I have a Sanderson sqlite forensic toolkit dongle, and the accompanying book ($600 cost) and Elcomsoft iOS Forensic Toolkit Version Version 8 dongle ($2000+) that I purchased a little over two years ago, I would like to donate if anyone is interested in playing around with these tools. Figured a student may not have access to these, and there isn't much of a secondary market for these. Whoever has the dongle basically holds the license, as the usb must be inserted and remain in place to run either of these pieces of software.
The Elcomsoft is a bit out of date now, it can't deal with the latest and greatest versions of iOS, but it covers quite a few devices and iOS versions nonetheless. And you can at least see how it works. Below is from the manual re what it can process.
I'd just ask for the cost of shipping, depending on where it's going. Sorry if this isn't the right place to put this. I hate for these to go to waste when they were so expensive. I'm a hobbyist now, used ot work in cybersecurity way back when, and just like to keep abreast of what's out there, thought someone else might want to do the same. Feel free to message me at [email protected] thanks!
A.1.1.1 Method 1
The following devices can be put into DFU mode with Method 1 as described in Section 4.1.1.1.
• iPod touch 6th gen: A1574
• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349
• iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516
• iPhone 5S (iPhone6,1/iPhone6,2): A1453, A1533, A1457, A1518, A1528, A1530 • iPhone 6 (iPhone7,2): A1549, A1586, A1589
• iPhone 6 Plus (iPhone7,1): A1522, A1524, A1593
• iPhone 6s (iPhone8,1): A1633, A1688, A1691, A1700
• iPhone 6s Plus (iPhone8,2): A1634, A1687, A1690, A1699
• iPhone SE (iPhone8,4): A1662, A1723, A1724
A.1.1.2 Method 2
The following devices can be put into DFU mode with Method 2 as described in Section 4.1.1.2. • iPhone 7 (iPhone9,1/iPhone9,3): A1660, A1778, A1779, A1780, A1853, A1866
• iPhone 7 Plus (iPhone9,2/iPhone9,4): A1661, A1784, A1785, A1786
A.1.1.3 Method 3
The following devices can be put into DFU mode with Method 3 as described in Section 4.1.1.3. • iPhone 8 (iPhone10,1/iPhone10,4): A1863, A1905, A1906, A1907
• iPhone 8 Plus (iPhone10,2/iPhone10,5): A1864, A1897, A1898, A1899
• iPhone X (iPhone10,3/iPhone10,6): A1865, A1901, A1902, A1903
A.1.1.4 Method 4
The following devices can be put into DFU mode with Method 4 as described in Section 4.1.1.4. • AppleTV 3 (AppleTV3,2): A1469
A.1.2 Physical acquisition
Physical extraction currently supports iOS 8.0 - iOS 16.0 for the following devices:
A.1.2.1 iPhone
• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349
• iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516
• iPhone 5S (iPhone6,1/iPhone6,2): A1453, A1533, A1457, A1518, A1528, A1530 • iPhone 6 (iPhone7,2): A1549, A1586, A1589
• iPhone 6 Plus (iPhone7,1): A1522, A1524, A1593
• iPhone 6s (iPhone8,1): A1633, A1688, A1691, A1700
• iPhone 6s Plus (iPhone8,2): A1634, A1687, A1690, A1699
• iPhone SE (iPhone8,4): A1662, A1723, A1724
• iPhone 7 (iPhone9,1/iPhone9,3): A1660, A1778, A1779, A1780, A1853, A1866 • iPhone 7 Plus (iPhone9,2/iPhone9,4): A1661, A1784, A1785, A1786
• iPhone 8 (iPhone10,1/iPhone10,4): A1863, A1905, A1906, A1907
• iPhone 8 Plus (iPhone10,2/iPhone10,5): A1864, A1897, A1898, A1899
• iPhone X (iPhone10,3/iPhone10,6): A1865, A1901, A1902, A1903
Note: physical extraction of iPhone 8, iPhone 8 Plus, iPhone X with iOS 14 and higher works only if passcode is not set
A.1.2.2 iPod Touch
• iPod touch 4th gen (iPod4,1): A1367 (not tested) • iPod touch 6th gen (iPod7,1): A1574
• iPod touch 7th gen (iPod9,1): A2178
26
A.1.2.3 iPad
• iPad (iPad1,1): A1219
• iPad 3G (iPad1,2): A1337
• iPad 4 (iPad3,4/iPad3,5/iPad3,6): A1458, A1459, A1460
• iPad Air (iPad4,1/iPad4,2/iPad4,3): A1474, A1475, A1476
• iPad Mini Retina (iPad4,4/iPad4,5/iPad4,6): A1489, A1490, A1491
• iPad Mini 3 (iPad4,7/iPad4,8/iPad4,9): A1599, A1600, A1601
• iPad Mini 4 (iPad5,1/iPad5,2): A1538, A1550
• iPad Air 2 (iPad5,3/iPad5,4): A1566, A1567
• iPad Pro (iPad6,3/iPad6,4/iPad6,7/iPad6,8): A1673, A1674, A1584, A1652
• iPad 2017 (iPad6,11/iPad6,12): A1822, A1823
• iPad Pro 2 (iPad7,1/iPad7,2,/iPad7,3/iPad7,4): A1670, A1671, A1701, A1709 • iPad 6 (iPad7,5/iPad7,6): A1893, A1954
• iPad 7 (iPad7,11/iPad7,12): A2197, A2200
A.1.2.4 AppleTV
• AppleTV 2 (AppleTV2,1): A1378 (not tested)
• AppleTV 3 (AppleTV3,2): A1469
• AppleTV 4 (AppleTV5,3): A1625
• AppleTV 4K (AppleTV6,2): A1842 (not tested)
A.1.2.5 Apple Watch
• Apple Watch S3 (Watch3,1, Watch3,2, Watch3,3, Watch3,4 ): A1858, A1859, A1860, A1861, A1889, A1890, A1891, A189
A.1.4 Agent-based acquisition
Agent-based acquisition is available for the following devices and iOS versions:
A.1.4.1 iPhone
• iPhone 5s, iPhone 6, iPhone 6s Plus: iOS 9.0 - 12.5.5
• iPhone 6s, iPhone 6S Plus, iPhone SE (1st gen), iPhone 7, iPhone 7 Plus: iOS 9.0 - 14.3 • iPhone 8, iPhone 8 Plus, iPhone X: iOS 11.0 - 15.3.1
• iPhone Xr, Xs, Xs Max: iOS 12.0 - 15.3.1
• iPhone 11, 11 Pro, 11 Pro Max, iPhone SE (2020): iOS 13.0 - 15.3.1
• iPhone 12, iPhone 12 Mini, iPhone 12 Pro, iPhone 12 Pro Max: iOS 13.0 - 15.3.1
• iPhone 13, iPhone 13 Mini, iPhone 13 Pro, iPhone 13 Pro Max: iOS 15.0 - 15.3.1
27
A.1.4.2 iPad
• iPad Mini 2 and 3, iPad Air (1st gen): iOS 9.0 - 12.5.5
• iPad 5th-7th gen, iPad Pro 1st and 2nd gen: iOS 9.0 - 14.3
• iPad Mini 5, iPad Air 3rd gen, iPad Pro 3rd and 4th gen, iPad 8th gen: iOS 12.0 - 15.3.1 • iPad 9th gen: iOS 13.0 - 15.3.1
• iPad Air 4th gen: iOS 13.0 - 15.3.1
• iPad Pro 5: iOS 14.5 - 15.3.1
• iPad Mini 6: iOS 15.0 - 15.3.1
A.1.4.3 iPod Touch
• iPod Touch 7th gen: iOS 12.0 - 14.3
Please note that for versions 15.2 to 15.3.1 only full file system extraction is possible, but no keychain yet.
A.1.5 Logical acquisition
Logical acquisition is supported for all iOS devices regardless of the installed version.
A.1.6 Passcode cracking
When performing physical acquisition with EIFT, passcode cracking is available for the following devices:
A.1.6.1 iPhone
• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349 • iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516
A.1.7 Disk decryption
When performing physical acquisition with EIFT, offline disk dump decryption is available for the following devices:
A.1.7.1 iPhone
• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349 • iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516
A.1.8 Hardware checkm8 exploit
Hardware based checkm8 implementation as described in Section 6.6, is currently available for the following devices:
A.1.8.1 iPhone
• iPhone 4s (iPhone4,1): A1387, A1431 A.1.8.2 iPod Touch
• iPod touch 5th gen (iPod5,1): A1421, A1509
28
A.1.8.3 iPad
• iPad 2 (iPad2,1/iPad2,2/iPad2,3/iPad2,4): A1395, A1396, A1397 • iPad 3G (iPad3,1): A1416
• iPad 3 (iPad3,2/iPad3,3): A1403, A1430
• iPad mini (iPad2,5/iPad2,6/iPad2,7): A1432, A1454, A1455
A.1.8.4 Apple TV
• AppleTV 3 (AppleTV3,1): A1427