RELEASE NOTES
December 2020

Elcomsoft iOS Forensic Toolkit
Version 6.60

Elcomsoft iOS Forensic Toolkit helps forensic experts perform
physical and logical acquisition of iOS devices, by imaging device
file system, extracting device secrets (passwords, encryption
keys and protected data) and decrypting the file system image.

Summary
Elcomsoft iOS Forensic Toolkit 6.60 extends the coverage for jailbreak-free extraction from iOS 9.0 all
the way through iOS 13.7, adding support to the last versions of iOS 13 ever released. The new release
expands the availability of the extraction agent, adding full file system and keychain decryption support
for previously unsupported versions of iOS 13.5.1 to 13.7 on all compatible iPhone and iPad devices.

Essential updates
File system extraction and keychain decryption for iOS 9.0–13.7
In Elcomsoft iOS Forensic Toolkit 6.60, we implemented jailbreak-free extraction tosupport the last remaining versions of iOS 13. The new release supports agent-based filesystem extraction and keychain decryption in the full range of iOS releases since iOS 9.0
all the way up to iOS 13.7 with no gaps or exclusions.

Support for a range of devices from iPhone 6s to iPhone Pro Max
All other devices starting with the iPhone 6s through iPhone 11 Pro Max are also fully
supported without a jailbreak if they are running any version of iOS between iOS 9.0
through iOS 13.7. For these devices, iOS Forensic Toolkit can pull the file system image,extract and decrypt the keychain in a forensically sound way and without the need toinstall a jailbreak.

Extended logical acquisition support for A14 devices
Devices equipped with A14 Bionic are fully supported without a jailbreak throughextended logical acquisition. Supported models include the entire iPhone 12 range andthe new iPad Air regardless of the iOS version. Extended logical acquisition can pull a
local backup, extract media files regardless of backup encryption password, and gain
access to certain system logs and app shared files.

Agent-based extraction
Agent-based extraction offers numerous benefits compared to all other extraction
method. The agent does not make any changes to user data, offering forensicallysound extraction without requiring Internet access on the device and without therisk of bricking. Using an Apple ID registered in Apple’s Developer Program is strongly
recommended for installing the agent. More about that in our blog article Why Mobile
Forensic Specialists Need a Developer Account with Apple. A workaround is available toMac users; more details in the blog article.

Version 6.60 change log◉◉◉◉

Added support for iOS 13.5.1 to 13.7 inagent-based acquisition
Improved overall agent-based acquisition
stability and performance
Improved support for iPhone 12 and new iPad
Air models (extended logical acquisition only)
Improved support for iOS 14.2 (extendedlogical acquisition only)◉◉◉

Fixed some problems when the product pathcontains spaces
Mac version of the product is now distributed
as password-protected DMG image
Added support for extended logicalacquisition of A14 Bionic devices including
the iPhone 12 range and the new iPad Air

Steps to renew
1. All active users of Elcomsoft iOS Forensic Toolkit are invited to obtain the new version 6.60 byentering product registration key in the online form: https://www.elcomsoft.com/key.html
2. Users having an expired license of Elcomsoft iOS Forensic Toolkit are welcome to renew theirlicense at corresponding cost that is available by entering registration key in the online form:
https://www.elcomsoft.com/key.html.
Contact us at sales@elcomsoft.com for any further questions on updating and license renewing.

www.elcomsoft.com
blog.elcomsoft.com
sales@elcomsoft.com