While this is the deepest and most comprehensive acquisition method, it is not applicable to modern devices.

When analyzing an old, 32-bit device such as the iPhone 4, 5 or 5c, one can make a bit-precise image of the data partition, decrypting everything down to the last bit. On the other hand, media files (including metadata) can be extracted regardless of the backup password, while log files may help recover some of the device usage timeline. Breaking the password might be time-consuming or not even possible depending on the length and complexity of the password, while resetting the password involves removing the screen lock passcode on the iPhone, which, in turn, has important consequences. This method is one of the most limited, too: both Apple and developers can restrict which parts of data are backed up, and the user can protect local backups with a password, which must be broken or removed in order to access the data. With logical acquisition, experts can make the phone create the full local backup of its data, pull pictures and videos, and obtain certain logs and shared files. This is the most universal and the most compatible extraction method based on Apple’s APIs and protocols. Speaking of iOS devices, there are several extraction methods of varying quality and applicability. With this exclusive jailbreak-free coverage experts will be able to image all iPhone models based on 64-bit SoC (iPhone 5s through iPhone 12). In the end, the tool delivers the complete, zero-gap coverage for iPhone devices without a jailbreak from iOS 9 onwards, up to and including iOS 14.3 on supported devices.

In addition, the toolkit can image other iPhone and iPad models running the same versions of iOS (iPhone 6s/SE models and newer).

The latest update of iOS Forensic Toolkit enabled jailbreak-free, low-level extraction of A14 Bionic devices, which includes the entire iPhone 12 model range, running the iOS versions 14.0 through 14.3. Learn how to image the latest iPhone models without a jailbreak. This includes the entire range of iPhone 12 models as well as all other devices capable of running iOS 14.0 to 14.3. IOS Forensic Toolkit 7.0 brings low-level extraction support for the latest generation of Apple devices.

Iphone backup extractor reddit