Extract critical evidence from Apple iOS devices in real time. Gain access to phone secrets including passwords and encryption keys, and decrypt the file system image with or without the original passcode. Physical and logical acquisition options for all 64-bit devices running all versions of iOS.

Perform full file system and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image.

• Full file system extraction and keychain decryption

• Logical acquisition extracts backups, crash logs, media and shared files

• Passcode unlock and physical acquisition for legacy devices

• Extracts and decrypts protected keychain items

• Repeatable, forensically sound extraction for select iPhone and iPad models through modified bootloader

• Automatically disables screen lock for smooth, uninterrupted acquisition

Supports: all generations of iPhone, iPad, iPad Pro and iPod Touch, all generations of Apple Watch, Apple TV 4 (HD), all generations of Apple TV 4K; full file system acquisition for select models and versions via extraction agent, Perfect Acquisition and bootloader methods; on-device passcode unlocking for select devices.

Compatible Devices and Platforms

iOS Forensic Toolkit supports advanced logical extraction, agent-based and bootloader-based low-level extraction methods.

Advanced logical extraction:

• Supports all Apple iPhone, iPad, and iPod Touch models regardless of iOS version

• Limited support for Apple Watch and Apple TV devices

• Extended device information including list of installed apps

• iTunes-format backup (includes many keychain items)

• Media files and shared files, even if the backup is password-protected

Agent-based extraction:

• Supports all Apple iPhone, iPad, and iPod Touch models subject to iOS version support

• iOS/iPadOS 12.0 through 18.7.1 supported on compatible devices

• iOS/iPadOS 26 and 26.0.1supported on compatible devices except those based on A19 and M5 chips

• For compatibility, please refer to the chart below

• Extracts full file system image and keychain

Bootloader-level extraction:

• For 64-bit devices, extracts full file system image and keychain

• HomePod (first generation); full checkm8 extraction; requires a custom 3D-printable USB adapter (macOS and Linux editions)

• Apple Watch (checkm8 for Apple Watch S0-S3, logical extraction for Apple Watch S0 through S10, SE, SE2, Ultra, Ultra 2); requires a third-party adapter; checkm8 extractions supported in macOS and Linux editions only

• Apple TV 4 (cable connection) and Apple TV 4K (Mac and Linux editions)

• Partial file system & keychain acquisition for BFU, locked and disabled iPhone models ranging from the iPhone 5s through iPhone X

• iPhone 3GS, 4, 4s, 5, 5c, 5s, 6, 6s, SE, 7, 8, X, iPod Touch 5, 6, 7, iPad 2, 3, 4, 5, 6, 7, iPad Mini 1, 2, 3, 4, iPad Air 1, 2, iPad Pro 1, 2, Apple TV 3, 4, 4K, Apple Watch S0-S3: forensically sound bootloader-level extraction (macOS and Linux editions)

• iPhone 3GS, 4, 4s, 5 and 5c, iPhone 6, 6 Plus, iPod Touch 6, iPad Mini 4, and iPad Air 2: physical acquisition with bit-precise imaging (macOS and Linux editions)

• iPhone 3GS, 4, 4s, 5 and 5c, iPhone 6, 6 Plus, iPod Touch 6, iPad Mini 4, and iPad Air 2: passcode unlock (macOS and Linux editions)

• For legacy 32-bit devices, images and decrypts the data partition
  
  

New features

• Extraction agent: full support for iOS 16 and 17, iOS 18 up to 18.7.1, and iOS/iPadOS 26 and 26.0.1
  Low-level extraction via the agent now covers the entire range of iOS and iPadOS 16 and 17, as well as the 18 branch up to version 18.7.1. We have also added support for builds 16.7 through 16.7.15, which are currently the most recent updates available for iPhone 8, 8 Plus, X, and several older iPad models. On system versions 16.7 and higher (including all iOS/iPadOS 17 and 18), the method works on all iPhones and iPads with A11 and newer chips, including M-series processors.
  
  In addition, the extraction agent now supports iOS/iPadOS 26 and 26.0.1 on all compatible devices except those based on Apple A19 (iPhone 17 range) and M5 chips.

• Bootloader exploit: expanded OS version support
  In the latest update, we expanded the range of supported versions of iOS for bootloader-based extractions. All OS versions from 3 to 26 inclusive are now supported for all devices compatible with this method. The maximum supported version depends on the platform: for iOS it is 16 (with limitations on 16.x for iPhone 8, 8 Plus, and X models), for iPadOS it covers branches 17 and 18, while higher versions up to 26 are relevant only for tvOS and audioOS.