Belkasoft Supports Full File System iOS Acquisition Without Doing Jailbreak

Belkasoft releases version 9.8 of its flagship digital forensic product Belkasoft Evidence Center. In this release two major features added, concerning iOS forensics:

• Acquisition of devices with checkra1n jailbreak installed
• Acquisition of some iOS devices without jailbreak

Support for checkra1n

Belkasoft Evidence Center supports full file system copy of devices having checkra1n jailbreak installed. The product can detect jailbreak presence and offers to create a full copy instead of iTunes backup. No Cydia install is required.

Support for acquisition without jailbreak

The product can also acquire image of an iPhone or an iPad without you doing jailbreak! The acquired image is the same full file system copy like the one obtained with jailbreak. This feature works on iOS 11 to 12.2 and 12.4 for iPhone 5S—iPhone X and also for iPads with similar processor types.

Below you can find a list of requirements to use this method:

• iPhone models: iPhone 5S—iPhone X (iPhone XR is not supported)
• iOS version: 11 to 12.2 and 12.4
• Apple Developer: You must have an Apple Developer ID
• Antivirus: Antivirus must be switched off otherwise it will delete the agent since it works like an exploit
• Internet connection: Internet connection should be switched on the computer with BEC (otherwise agent will not install)

Belkasoft Agent on an iPhone Being Acquired

Sign up for a webinar on iOS acquisition!

See also

Another jailbreak-free acquisition type: checkm8-based iOS acquisition by Belkasoft

What is new in Belkasoft Evidence Center version 9.8