The company is called Elcomsoft, and the newly expanded ability comes by way of an update to its iOS Forensic Toolkit. Specifically, the update allows the software to extract select keychain records in the BFU (Before First Unlock). That means it can pluck sensitive data from affected iPhone devices that have been powered off or rebooted, without having to enter in a passcode.
“In Apple’s world, the content of the iPhone remains securely encrypted until the moment the user taps in their screen lock passcode. The screen lock passcode is absolutely required to generate the encryption key, which in turn is absolutely required to decrypt the iPhone’s file system. In other words, almost everything inside the iPhone remains encrypted until the user unlocks it with their passcode after the phone starts up,” Elcomsoft explains.
Source: Elcomsoft
In addition, Elcomsoft has made it clear it cannot and will not help unlock iOS devices. Instead, its updated toolkit can help law enforcement officials and others get at the data inside an iPhone, without having to unlock it. no jailbreaking is required, either.
This even works on disabled devices, after a user has inputted an incorrect passcode 10 times in a row. At that point, Apple prompts the user to connect the handset to iTunes in order to completely reset the device, and the data on the iPhone is lost forever.
“Unless the Erase data option is enabled, the data is still there; it’s just not available for extraction via regular means. BFU acquisition still works even in this case, and you can even extract parts of the keychain,” Elcomsoft says.
Elcomsoft sells its iOS Forensic Toolkit for $1,495, and it looks like it’s available to anyone (not just law enforcement). It’s one of several recovery program the company offers.
‘).insertAfter(jQuery(‘#initdisqus’));
}
loadDisqus(jQuery(‘#initdisqus’), disqus_identifier, url);
}
else {
setTimeout(function () { disqusDefer(); }, 50);
}
}
disqusDefer();
function loadDisqus(source, identifier, url) {
if (jQuery(“#disqus_thread”).length) {
jQuery(“#disqus_thread”).remove();
}
jQuery(‘
‘).insertAfter(source);
if (window.DISQUS) {
DISQUS.reset({
reload: true,
config: function () {
this.page.identifier = identifier;
this.page.url = url;
}
});
} else {
//insert a wrapper in HTML after the relevant “show comments” link
disqus_identifier = identifier; //set the identifier argument
disqus_url = url; //set the permalink argument
//append the Disqus embed script to HTML
var dsq = document.createElement(‘script’); dsq.type = ‘text/javascript’; dsq.async = true;
dsq.src = ‘https://’ + disqus_shortname + ‘.disqus.com/embed.js’;
jQuery(‘head’).append(dsq);
}
jQuery(‘.show-disqus’).show();
source.hide();
};
function disqusEvent()
{
idleTime = 0;
}