Seven years after checkm8, iOS Forensic Toolkit 10.11 adds bootloader-level extraction for the Apple Watch Series 4 and Series 5, as well as the second-generation Apple TV 4K. In each case the result is the full file system image and the decrypted keychain. This is the first time that the low-level extraction boundary has moved past the A11 generation, and the reason is a SecureROM exploit called usbliter8, published in June 2026.

Why bother with a watch, a set-top box and a speaker

These devices come up in situations where the phone does not help. The iPhone is locked, damaged, or was never seized.

The Apple Watch is the most valuable of the three by a wide margin. It keeps its own copy of a large part of what the paired iPhone holds: health and activity records, location history including workout tracks written roughly once per second, SMS and iMessage, contacts, Wallet passes, network and Bluetooth events, watch unlock events, and a keychain with the user’s passwords. It also has a passcode, but it’s typically shorter than the passcode of an iPhone; the watch passcode is a four-digit numeric code by default, while iPhones typically have six-digit passcodes these days. A longer code can be set in the Watch app on the iPhone, but not alphanumerical, and hardly anyone does it anyway. In practice the watch code is often the first four digits of the the phone passcode or a short number the owner can produce.

The Apple TV comes second, and it has an advantage: the platform has no passcode at all. There is nothing to enter, nothing to pair, and no lockdown record to hunt for. What it holds is Wi-Fi passwords, an Apple account token, iCloud Photos metadata with full EXIF including location for images the box itself never stored, playback and usage records in knowledgeC, and, if it serves as a home hub, a timeline of what the other devices in the household were doing. Notably, this release adds support for tvOS 27, enabling investigators and forensic specialists to access the internals of the 27-th generation of Apple’s mobile OS for the first time.

The HomePod will come next. It trails the other two, though it is far from empty. The keychain typically carries Wi-Fi passwords for networks the speaker itself was never connected to, along with account tokens. The file system holds call records, location reports derived from Wi-Fi lookups, lists of paired and observed Bluetooth devices, alarms, and playback history with timestamps. Like the Apple TV, it cannot be protected with a passcode.

None of these devices has a backup service, so logical acquisition returns media files and logs and little else. Everything listed above sits behind file system access.

What we now support

The Apple Watch list is the long one. All model numbers are on Apple’s Identify your Apple Watch page.

• Apple Watch Series 4: A1977, A1978 (GPS); A1975, A1976 (North America) and A2007, A2008 (Europe, Asia Pacific, China mainland) for GPS + Cellular. Supported on watchOS 5 through 10.
• Apple Watch Series 5: A2092, A2093 (GPS); A2094, A2095 (North America) and A2156, A2157 (Europe, Asia Pacific, China mainland) for GPS + Cellular. Supported on watchOS 6 through 10.
• Apple Watch SE (1st generation): A2351, A2352 (GPS); A2353, A2354 (North America) and A2355, A2356 (Europe, Asia Pacific, China mainland) for GPS + Cellular. Supported on watchOS 7 through 10.

Those ranges cover every version of watchOS these watches can run, so the OS version is not a factor you need to check.

In addition, the second-generation Apple TV 4K is supported. Currently we support all versions of tvOS from 14 to 26; tvOS 27 support is coming later.

• Apple TV 4K, 2nd generation (2021), model A2169; see Identify your Apple TV model.

The first-generation Apple Watch SE is built on the same S5 package as the Series 5; its status will be covered in the article on watch extraction.

HomePod mini support is coming soon.

Everything that was already supported stays supported. The Apple Watch S0 through S3, the Apple TV up to and including the 4K 1st generation, and the original HomePod continue to be handled through checkm8, and the original HomePod and Apple TV HD additionally through Perfect Acquisition.

One exploit, multiple devices

The reason these four arrive together is that they share silicon. The Apple Watch S4 and S5 packages and the HomePod mini are all T8006; the Apple TV 4K 2nd generation runs an A12, which is T8020. The usbliter8 exploit, published by Paradigm Shift, covers A12, A13 and S4/S5.

The bug is in the USB controller itself and is triggered by malformed, undersized USB control packets. Ordinary host controllers in a Mac or PC cannot send packets that far out of spec, which is why the exploit needs a microcontroller board that implements the USB protocol on the wire and can emit anything at all. The vulnerability lives in SecureROM, so it cannot be patched by a software update, and it requires physical possession and DFU mode.

We published our own fork of the exploit, which you can find at github.com/Elcomsoft/usbliter8. The public version gives you two capabilities, neither of which fits a forensic workflow; our version adds read, write and execute primitives and BootROM signature patches, which puts it on the same footing as checkm8 and keeps the rest of the toolchain working unchanged. The reasoning is spelled out in A12 usbliter8 BootROM sigpatches. The practical consequence: our extraction method requires our firmware. The two go together.

You will need a Waveshare RP2350 USB-A board. While several boards exist based on the same chip set, they all require soldering; this one doesn’t.

Compiled firmware images are in the Releases section of the repository. To flash, hold the board’s button, plug it into the computer, and copy the file onto the volume that appears. The board itself costs under $10 and covers all four device families.

You will need a few more things

None of these devices offers a convenient port. The Apple Watch has a hidden diagnostic port under the band and needs a wired adapter; a universal wired adapter covering the S0 through S6 range costs under $150, and the expensive wireless adapters are only required from Series 7 onward, which this exploit does not reach anyway. The Apple TV 4K 2nd generation requires an adapter as well; we are testing options and are not naming one yet. The HomePod mini does have a USB-C port, which is a pleasant change after prying the base off a full-size HomePod, but a custom adapter is required to enter DFU mode and run the exploit. We have a working prototype in testing.

Each of these gets its own article with the hardware, the connection procedure and the exact commands.

Do I need a passcode?

Yes, you do for the Apple Watch. There is no recovery or attack path. No passcode means no extraction.

The Apple TV and the HomePod mini have no passcode.

Further reading

Our own articles on these devices:

• Apple Ecosystem: Overlooked Devices, the general map of what is possible on which model
• Forensic Insights into Apple Watch Data Extraction and iOS Forensic Toolkit Now Supports All Models of Apple Watch
• Apple Watch Forensics: The Adapters and More on Adapters
• Apple TV Forensics 03: Analysis and Breaking Barriers: First Full File System Extraction from Apple TV 4K Running tvOS 26
• Exploring iPadOS, tvOS and audioOS 17 and 18 Devices
• HomePod Forensics, in three parts: Pwning the HomePod, checkm8 and Data Extraction, Analyzing the Keychain and File System
• Extracting and Analyzing Apple sysdiagnose Logs, which is often the only route when no adapter is at hand

Work by others, worth reading in full:

• Mattia Epifani, Forensic Analysis of Apple IoT Devices, RSA Conference 2023; the accompanying datasets are the only public test data for these platforms
• RN Team, A journey into IoT Forensics, Episode 5: HomePod and the HomeKit environment
• Sarah Edwards, APOLLO and tvOS
• Max Bazaliy, Jailbreaking Apple Watch, Black Hat Europe 2017, still the most detailed public work on watchOS internals
• Luke Jennings, Matthew Sorell and Hugo Espinosa, Interpreting the location data extracted from the Apple Health database, DFRWS EU 2023
• Andrea Fortuna, Apple Watch forensics
• Ahmet Birinci, Security research on the HomePod mini

A call to the vendors

We can now produce full file system images and decrypted keychains from device classes that almost nobody parses. Search the release notes of the major analysis suites for tvOS or watchOS artifact support and you will come back empty; there is no public reference image for either platform, and the only public dataset is the one Mattia Epifani released for his RSAC lab in 2023.

So here is an open offer to Cellebrite, Magnet Forensics, MSAB, MOBILedit and Oxygen Forensics: we will provide a free license of iOS Forensic Toolkit to anyone who wants to build parsing for watchOS and tvOS images against real data. Write to us. It will be interesting to see who gets there first.

What is still out of reach

The Apple Watch Series 6 and later move to the T8301 package and are not affected. The third-generation Apple TV 4K runs an A15, and the second-generation HomePod an S7; neither is in range. For those, logical acquisition and sysdiagnose remain the options. Everything described here sits in ROM, which means the coverage does not expire with the next OS update.