iOS Forensic Toolkit 8.0 is officially released! Delivering forensically sound checkm8 extraction and a new command-line-driven user experience, the latest release becomes our most sophisticated mobile forensic tool.

checkm8 extraction

Released almost exactly three years ago, checkm8 came as a huge surprise. Exploiting a vulnerability in the bootloader of many Apple devices, including several generations of iPhones, iPads, iPod Touch, Apple Watch, and even Apple TV devices, checkm8 allows breaking into a device almost regardless of the version of iOS installed on these devices. The latest iPhone models that can be exploited include the iPhone 8, 8 Plus, and iPhone X devices (up to and including iOS 15.7). For 32-bit machines, the exploit can even be used to unlock devices with an unknown screen lock passcode.

Today, checkm8 is a common and widely accepted tool in the mobile forensic community. Multiple solutions exist, but none of them is perfect. We are yet to see a purely checkm8-based solution that does not borrow from checkra1n while offering repeatable extractions several times in a row, so we developed our implementation built from the ground up. As a result, there won’t be a trace left on the iPhone extracted with iOS Forensic Toolkit, not a single log entry, and not even a changed timestamp. How did we make it possible?

checkm8 is ideal when it comes to forensic extractions. By its very nature, the exploit does not need to modify the file system; all modifications are performed on the fly in the device’s volatile memory. Our implementation works entirely in the RAM; it does not boot the OS installed on the device and does not modify the data or system partition. To work, during the extraction process, you will need to download a matching copy of the original device firmware from Apple (the download link will be provided at the time of extraction).

Compatibility, System Requirements, and Limitations

The initial release of iOS Forensic Toolkit 8.0 is available for macOS computers and can be launched on both x86 and Apple Silicon (M1/M2) computers. Linux and Windows editions are in the works.

Our implementation of checkm8 extraction is available for 76 Apple devices, including a host of iPhone, iPad, iPod Touch, Apple Watch, and Apple TV models. We support several major OS releases ranging from iOS 7 through iOS 15.7 (with limited iOS 16 support) in three different flavors (iOS, tvOS, and watchOS) for three different architectures (arm64, armv7, and armv7k). We support 18 additional chips vulnerable to BootROM exploits, namely:

S5L8930, S5L8940, S5L8942, S5L8945, S5L8947, S5L8950, S5L8955, S5L8960, S5L8965, T7000, T7001, S8000, S8001, S8003, T8004, T8010, T8011, T8015

These chips include:

• 4 AppleTVs: AppleTV3,1 AppleTV3,2 AppleTV5,3 AppleTV6,2
• 40 iPads: iPad2,1 iPad2,2 iPad2,3 iPad2,4 iPad2,5 iPad2,6 iPad2,7, iPad3,1 iPad3,2 iPad3,3 iPad3,4 iPad3,5 iPad3,6 iPad4,1 iPad4,2 iPad4,3 iPad4,4, iPad4,5 iPad4,6 iPad4,7 iPad4,8 iPad4,9 iPad5,1 iPad5,2 iPad5,3 iPad5,4 iPad6,11, iPad6,12 iPad6,3 iPad6,4 iPad6,7 iPad6,8 iPad7,1 iPad7,11 iPad7,12 iPad7,2 iPad7,3, iPad7,4 iPad7,5 iPad7,6
• 25 iPhones: iPhone10,1 iPhone10,2 iPhone10,3 iPhone10,4 iPhone10,5 iPhone10,6, iPhone3,1 iPhone3,2 iPhone3,3 iPhone4,1 iPhone5,1 iPhone5,2, iPhone5,3 iPhone5,4 iPhone6,1 iPhone6,2 iPhone7,1 iPhone7,2 iPhone8,1 iPhone8,2 iPhone8,4 iPhone9,1, iPhone9,2 iPhone9,3 iPhone9,4
• Three iPods: iPod5,1 iPod7,1 iPod9,1
• 4 Watches: Watch3,1, Watch3,2, Watch3,3, Watch3,4

In response to checkm8, Apple attempted to strengthen the security of the latest vulnerable devices, the iPhone 7, 7 Plus, 8, 8 Plus, and iPhone X range, by hardening SEP protection. The increased security measures require removing the screen lock passcode before applying the exploit on the iPhone 8, 8 Plus, and iPhone X models running iOS 14 through 15.7. Yet, we overcame this protection for the iPhone 7 and 7 Plus.

iOS 16 support is limited. Days before the release of the final build of iOS 16, we were ready to roll out iOS Forensic Toolkit 8 with iOS 16 support on A11 devices. Apple’s last-minute change in the release version of iOS 16 included an unexpected SEP patch that broke checkm8 extraction completely. The patch effectively blocks the exploit from accessing the data if a passcode was ever configured on the device (even if subsequently removed). The new SEP hardening measures effectively prevent checkm8 extractions on most A11-based devices in circulation (the iPhone 8, 8 Plus, and iPhone X).

The complete compatibility matrix now looks as follows:

Passcode Unlock

checkm8 does not affect the Secure Enclave. It cannot be used to break the screen lock passcode, and without it, it cannot be used to decrypt most of the data in the file system (limited BFU mode access is still possible).

We can still unlock older Apple devices with no Secure Enclave by using checkm8 or another bootloader exploit. Such devices include the iPhone 4, 4s, 5, and 5c. Our tool can do everything from recovering the passcode to bit-precise physical extraction for these iPhone models. Note: the iPhone 4s requires additional hardware due to a specific USB controller (see checkm8: Unlocking and Imaging the iPhone 4s).

Unknown Passcode and BFU Extraction

As already mentioned, our solution can perform a limited BFU (Before First Unlock) extraction for 64-bit devices protected with an unknown screen lock passcode. In this mode, you can extract information that is not encrypted with a key derived from the screen lock passcode. This includes the call history log, account list, draft messages (SMS/iMessage), attachments (drafts only!), geolocation data, and app data. In addition, WAL files (write-ahead logs) to many databases can also be extracted.

checkm8 vs. Advanced Logical Acquisition

Advanced logical acquisition is the easiest and most compatible extraction method, including local backups, media files, crash logs, and shared files. Advanced logical extraction often delivers just enough data to jump-start the investigation. What is not included with the advanced logical process are many types of data, such as chats occurring in the most secure messaging apps such as Signal or Telegram, email messages, low-level system data, SQLite databases with their respective write-ahead logs, location data, and many system logs that may reveal every detail of device usage history. All that and much more is readily available when you use checkm8 extraction.

checkm8 or checkra1n?

The first checkm8-based solutions in mobile forensics were built with checkra1n, a public, closed-source jailbreak based on the open-source checkm8 exploit. checkra1n extractions deliver the same amount of data as any other low-level extraction method. However, checkra1n inevitably alters the device’s content, which impacts its use in mobile forensics.

Compared to checkra1n-based extractions, our checkm8 extraction process has the following differences:

• Repeatable, verifiable extractions
• Unaltered system and data partitions
• 100% of the patching occurs in the RAM
• Supports 76 devices, three different architectures, and several generations of iOS from iOS 7.0 through iOS 15.7 (with limited iOS 16 support)
• Passcode unlock available for armv7 devices (iPhone 4 through iPhone 5c)
• BFU (Before First Unlock) extraction supported
• Supports iPhone, iPad, iPod Touch, Apple Watch, and Apple TV devices

The Command Line

iOS Forensic Toolkit 8.0 brings a new, advanced user experience built around the command line. The command line enables complete control over every step of the extraction workflow, allowing experts to stay in control of every step of the process. Thanks to the command line, experts can also build scripts to automate specific routines.

Conclusion

With this update, Elcomsoft iOS Forensic Toolkit becomes the market’s most advanced iOS acquisition tool. The toolkit supports all possible acquisition methods, including advanced logical, agent-based, and checkm8-based low-level extraction.

ElcomSoft iOS Forensic Toolkit

Perform full file system and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image.

Unlock and Decrypt Protected Data

Book a session with our specialist to discover how Elcomsoft helps organization with their complete range of mobile and computer forensic tools, corporate security and IT audit products.