Elcomsoft Phone Viewer

Discover the contents of local and cloud backups created by all iOS versions and analyze the synced data available in Apple iCloud and Microsoft accounts! Elcomsoft Phone Viewer is a small, lightweight tool that provides read-only access to contacts, messages, call logs, notes and calendar data in mobile backups. In addition, the tool displays essential information about the device such as model name, serial number, date of last backup, etc. Finally, the tool implements access to deleted SMS and iMessages saved in iOS backups.

The perfect assistance software for displaying

Yet another forensic tool for displaying data? Obtaining data is not everything - displaying the data obtained quickly, clearly and completely is at least as important in investigative work. Customers ofElcomsoft Phone Breakerwanted a tool that was fast, cross-platform and easy to use. We then developed our own software to meet these expectations.

As an assistant software, Elcomsoft Phone Viewer is ideal for use in conjunction with other mobile forensics programs. Users who recover data with Elcomsoft Phone Breaker appreciate having a tool that is perfectly tailored to analyzing the data obtained. Thanks to regular updates and support for the latest backup formats, Elcomsoft Phone Viewer also works with other mobile investigation tools.

Please note that Elcomsoft Phone Viewer can only read unencrypted backups and iTunes backups with a known password. In case of a backup file encrypted with an unknown password, it is recommended to use Elcomsoft Phone Breaker to recover the password.

Analysis of online activities

Elcomsoft Phone Viewer displays the user's online activity, including browsing history, search queries, bookmarks, and snapshots of open tabs. Information about recent searches and recently visited websites has helped solve several cases and will certainly be a great help in solving future crimes.

Access to synchronized data, passwords and messages

Information such as call logs, contacts, notes, calendar entries, and browser activity including browsing history (including deleted entries), bookmarks, and open tabs in Safari can be synced to Apple's servers. Unlike iCloud backups, which can be created daily, information is synced to Apple's servers just minutes after the actual activity. Once uploaded, this synced data can be stored for months without the end user being able to delete the data or disable syncing.

Synced records can be retained for longer periods of time; much longer than in iOS devices and device backups. Both existing and deleted records are displayed and filters can be applied to list only deleted records.

Elcomsoft Phone Viewer is the tool for viewing synced data extracted from iCloud with Elcomsoft Phone Breaker. The following synced data can be viewed:

• Messages in iCloud: along with attached media files and documents
• Safari (website history, bookmarks, open tabs on the user's device)
• Voice memos
• Calendar, notes and contacts
• Call logs (information about outgoing and incoming calls)
• Apple Maps (routes, places, search)
• Wi-Fi (Wi-Fi access points, MAC address, date and device)
• Wallet (everything except payment details)
• Account information (comprehensive information about the user and devices registered with an Apple ID)

Multimedia Gallery

Elcomsoft Phone Viewer can also display multimedia files such as images and videos created with the smartphone. To avoid chaos from thousands of images and files and a single confusing wall of thumbnails, all files are separated into categories. You can see straight away which images were taken with the camera or which were received as email attachments. You can also filter system and app-specific images, such as icons, logos and start screens. The multimedia gallery thus enables better navigation within a very large number of images.

Aggregated location data

In a given backup or image, multiple sources of location data may be available. Location data can be found in calendar events, map caches, and system logs. Geolocation is one of the most important EXIF ​​tags available. Elcomsoft Phone Viewer automatically extracts location data from multiple sources and maps the locations using OpenStreetMap. The ability to map GPS coordinates extracted from multiple sources can be extremely useful during investigations.

Apple Health data

Health data can serve as essential evidence in investigations. At a minimum, the data includes the number of steps, running and walking distances with precise timestamps that the user took. Significantly more evidence is available if the user is wearing a HealthKit compatible device such as the Apple Watch or a third-party fitness tracker. A variety of third-party apps can contribute significantly to health data.

Elcomsoft Phone Viewer can view health data stored in password-protected iTunes backups or file system images retrieved from iOS devices in TAR/ZIP format using Elcomsoft iOS Forensic Toolkit or GrayKey during physical extraction.

TAR Images: iOS File System

Since the launch of the iPhone 5s, Apple's first 64-bit iPhone, physical capture has had to be changed on newer versions. For all iPhone and iPad devices equipped with Apple's 64-bit processors, physical capture is only possible through file system imaging. Whether you perform a checkm8 extraction or use the extraction agent, the result is a TAR archive containing an image of the device's file system.Elcomsoft iOS Forensic Toolkitcreates TAR files as a result of the “F” (file system) command.

Elcomsoft Phone Viewer provides a handy tool for quick and easy analysis of evidence found in physical capture results.

Installed applications

The Applications View allows viewing information about the apps installed on the iOS device being analyzed. The expert can access the list of all apps installed on the device along with the date of acquisition (purchase date for paid apps or first installation date for the free apps). Additional information includes the app version, category and Apple ID used for the purchase. Since some of this information is not available in the backup, Elcomsoft Phone Viewer automatically requests additional data through an online connection via iTunes.

The Applications view gives experts an overview of which apps the user has used, which social networks they use, and which messaging tools they use to communicate.

Wi-Fi networks

The Wi-Fi View displays a list of saved Wi-Fi networks along with SSID (Service Set Identifier) ​​names and passwords. SSID and MAC address of each visited Wi-Fi network are visible. Additional network parameters include network BSSID and encryption standard. In addition, Elcomsoft Phone Viewer automatically extracts the date and time of the first and last network access.

Experts can sort the list by last connection time and track the user's activity by seeing which networks they connected to during a certain period of time.

iCloud Photo Library

Starting from version 2.30, Elcomsoft Phone Viewer can display photos from iCloud Photo Library read by Elcomsoft Phone Breaker. Automatic arrangement into albums and advanced filtering features are supported.

Access iOS notifications

Elcomsoft Phone Viewer allows viewing iOS notifications extracted from iCloud backups, as well as those from local backups created with iTunes. The tool can even display notifications from several years ago, except if they have already been read or dismissed by the user.

Notifications are an essential part of a mobile operating system and can contain large amounts of ephemeral, highly sensitive information. Almost all applications that are of forensic importance have a notification function. Email clients, instant messengers, taxi and travel apps, social networks and many other applications use push notifications. These messages, unless the user dismisses them, are stored in both local and cloud backups.

Support for EXIF ​​information

Elcomsoft Phone Viewer shows when and where the images were taken for all files. Full EXIF ​​data recorded by the camera provides insight into much more than just what is shown in the images. For example, it is possible to distinguish whether the image was actually taken with the smartphone in question or imported from another source. Searches for images in a particular time frame can also be carried out quickly thanks to the EXIF ​​data.

Fast Cloud Explorer

Elcomsoft Phone Viewer is the perfect tool for analyzing information in online backups downloaded from the cloud, while Elcomsoft Phone Breaker is the perfect tool to download mobile backups from iCloud. Use Elcomsoft Phone Breaker to quickly download selective information from Apple iCloud and review information acquired in Elcomsoft Phone Viewer. The two tools allow investigators to obtain essential information about the suspect, such as calls, messages, address books, and location history, in a matter of minutes.

Small. Fast. Practical.

Elcomsoft Phone Viewer is a perfect tool when time is of the essence. By using Elcomsoft Phone Viewer together with other ElcomSoft tools such as Elcomsoft Phone Breaker, investigators can save time by reviewing essential information in just a few moments. By quickly downloading selective information from Apple iCloud with Elcomsoft Phone Breaker and viewing acquired information in Elcomsoft Phone Viewer, investigators can obtain important information about the suspect such as calls, messages, address books and location history in a matter of minutes. The ability to view call and message databases with many thousands of entries, as well as full-text and category-based search and filtering, make navigating acquired information a breeze.

Export with one click

Export evidence in just a few clicks! You can export digital evidence obtained from iOS devices, including local and cloud backups, synced iCloud data, and file system images received as a result of physical capture. In addition, location data is exported in the industry-standard KML format. Elcomsoft Phone Viewer exports data in Microsoft Excel format, allowing experts to continue the investigation using their forensics product. The ability to export data from the many supported sources enables easy interoperability with the most commonly used forensic and analytical toolkits.

Convenient searching and filtering

Modern search options and convenient filter settings must not only be user-friendly, but also fast. Elcomsoft Phone Viewer filters results in real time. Full-text searches within seconds are important time advantages for investigators in an emergency. Contacts, call lists, notes and messages can be combed through using names, numbers and other available fields or with the full-text search.

With real-time filtering, you can choose to only display contacts from specific accounts such as Exchange, iCloud, Google or Facebook. Messages can also be filtered by type (SMS, MMS, iMessage), time period, folder type (inbox, outbox, drafts) or simply by full-text search.

Screen Time Passwords

Since iOS 12, the Screen Time password can be used to access privacy settings. The problem is that forensic experts can only access a limited amount of iPhone or iPad information once a Screen Time password is enabled and privacy and data protection restrictions are in place. Elcomsoft Phone Viewer is able to view iOS Screen Time passwords if they exist. For iOS 12, you can retrieve Screen Time passwords from password-protected iTunes backups. For all newer iOS versions, iCloud extraction is the only way to obtain Screen Time passwords.

Display of mobile backups

Elcomsoft Phone Viewer is a fast, compact tool that does not require a long training period. It is intuitive and easy to use for anyone. Even investigators who do not specialize in IT can use Elcomsoft Phone Viewer without having to deal with mobile IT forensics beforehand.

Analyzing keychain data

Elcomsoft Phone Breaker is the only tool on the market that can access, extract and decrypt iCloud Keychain, iCloud-based Apple system for storing and syncing passwords, credit card details and other highly sensitive information from different devices. Elcomsoft Phone Viewer can now view keychain data obtained from Apple iCloud using Elcomsoft Phone Breaker. The tool is not limited to iCloud Keychain only, but can also view keychain data obtained from password-protected local backups extracted with Elcomsoft iOS Forensic Toolkit from jailbroken devices or using the capture agent.

Decrypting and analyzing Signal conversation histories and secret Telegram chats

Elcomsoft Phone Viewer can decrypt Signal databases extracted from iPhone by physical capture. Experts using Elcomsoft iOS Forensic Toolkit open the file system image in Elcomsoft Phone Viewer and decrypt the Signal database using the extracted keychain file. Elcomsoft Phone Viewer then decrypts the database and displays its contents immediately.

Telegram supports secure chats. According to Telegram developers, all messages in secret chats use end-to-end encryption. Secret chats are device-specific. They are not part of the Telegram cloud and cannot be extracted using cloud capture. Elcomsoft Phone Viewer can view Telegram conversations and secret chats obtained from TAR images extracted using Elcomsoft iOS Forensic Toolkit.