Information Technology Reference
In-Depth Information
Usage of EIFT
Elcomsoft iOS Forensic Toolkit can be used in two modes: guided mode and manual mode.
The USB dongle shipped with the toolkit must be connected to the computer while the
toolkit is running.
Guided mode
The guided mode features a menu-based user interface where you can accomplish typical
tasks by selecting the corresponding menu items. You can start the guided mode by double-
clicking on the
Toolkit.cmd
(Windows) or
Toolkit.command
(Mac OS X) file in
the directory where you have copied the toolkit files. This should open the terminal win-
dow and present a text-based menu as shown in the following screenshot:
The Elcomsoft iOS Forensic Toolkit welcome screen
When running in the guided mode, the toolkit logs all the activities to a text file. Each time
the toolkit is started, a new log file is created in the user's home directory and the output of
all the invoked commands as well as user choices are written to that file.
To perform the physical acquisition of iPhone 4 and older devices with EIFT, follow the
steps provided:
