We are expanding our collection of free forensic tools with EIFT Firewall, a new companion application for Elcomsoft iOS Forensic Toolkit to safely sideload the low-level extraction agent. It's a macOS application that creates a temporary, controlled USB network path between the Mac and a connected evidentiary device. It runs on macOS only, and it replaces the macOS firewall script we published in 2023.

Sideloading the extraction agent requires the iPhone to contact a small number of Apple servers so that the signature can be validated. One of those addresses changes every few minutes. Everything else has to stay blocked: an evidentiary device with unrestricted Internet access resumes iCloud sync, becomes reachable by Find My, and can accept a remote lock or wipe command.

EIFT Firewall does not rely on macOS Internet Sharing. The application creates the network path itself and filters it with the same component, so there is no interval in which the path exists but the policy does not. Before the session can start, the application runs a read-only preflight that checks the selected iPhone interface, the upstream interface, the privileged helper, and whether an earlier session still needs recovery; if any of those cannot be confirmed, Start stays unavailable and the application names the condition that failed. For agent sideloading, the Apple Activation profile permits only approved activation services after restricted DNS enforcement and blocks everything else, including IPv6. The application fails closed: unplugging the device tears the path down instead of resuming it, and a session whose teardown cannot be verified blocks the next one. After the session, it writes a .tar.gz archive containing a forensic report, the profile receipt, session status and teardown result, connected-device details, the DNS decision log, the runtime log, and a manifest with SHA-256 hashes of the contents.

iOS Forensic Toolkit is a multi-platform forensic tool that helps practitioners perform full file system and logical acquisition of iPhone, iPad, and other devices from the Apple ecosystem. It images the device file system, extracts device secrets such as passwords and encryption keys along with protected data, and decrypts the file system image. Several low-level extraction methods are supported, as well as extended logical acquisition. The extraction agent is a tool to extract the full file system from modern Apple devices running modern OS builds.

The rest of the free tools cover different parts of the workflow. Elcomsoft Encrypted Disk Hunter locates BitLocker, VeraCrypt, and TrueCrypt containers and encrypted virtual machines on a live system, which is useful during triage. FSTOOL mounts HFS and APFS images from legacy iOS devices on Windows, where those file systems have no native support. picoScrollNScreenshot turns a Raspberry Pi Pico board into a semi-automatic capture rig for long scrollable screenshots, which sometimes yields data that no other acquisition method returns. All of them are free, and more are in development.