposedtocreatingalocalbackup,whichcouldbeapotentiallylengthyoperation,mediaextractionworksquicklyandeasilyonallsupporteddevices.Extractionfromlockeddevicesispossiblebyusingapairingrecord(lockdownfile).

Inadditiontomediafiles,iOSForensicToolkitcanextractstoredfilesofmultipleapps,extractingcrucialevidencefrom32-bitand64-bitdeviceswithoutajailbreak.Whileaccesstoappdatawithoutajailbreakislimited,thisnewtechniqueallowsextractingAdobeReaderandMicrosoftOfficelocallystoreddocuments,MiniKeePasspassworddatabase,andalotmore.Theextractionrequiresanunlockeddeviceoranon-expiredlockdownrecord.Ifalockdownrecordisused,somefilesmaynotbeaccessibleunlessthelockscreenpasscodeisremoved.

PerformphysicalandlogicalacquisitionofiPhone,iPadandiPodTouchdevices.Imagedevicefilesystem,extractdevicesecrets(passwords,encryptionkeysandprotecteddata)anddecryptthefilesystemimage.

AllFeaturesandBenefits
-PhysicalAcquisitionfor32-bitand64-bitiOSDevices
-LogicalAcquisitionwithLockdownSupportandKeychainExtraction
-AccessMoreInformationthanAvailableiniPhoneBackups
-KeychainRecovery
-PasscodeRecovery
ReleaseNotes:

-AddedfullfilesystemacquisitionandkeychaindecryptionforiOS12(withjailbreak)
CompatibleDevicesandPlatforms:
-64-bitiOSdeviceswithjailbreak:physicalacquisition(filesystemextraction,keychaindecryption)
-AppleTV4(cableconnection)andAppleTV4K(wirelessconnectionthroughXcode,Maconly)
-AppleWatch(allgenerations);requiresathird-partyIBUSadapter
-Nojailbreak:advancedlogicalacquisitiononly[1]

Logicalacquisitionincludes:
-Extendedinformationaboutthedevice
-iTunes-formatbackup(includesmanykeychainitems)
-Listofinstalledapps
-Mediafiles(evenifthebackupispassword-protected)
-Sharedfiles(evenifthebackupispassword-protected)

SystemRequirements:
-WindowsServer2016
-WindowsServer2012
-Windows7(32bit)
-Windows7(64bit)
-Windows8
-Windows8.1
-Windows10

Homepage
https://www.elcomsoft.com