Elcomsoft Phone Breaker

Perform logical and over-the-air acquisition of iOS devices, break into encrypted backups, obtain and analyze backups, synchronized data and passwords from Apple iCloud.

• Break passwords and decrypt iOS backups with GPU acceleration
• Decrypt iCloud Keychain and Messages with media files and documents from iCloud

• Obtain synchronized data from Apple and Microsoft accounts
• Download iCloud backups and synced data with or without Apple ID password

Supports: local iOS backups (iTunes); iCloud and iCloud Drive backups; iCloud synced data (call logs, photos, browsing history etc.) Microsoft Account (with valid authentication credentials); iCloud authentication tokens.

Description

NEW FEATURES

iCloud Messages and Attachments

Since iOS 11.4, messages can sync through iCloud. Elcomsoft Phone Breaker is the first tool on the market to extract and decrypt messages from iCloud complete with additional content: pictures, videos, documents and other attachments. To access iCloud Messages, the login and password to the user’s Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices are required.

Extract Apple Health Data from iCloud

Health data can become an essential piece of evidence. Heartrate, sleeping habits, workouts, steps and walking routines are just a few things that come to mind speaking of Apple Health. Elcomsoft Phone Breaker can remotely extract synced Health data from iOS devices from the user’s iCloud account.

Support for iOS 13 Beta

Elcomsoft Phone Breaker now supports iCloud backups produced by the beta versions of iOS 13 and iPadOS beta.

Logical Acquisition of iPhone, iPad and iPod Touch Devices

Elcomsoft Phone Breaker enables forensic access to information stored in a wide range of Apple devices running all versions of iOS. The tool can brute-force passwords and decrypt iOS backups using GPU acceleration, decrypt and analyze passwords stored in iOS Keychain. The tool can download iCloud backups and synchronized data, and access protected data such as iCloud Keychain, iCloud Messages and Health.

Cloud Acquisition via Apple iCloud and Microsoft Account

Cloud acquisition is a highly effective way of retrieving up-to-date information backed up or synced by modern smartphones with their respective cloud services. Elcomsoft Phone Breaker supports the extraction of cloud backups and synced data from Apple iCloud and Microsoft Account, enabling remote acquisition of iPhone and iPad devices as well as smartphones running Windows Phone and Windows 10 Mobile.

Online backups can be acquired by forensic specialists without having the original iOS or Windows Phone device in hands. All that’s needed to access online backups stored in the cloud service are the original user’s credentials including Apple ID or Live ID accompanied with the corresponding password.

Access iCloud without Login and Password

If the user’s Apple ID and password are not available, Elcomsoft Phone Breaker can use a binary authentication token created by Apple iCloud Control Panel in order to login to iCloud and retrieve information. The use of authentication tokens allows bypassing two-factor authentication even if no access to the secondary authentication factor is available.

Acquire iCloud Keychain

Elcomsoft Phone Breaker is the only tool on the market to access, extract and decrypt iCloud Keychain, Apple’s cloud-based system for storing and syncing passwords, credit card data and other highly sensitive information across devices. As opposed to authorizing a new Apple device, Elcomsoft Phone Breaker does not become part of the circle of trust and does not require a middleware device, thus offering truly forensic extraction of protected records.

Download Health and Messages from iCloud

Apple supports Health and Messages sync through iCloud. Elcomsoft Phone Breaker is the first tool on the market to extract and decrypt messages from iCloud complete with attachments, extract and decrypt Health data. To access Health and Messages, the login and password to the user’s Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices are required.

Decrypt FileVault 2

Elcomsoft Phone Breaker can extract escrow decryption keys from the user’s Apple account, and make use of those keys to decrypt macOS FileVault 2 volumes even if user account password is not known.

Note: At this time, Elcomsoft Phone Breaker can only decrypt HFS+ volumes.