iOS Forensic Toolkit 10.0 brings updates to both agent-based and checkm8 low-level extraction methods. This release expands device compatibility, introducing support for the iOS 18 and iOS 17 branches alongside comprehensive updates for iOS 16. It also includes several important bugfixes, improving passcode handling on legacy devices and resolving issues with agent installation and mounted images.

In this release, we focused on expanding agent-based extraction capabilities. The toolkit now supports extraction for the entire iOS 17 branch and adds initial iOS 18 support, covering versions 18.0 through 18.7.1. We’ve also added support for the latest builds of iOS 16.7 through 16.7.15, which is currently the latest update received by the iPhone 8, 8 Plus, iPhone X, and several iPad models.

To put it simply, agent-based extractions now cover the complete iOS 16 and iOS 17 branches, while iOS 18 is covered in versions 18.0 through 18.7.1. This newly added support is added for all compatible iPhone and iPad models based on A-series chips; for M-based iPads, the maximum supported version of iPadOS remains 16.6.1.

Bootloader-level checkm8 acquisition has also been updated to support recent software updates on a range of devices. This includes support for iOS and iPadOS 15.8.7, 16.8.8 (limitations apply to A11 devices), 16.7.15, and 18.7.5 across compatible iPhones, iPads, and iPod Touch models. Furthermore, checkm8 support now extends to Apple TV (tvOS 26.3 and 26.4) and Apple HomePod (audioOS 26.3 and 26.4).

Finally, we improved extended logical acquisition support for the latest iOS 26 family, including iOS/iPadOS 26.4. The enhanced method can now extract additional shared files that aren’t otherwise available via regular local backups.

iOS Forensic Toolkit 10.0 release notes

Agent-based extraction

• Added support for iOS 16.7 to 16.7.15 (iPhone 8, 8 Plus, X, and most compatible iPads)
• Added support for iOS 17.0 to 17.7.8 (iPhones and most compatible iPads)
• Added support for iOS 18.0 to 18.7.1

Checkm8 acquisition

• Added support for iOS 15.8.7 (iPhone 6s/6s Plus/7/7 Plus/SE, iPod Touch 7th gen)
• Added support for iOS 16.8.8 (iPhone 8/8 Plus and iPhone X; limitations apply)
• Added support for iPadOS 15.8.7 (iPad Mini 4, iPad Air 2)
• Added support for iPadOS 16.7.15 (iPad 5th gen, iPad Pro 1st gen)
• Added support for iPadOS 18.7.5 (iPad 7th gen)
• Added support for tvOS 26.3 and 26.4 (Apple TV HD and Apple TV 4K 1st gen)
• Added support for audioOS 26.3 and 26.4 (Apple HomePod 1st gen)

Extended logical acquisition

• Improved extended logical acquisition support for iOS/iPadOS 26, expanding the amount of extractable shared data

Bugfixes and improvements

• Improved handling of passcode lengths on legacy devices
• Fixed agent installation issues
• Enhanced error handling and diagnostics
• Resolved an issue with the local firmware path
• Fixed a problem with copying files from mounted images

Known problems and limitations

• Some APFS images obtained via "perfect acquisition" (utilizing the bootloader-based exploit) cannot be mounted on Windows.
• Agent-based extraction for iOS 16.7, iOS 17 and iOS 18 works with all devices utilizing the A11 SoC (iPhone 8, 8 Plus, and X) through the A18 and A18 Pro (iPhone 16 series). This includes iPads with A-series SoCs, but excludes those with M-series SoCs.
• The extraction agent exploit is currently less stable on A18 devices (iPhone 16 series) and may cause the device to reboot; successful extraction may require multiple attempts.