Elcomsoft iOS Forensic Toolkit 8.55 makes a significant advance in checkm8-based bootloader-level extractions of many Apple devices, now waiving the requirement to remove the screen lock passcode in a broad range of cases.

The update to Elcomsoft's iOS Forensic Toolkit 8.55 brings important improvements enhancement to checkm8 extractions, dropping the requirement to remove the screen lock passcode for most devices where it was previously required. Notably, the update addresses the issue with iPadOS 16 extractions, where some devices required the passcode to be empty to proceed with the extraction.

In addition, we’ve added two new Linux editions: the Astra Linux edition for Intel-based computers, and the Linux-arm64 edition supporting the Raspberry Pi 5. At this point, the arm64 edition is highly experimental; more information and setup instructions will follow in our blog.

Screen lock reset no longer required for multiple devices

The following models previously required resetting the screen lock passcode during checkm8 extractions if running iOS 16: iPad Pro and iPad Pro 2, iPad 5, iPad 6, and iPad 7. However, for three devices (iPhone 8, 8 Plus, iPhone X) running iOS 14 or 15, one still must remove the screen lock passcode when using checkm8 extraction.

Removing the screen lock passcode during an investigation has several negative consequences: it compromises forensic integrity, leads to permanent data loss, risks remote wipe/lock via iCloud, may necessitate complex workarounds, and affects access to encrypted iCloud data. Therefore, it's discouraged unless absolutely necessary, with backups and careful consideration advised beforehand. For these reasons, we suggest using agent-based extraction instead that does not necessitate passcode removal.

More information in our blog: The Implications of Resetting the Screen Lock Passcode in iOS Forensics

This new update offers enhanced capabilities for forensic professionals, providing them with the ability to extract and analyze data from a wide range of Apple devices without having to remove the screen lock passcode. With its expanded compatibility and comprehensive extraction features, Elcomsoft continues to offer one of the most powerful and efficient mobile forensic tools on the market.

iOS Forensic Toolkit 8.55 Release Notes

• checkm8: passcode removal requirement dropped for many devices running iPadOS 16
• New edition: Linux-arm64
• New edition: Astra Linux
• Multiple minor bug fixes and performance improvements