Elcomsoft iOS Forensic Toolkit 10.11 adds bootloader-level extraction for the Apple Watch Series 4 and Series 5 and the second-generation Apple TV 4K. In each case the result is a full file system image and the decrypted keychain. This is the first time the low-level extraction boundary has moved past the A11 generation of Apple silicon.

The extraction is based on usbliter8, a new SecureROM exploit, published in June 2026. checkm8, which the Toolkit has used since 2019, covers Apple SoCs up to A11; everything newer stayed out of reach at the bootloader level for seven years. usbliter8 covers the next generation: the S4 and S5 systems in package in the Watch, the S5 in the HomePod mini, and the A12 Bionic in the Apple TV 4K 2nd gen. The vulnerability sits in the boot ROM, so the installed version of watchOS, tvOS, or audioOS makes no difference, and Apple cannot patch it on devices already manufactured.

The extraction is forensically sound just like our checkm8 implementation. The exploit and the acquisition code run in RAM, the device's own operating system is never booted, and the data partition is never altered or modified. Repeated extractions return the same image. The device passcode is required to unlock the data partition; else a limited BFU extraction is available.

For the Apple Watch, the file system image is the difference between a handful of media files and the actual record of what the user did. It includes:

• health and activity history, including heart rate and workout data
• low-level location logs
• keychain items, including stored passwords and tokens
• messages (SMS and iMessage), contacts, and call logs
• Wallet data
• system events: app activity, unlock events, network and Bluetooth usage

The Apple TV holds less personal data, but the set top box holds accounts, authentication tokens, paired device records, network history, and Siri-related artifacts, which is often enough to place a person in a location at a time or to connect a device to an Apple ID.

The update also adds support for tvOS 26.5 and 26.6 and audioOS 26.5 and 26.6, and fixes a regression in checkm8 extraction that affected several legacy devices.

Extraction requires an inexpensive, commercially available adapter and board; both are listed in the manual, along with the procedure for putting the device into DFU. The exploit implementation is published at github.com/Elcomsoft/usbliter8.

Release notes

• bootloader exploit: added keychain and full file system extraction for Apple Watch S4 & S5
• bootloader exploit: added keychain and full file system extraction for Apple TV 4K 2nd gen
• added support for tvOS 26.5 & 26.6
• added support for audioOS 26.5 & 26.6
• fixed: checkm8 extraction for some legacy devices