We are excited to announce the release of BlackLight’s newest update, 2016R3.1. This release features many fixes and improvements, including iOS 10.2 encryption support and an updated EWMounter. Update your software or renew your license!
With Apple’s release of iOS 10.2 came a drastic increase in the encryption of its iTunes backups. Following that change, BlackBag has improved BlackLight’s ability to import both the iTunes encrypted backups from a Windows or Mac computer, as well as, importing data from an iOS device where the “Encrypt iPhone backup” setting has been selected.
When decrypting data from an iTunes backup or a physically attached iOS device, BlackLight will prompt the user to input the backup encryption password. As a reminder, this password is not normally the same as the device’s PIN code.
Once the password has been correctly provided, BlackLight displays information about the device in the Add Evidence window's center pane. In the right pane, the processing selection can be made, and the Start button can be selected to begin importing and decrypting the available data.
With BlackLight, we are also releasing its updated EWMounter application. EWMounter is now capable of being used on the newest Apple operating system, macOS Sierra, 10.12. EWMounter is designed to complement BlackLight, offering the examiner a choice of directly importing an E01 into BlackLight as an image, or first mounting the E01 and then importing the mounted volume into BlackLight. EWMounter will automatically mount the E01 in a read-only manner.
Don't have BlackLight to update it? Try it out first by requesting a software trial.