Exploring iPadOS, tvOS and audioOS 17 and 18 Devices: File System and Keychain Extraction🔈

The latest update to iOS Forensic Toolkit brought bootloader-level extraction to a bunch of old iPads, Apple TVs, and even the first-gen HomePod running OS versions 17 and 18. This enabled full file system and keychain extraction on a those older Apple devices that can still run these versions of the OS.

What’s new in the Elcomsoft iOS Forensic Toolkit 🖥

Speaking of iOS Forensic Toolkit 8.81, the update extends bootrom (checkm8) extraction to cover iPadOS, tvOS and audioOS builds from the latest major families (17 and 18) on a defined set of older devices, adding the ability to perform full file system dumps and decrypt the keychain.

More details in our article:
✍️https://blog.elcomsoft.com/2025/11/exploring-ipados-tvos-and-audioos-17-and-18-devices-file-system-and-keychain-extraction/

#EIFT #updating

Elcomsoft System Recovery 8.36 adds Windows Server 2025 support, BitLocker key exporting, and enhanced SRUM analysis

This update introduces support for the newest Windows Server 2025 Active Directory database (ntds.dit), allowing investigators to extract, analyze, and recover credentials and directory data from up to date systems. Version 8.36 also adds the ability to export BitLocker keys discovered in the Active Directory database of Windows Server 2025, along with reporting, giving examiners the ability to identify, extract, and document recovery keys for encrypted volumes directly from the system under investigation💻

The update enhances Forensic Tools data export with new options to save extracted evidence in CSV and XML formats, in addition to the already available plain text exporting💡

More information on the website at the link ✍🏻
#ESR #updating

Eighteen Years of GPU Acceleration🎉

Eighteen years ago, before “GPU acceleration” and “AI data center” became household terms, a small hi-tech company changed the rules of cryptography. In 2007, we unveiled a radical idea – using the untapped power of graphics processors to recover passwords, which coincided with the release of video cards capable of performing fixed-point calculations. What began as an experiment would soon redefine performance computing across nearly every field.

Let's talk about questions:

❓What Happened in 2007
❓Beyond Gaming: The Rise of GPU Acceleration Everywhere
❓How GPU Acceleration Works

Not as Simple as It Sounds...

And also...a major update is coming❗️

More in our new article📎

Choosing the Right Strategy: Cold Boot Forensics vs Live System Analysis🔎

The first steps of an investigation are rarely straightforward. Do you shut down the system and image the storage media, taking the safe but slow traditional path? Do you run a triage tool on the live system to grab passwords and keys, or do you reboot into a clean forensic environment?

Traditional wisdom might suggest pulling the plug to preserve the state of the disk, but modern encryption makes this increasingly difficult📊

During the initial stage of an investigation, the choice usually falls between two primary strategies: deploying a live triage tool on the running system or booting into a clean, external environment🖥

In this article, we look at the trade-offs between Elcomsoft Quick Triage and Elcomsoft System Recovery to help you decide which tool fits the scenario.

More in our new article📎

#EQT #ESR

iOS Forensic Toolkit 9.0: full unlocking and perfect acquisition support for iPhone 6/6 Plus and other Apple A8/A8X devices🔥

The latest update to Elcomsoft iOS Forensic Toolkit introduces full unlock and perfect acquisition capabilities for iPhone 6, iPhone 6 Plus, iPad Mini 4, iPad Air 2 and other A8/A8X devices, including on-device passcode recovery.

In addition, low-level extraction is now supported for Apple TV 4 (HD), Apple TV 4K (1st gen) and HomePod devices running tvOS/audioOS 26.

More information at the link 💡

#EIFT #updating

🆕Distributed Password Recovery Goes 64-bit: Ready for RTX 5090🆕

We have just released a major update to Elcomsoft Distributed Password Recovery. While the release notes might simply say “migrated to 64-bit,” the reality under the hood is far more complex and significant⚡️

This is not a cosmetic update or a simple recompile; it is a fundamental architectural shift necessitated by the evolution of GPU hardware. Put simply: if you want to use the latest NVIDIA RTX 50-series Blackwell GPUs for password recovery, you can no longer use 32-bit code❗️

Here is why we did it, why it took so long, and why it matters for your forensic lab⌛

Let's talk about:

💡The introduction and evolution of hardware acceleration
💡Under the hood: the EDPR architecture
💡The plugin problem
💡The migration struggle
💡The result: ready for RTX 5090

More information at the link 📎

#EDPR

🆕Low-Level Extraction for iOS 17 and 18🆕

We’ve just update iOS Forensic Toolkit to version 10.0, significantly expanding its low-level extraction capabilities for both the extraction agent and bootloader-based methods🔴

⚡️ Previously, agent-based extraction was capped at iOS 16.6.1. This release finally covers the remainder of the iOS 16 branch, and adds support for the entire iOS 17 branch as well as iOS 18 through 18.7.1;
⚡️We have also expanded checkm8 support to cover all the latest OS updates pushed by Apple on devices susceptible to the exploit;
⚡️Finally, we improved extended logical acquisition support for iOS/iPadOS 26, now pulling significantly more shared data than before.

In this update we are making the following changes:

▪️For quite a while, agent-based extraction hit a hard wall at iOS 16.6.1. Newer releases required more powerful exploits, or more exactly, a chain of exploits.
With version 10.0, we finally put the pieces of the puzzle together. First, we’ve added support for the remaining iOS 16 builds, covering iOS 16.7 through 16.7.15. More importantly, the agent now supports the entire iOS 17 branch (17.0 to 17.7.8) and introduces support for a range of iOS 18 versions (18.0 to 18.7.1);

▪️Checkm8 support now includes iOS and iPadOS 15.8.7, iPadOS 16.7.15, and iPadOS 18.7.5. We also added support for iOS 16.8.8, though keep in mind the usual checkm8 limitations still apply. Finally, if you are extracting smart home or media hardware, we updated coverage for tvOS and audioOS to versions 26.3 and 26.4;

▪️We’ve added extended logical extraction support for iOS 26, including iOS 26.4, which delivers significant forensic value: this newly improved method can pull massive amounts of "shared files".

More information at the link 📎

#EIFT #update

🆕Low-Level Extraction for M-Series iPads🆕

With the release of iOS Forensic Toolkit 10.01 we are extending low-level extraction capabilities to Apple tablets running up to iPadOS 18.7.1.

This update brings our extraction agent to the latest hardware, supporting not just A-series but also M-series iPads⚡️

We have also implemented support for the distinct memory layout found in high-end 1TB and 2TB iPad Pro models equipped with 16GB of RAM, which required a targeted engineering approach to handle the structural differences.

There is also a practical advantage to examining Apple tablets: their extended hardware lifecycle👣

Tablets are typically kept in service much longer than smartphones, with users routinely skipping multiple hardware generations before upgrading. Because of this longer operational life, examiners have a higher probability of encountering an older device running an exploitable version of iPadOS. This directly increases the chances of successfully deploying an extraction agent to acquire the full file system and the decrypted keychain.

More information at the link📎

#EIFT #update