iOS Forensic Toolkit 10.02 expands agent-based low-level extraction support, bringing compatibility with iOS/iPadOS 26 and 26.0.1.

In this release, we focused on expanding agent-based extraction capabilities. The previous update introduced preliminary support for these iOS/iPadOS versions, while iOS Forensic Toolkit 10.02 finally makes it official: the toolkit now fully supports agent-based full file system extraction and keychain decryption for most devices capable of running iOS/iPadOS 26 and 26.0.1.

The notable exceptions are iPhone 17 series and M5-based iPads. Agent-based extraction will not work on these devices due to the newly added hardware-backed Memory Integrity Enforcement, a feature that appeared in Apple A19 and M5 chips.

Read more about it in our blog: https://blog.elcomsoft.com/

iOS Forensic Toolkit is a command-line tool able to perform full file system and extended logical acquisition of iPhone, iPad and IoT Apple devices. The tool covers the entire range of Apple hardware and OS versions, implementing bootloader-based, agent-based, and logical acquisition paths.

iOS Forensic Toolkit 10.02 release notes

• Agent acquisition: added support for iOS/iPad 26.0 and 26.0.1 for most devices (except A19 and M5 chips)
• Extended logical acquisition: fixed the problem with crash & diagnostics logs acquisition (all devices)
• Extended logical acquisition: fixed the problem with Apple Unified Logs acquisition (Apple Watch)