Elcomsoft Phone Breaker

Cloud capture from Apple iCloud and Microsoft Account

Cloud capture is an effective way to access up-to-date information stored by modern smartphones in the form of backups or using the synchronization feature in the respective cloud services. Elcomsoft Phone Breaker supports extraction of cloud backups and synchronized data from Apple iCloud and Microsoft account, enabling remote capture from iPhone and iPad devices, as well as Windows devices, Skype and other Microsoft software.

Online backups and synced data can be acquired by forensic experts without having the original iOS device in their hands. All that is needed to access online data in the cloud services is the user's credentials including the second authentication factor.

End-to-end encryption in iCloud

If the Apple ID and password are not available, Elcomsoft Phone Breaker can also be used to extract and use the authentication token from the iCloud Control Panel. This token can be used to bypass the entire two-factor authentication without requiring any further credentials.

iCloud Keychain

Elcomsoft Phone Breaker is the only tool on the market that accesses, extracts and decrypts iCloud Keychain, Apple's cloud system for storing and syncing passwords, credit card details and other highly sensitive information across different devices. Unlike authorizing a new Apple device, Elcomsoft Phone Breaker does not become part of the circle of trust and does not require a middleware device, allowing for truly forensic extraction of protected records.

Screen Time password

The Screen Time passcode is an optional feature in iOS that allows for content and privacy restrictions. Once the passcode is set, iOS will request the Screen Time passcode, e.g. when an expert tries to reset the device's backup passcode (iTunes backup passcode) in addition to the screen lock passcode. As a result, experts need two passcodes to reset the backup passcode: the screen lock passcode and the Screen Time passcode. Since the 4-digit Screen Time passcode is separate from the device lock passcode, it is managed with an additional layer of security that effectively blocks any logical sensing attempts.

By extracting and analyzing Screen Time information, experts can extract Screen Time passwords. This gives you the ability to reset the Screen Time lock and/or password protecting local (iTunes) backups. This in turn allows for easy logical capture.

iCloud Messages and Health App Data

Apple supports synchronization of messages and health data via iCloud. Elcomsoft Phone Breaker is the first tool on the market that can extract and decrypt messages with attachments and health data from iCloud. To access health data and messages, users must enter the login and password for the user's Apple account, one-time code for two-factor authentication, and a screen lock password or system password for one of the already logged in devices.

Extract Skype conversations, OneDrive and Vault files

The tool allows downloading Skype conversation histories, files, contact lists and metadata directly from the user's Microsoft account. Individual and group chats, text messages and attachments are extracted. Downloading the entire conversation of an average Skype conversation takes just a few minutes.

For deleted chats and messages, as well as for files deleted from Skype servers after the 30-day retention period, Elcomsoft Phone Breaker can retrieve metadata such as the date and time the file was deleted, the name and size of the file, the sender's Skype ID, and the name of the chat.

The tool can download files from the user's OneDrive. The downloaded files contain the data from OneDrive Vault, a protected cloud storage for keeping the most sensitive types of information. In addition, the tool can retrieve metadata for files that were recently deleted from OneDrive.

+ Device-based iCloud authentication

Use a trusted iPhone or iPad to perform iCloud extraction without having to enter a password or solve the two-factor authentication challenge. This new authentication method makes any type of data extractable, including cloud backups, iCloud photos, and synced data, including the end-to-end encrypted data types.

Download iCloud backups with selective access

iCloud backups are enabled by default and are created automatically every day when devices are charged and connected to a Wi-Fi network at the same time. Cloud backups contain a large amount of evidence, including third-party app data. Unlike local (iTunes) backups, cloud backups cannot be encrypted with a password. Apple does not provide any other way to download iCloud backups other than restoring them to a new device. Cloud backups can only be downloaded from the user's Apple account using a third-party tool such as Elcomsoft Phone Breaker.

The initial download of a large backup may take hours. Subsequent updates are incremental and much faster. When speed is of the essence, Elcomsoft Phone Breaker offers the ability to quickly capture selected information and skip data that takes the longest to download (such as music and videos). Information such as messages, attachments, phone settings, call logs, address books, notes, calendars, email account settings, recordings, and much more can be pre-selected and downloaded in just a few minutes, giving investigators near real-time access to essential information.

Note: This feature is only available in Forensic Edition

Restore password-protected Apple backups

Elcomsoft Phone Breaker provides forensic access to password-protected backups for smartphones and portable devices based on Apple iOS. The password tool supports all Apple devices running on iOS - including iPhone, iPad and iPod Touch devices of all generations.

Retrieve data from the cloud: Apple iCloud and Microsoft accounts

Cloud capture is a good way to retrieve information stored in mobile backups created by Apple iOS and a convenient alternative to scan Windows Phone and Windows 10 Mobile devices. Elcomsoft Phone Breaker can retrieve information from Apple iCloud and Microsoft accounts, provided that the user credentials for the account are known.

Online backups can be read by forensic specialists without having the original iOS or Windows device in hand. All that is needed to access online backups stored in cloud services is the original user data including Apple ID or Microsoft account along with the corresponding password. Accounts with two-factor authentication are fully supported.

Access iCloud without login and password

If the user's Apple ID and password are not available, Elcomsoft Phone Breaker can use an alternative authentication method.

First, the tool can use a binary authentication token to access a limited set of iCloud data. Using authentication tokens allows bypassing two-factor authentication even when access to the second authentication factor is not available. Authentication tokens can be extracted from Windows and macOS computers, hard drives, or forensic disk images using a built-in tool.

The second method provides full access to everything stored in the user's iCloud account, including end-to-end encrypted data. Instead of using a login and password, you can now authenticate to iCloud using the user's trusted iOS device. By using a trusted device, experts benefit from full access to all types of information stored in the user's iCloud account, including cloud backups, synced data, as well as end-to-end encrypted data, such as the user's passwords, browsing history, and health information. The trusted device must be unlocked and either jailbroken or running a version of iOS supported by Elcomsoft's extraction agent.

Synchronized data

iPhones automatically sync certain types of data with iCloud in real time. Elcomsoft Phone Breaker automatically downloads synced data such as call logs, contacts, notes, calendar entries, as well as browser activity including Safari history (including deleted entries and attachments), bookmarks, and open tabs. Unlike iCloud backups, which can be created daily, information is synced to Apple servers just minutes after the actual activity. Once uploaded, this synced data can be stored for months without the end user being able to delete the data or disable syncing.

Elcomsoft Phone Breaker supports the following types of synchronized data:

• Messages in iCloud: along with file and media attachments
• Health data (iOS 11+)
• iCloud Keychain
• Screen Time Passwords (12+)
• Safari (browsing history, bookmarks, tabs opened on the user's devices)
• Calendar, Notes, Contacts and Voice Memos
• Call lists (information about calls made and received) (iOS 12 and older)
• Apple Maps (routes, places, search)
• WLAN (WLAN access points, MAC addresses, date and device added)
• Wallet (everything except payment data)
• Account information (comprehensive information about the user and the devices registered to the Apple ID account)
• iBooks (documents including PDF files added by the user)

In addition, Elcomsoft Phone Breaker can extract FileVault 2 recovery keys from the user's iCloud account and use these keys to decrypt encrypted HFS+ disk images without a password.

iCloud files

In addition to iCloud backups, Elcomsoft Phone Breaker can download files stored in the user's iCloud account, such as documents and spreadsheets, data from third-party applications (such as WhatsApp's own backups, Apple Passbook/Wallet, etc.) and much more. From a synced Mac, files can be extracted from the Desktop or from the Recycle Bin. Some of this data (mostly documents) is available on Windows and macOS systems using the iCloud feature, but most of the files are only accessible with Elcomsoft Phone Breaker. The exact amount of available data may depend on the installed iOS version, iCloud sync settings, installed applications on the device connected to the scanned account and the options set in those applications. Please note that Apple does not send email notifications when files are downloaded from iCloud.

Attention: this function is only available in the Forensic version.

iCloud Photo Library

Apple's iCloud Photo Library allows users to store and sync media files between multiple devices. When iCloud Photo Library is enabled, media files are no longer stored in iOS iCloud backups. Accessing iCloud backups or downloading stored files from iCloud Drive does not automatically allow access to media files stored in iCloud Photo Library.

Elcomsoft Phone Breaker can read photos and videos from the user's iCloud Photo Library. In addition to existing files, Elcomsoft Phone Breaker can extract media files that have been deleted from the library. In our tests, we were able to recover photos that were deleted a long time ago, even earlier than 30 days ago. Selective downloads are possible by specifying which albums the user wants to download.

GPU Acceleration and Advanced Attacks

ElcomSoft offers a highly efficient, cost-effective solution for long-running attacks, where the speed of password discovery is dramatically increased when one or more supported graphics cards are present. Our company's GPU acceleration reduces the time required to discover passwords from iPhone, iPod, iPad and BlackBerry backups by orders of magnitude. The latest generation of Elcomsoft GPU acceleration technology supports an unlimited number of AMD or NVIDIA graphics cards.

Multiple different GPU acceleration units can be used simultaneously, allowing multiple generations of compatible graphics cards to be mixed to enhance existing systems by adding new acceleration hardware rather than replacing it.

Advanced dictionary attack with customizable mutations targeting the human factor and password reuse. The tool supports a wide range of mutations and tries hundreds of variants for each dictionary word to ensure the best possible chance of password recovery.

Attention: not applicable to the MacOS X version

Extract, decrypt and view passwords stored in the iOS keychain

iOS provides highly secure, encrypted storage for various types of data. Saved web forms, as well as browser passwords, email accounts, application passwords, and authentication tokens (including Apple ID account tokens) are stored securely in keychains, which are encrypted with hardware keys that are unique to each individual device.

Elcomsoft Phone Breaker can extract and decrypt the iOS keychain from local (iTunes) password-protected backups. The built-in Keychain Explorer makes it easy to search for individual keychain entries. Note: The keychain can only be decrypted when extracted from local password-protected backups.