New Breakthrough in iOS Acquisition for Digital Forensic Examiners.
Now you can Obtain a Complete, Jailbreak-free Extraction for the Latest Range of iPhone Devices.
An exciting development was recently announced by Elcomsoft Co. Ltd. The company has implemented low-level, jailbreak-free imaging of the entire iPhone 12 device range running iOS 14 through 14.3.
What’s Different?
Cornerstone Discovery digital forensic examiners can now leverage Elcomsoft’s iOS Forensic Toolkit 7.0 to gain access to a full range of iOS devices from the iPhone 5s to iPhone 12, running all versions of iOS 9 through 14.3 with no gaps or exclusions. This extraction works without a jailbreak by establishing a direct communication channel between the iPhone and the computer, enabling low-level access to the file system and keychain. This agent-based extraction offers numerous benefits compared to other acquisition methods as it does not make any changes to user data, therefore offering the most forensically sound extraction among available acquisition methods. The toolkit enables our digital forensic examiners to image the iPhone file system and pull and decrypt the keychain, which stores the user’s passwords, certificates, authentication tokens and keys.
What Does This Mean for You and Your Case?
This breakthrough enables our digital forensic examiners to gain access to the latest range of iOS devices and extract more digital evidence than ever — in the most forensically sound way.
Cornerstone digital forensics examiners can extract data from iOS devices that were previously impossible. This includes deleted iMessage, SMS, and MMS messages, emails, and end-to-end encrypted messages sent through various applications such as Telegraph, Signal, and WhatsApp — messages you would otherwise not receive from a subpoena to Apple or the mobile carrier.
Furthermore, this provides access to the Apple Keychain, which includes stored passwords across all of the user’s devices. This data can provide vital information to investigators and your case.
Already Completed a Forensic Examination on One of These iOS Devices?
Even if you completed a previous forensic examination on an iOS device, there may still be an opportunity for a skilled digital forensic examiner to provide new and relative content to your investigation.
This breakthrough allows our digital forensic examiners to find data previously hidden and unavailable to anyone without access to GrayKey, a service offered only to law enforcement. In addition, it levels the playing field and allows the private sector, as well as criminal defense attorneys, to access something previously reserved for a select group of law enforcement agencies: a full file system extraction for modern Apple iOS devices.
If you had a case or currently have a case that involves an iOS device, Cornerstone Discovery can help. This breakthrough allows our certified digital forensic examiners to perform iOS full file system extractions on a wide range of iPhones and Apple devices.
