Recover Password-Protected BlackBerry and Apple Backups Elcomsoft Phone Breaker enables forensic access to password-protected backups for smartphones and portable devices based on RIM BlackBerry and Apple iOS platforms. The password recovery tool supports all Blackberry smartphones as well as Apple devices running iOS including iPhone, iPad and iPod Touch devices of all generations released to date, including the iPhone 6 Plus and iOS 8. Retrieve Cloud Backups: Apple iCloud and Windows Live Cloud acquisition is an alternative way of retrieving information stored in mobile backups produced by Apple iOS, and the only method to explore Windows Phone 8 devices. Elcomsoft Phone Breaker can retrieve information from Apple iCloud and Windows Live! Services provided that original user credentials for that account are known. Online backups can be acquired by forensic specialists without having the original iOS or Windows 8 Phone device in hands.

Perform logical and over-the-air acquisition of iOS, Windows Phone 8/8.1. Of files and folders (e.g. Accounts that sync with Mac Documents or Desktop).

All that’s needed to access online backups stored in the cloud service are the original user’s credentials including Apple ID or Live ID accompanied with the corresponding password. Please note that a notification message might be sent to the owner of the Apple iCloud account when the given iCloud backup is accessed from a different computer at the first time.

Apple turns the notifications on and off from time to time (right now there are no notifications). Two-factor authentication The Forensic edition of Elcomsoft Phone Breaker enables over-the-air acquisition of iCloud data without having the original Apple ID and password. Password-free access to iCloud data is made possible via the use of a binary authentication token extracted from the user’s computer.

Elcomsoft Phone Breaker supports accounts with Apple's two-factor authentication. Note that older versions of Elcomsoft Phone Breaker did not support secondary authentication and would fail even if the second authentication factor were accessible. Access to the second authentication factor such as a trusted device or recovery key is required. Once the secondary authentication step is completed, Phone Password Breaker will save a binary authentication token to bypass manual authentication for subsequent sessions. Note: at this time, Microsoft Live! Accounts that use two-factor authentication are not supported. Accessing iCloud without Login and Password The Forensic edition of Phone Password Breaker comes with all the tools necessary to acquire and decrypt such tokens from Windows and Mac OS X computers.

During the extraction, authentication tokens for all users of that computer can be extracted, including domain users (providing that their system logon passwords are known). The tools are available in Windows and Mac versions correspondingly. The ability to use authentication tokens acquired from the suspect’s computer in place of plain-text logon credentials is of major importance to forensic investigators. Authentication tokens can be obtained from the suspect’s computer where iCloud Control Panel is installed. In order to obtain the token, the user must have been logged in to iCloud Control Panel on that PC at the time of acquisition.

Authentication tokens can be extracted from live systems (a running Mac OS or Windows PC) or retrieved from users’ hard drives or forensic disk images. ICloud Control Panel is an integral part of Mac OS systems, and installs separately on Windows PCs.

Most users will stay logged in to their iCloud Control Panel for syncing contacts, passwords (iCloud Keychain), notes, photo stream and other types of data. All this means that the probability of obtaining authentication tokens from PCs with iCloud Control Panel installed is high. ICloud files In addition to iCloud backups, Elcomsoft Phone Breaker can download files stored in the user’s iCloud account such as documents or spreadsheets, application-specific data, WhatsApp backups etc. Note that there is no email notification sent by Apple when downloading files from iCloud. Both 'old' iCloud accounts and iCloud Drive accounts are supported. Note: on Windows, downloading files from iCloud Drive requires iCloud Control Panel to be installed. On MacOS X, iCloud Control Panel is a part of the operating system, but iCloud Drive support is available on OS X version 10.10 (Yosemite) only.