Elcomsoft Phone Password Breaker

Elcomsoft Phone Breaker is the only tool on the market to access, extract and decrypt iCloud Keychain, Apple's cloud-based system for storing and syncing passwords, credit card data and other highly sensitive information across devices. Elcomsoft Phone Breaker (formerly called Elcomsoft Phone Password Breaker) is an excellent mobile access cracking tool for the encrypted (password-protected) backups of iOS, Windows Phone, Windows Mobile and BlackBerry smartphone or other mobile devices, and a well-crafted mobile forensics tool for Windows and Mac that can be used by legal. Thank you for downloading Elcomsoft Phone Password Breaker from our software portal. The version of Elcomsoft Phone Password Breaker you are about to download is 9.15. The software is periodically scanned by our antivirus system. We also encourage you to check the files with your own antivirus before launching the installation.

Elcomsoft Phone Password Breaker Free
Elcomsoft Phone Password Breaker Free Download
Elcomsoft Phone Password Breaker License Key

Cloud Acquisition via Apple iCloud and Microsoft Account

Cloud acquisition is a highly effective way of retrieving up-to-date information backed up or synced by modern smartphones with their respective cloud services. Elcomsoft Phone Breaker supports the extraction of cloud backups and synced data from Apple iCloud and Microsoft Account, enabling remote acquisition of iPhone and iPad devices as well as Windows devices, Skype and other Microsoft software.

Online backups and synchronized data can be acquired by forensic specialists without having the original iOS device in hands. All that’s needed to access online data stored in the cloud service are the original user’s authentication credentials including the second authentication factor.

End-to-End Encryption in iCloud

Elcomsoft Phone Breaker enables access to iCloud data with end-to-end encryption. Protected categories include iCloud Keychain, iCloud Messages, Health, Screen Time and Maps data. Accessing end-to-end encrypted data requires the user's full authentication credentials including second authentication factor, as well as a system password or screen lock password to one of the user's devices.

iCloud Keychain

Screen Time Passcode

The Screen Time passcode is an optional feature in iOS 12/13/14 and newer versions that can be used to secure the Content & Privacy Restrictions. Once the password is set, iOS will prompt for the Screen Time passcode if an expert attempts to reset the device backup password (iTunes backup password) in addition to the screen lock passcode. As a result, experts will require two passcodes in order to reset the backup password: the device screen lock passcode and the Screen Time passcode. Since the 4-digit Screen Time passcode is separate to the device lock passcode (the one that is used when locking and unlocking the device), it becomes an extra security layer effectively blocking logical acquisition attempts.

By extracting and analyzing Screen Time information, experts can extract Screen Time passwords,
thus gaining the ability to remove Screen Time protection and/or to reset the password protecting local (iTunes) backups. This in turn makes logical acquisition easily possible.

iCloud Messages and Health Data

Apple supports Health and Messages sync through iCloud. Elcomsoft Phone Breaker is the first tool on the market to extract and decrypt messages from iCloud complete with attachments, extract and decrypt Health data. To access Health and Messages, the login and password to the user's Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices are required.

Extract Skype Conversations, OneDrive and Vault Files, and Windows 10 Timeline

The tool allows downloading of Skype conversation histories, files, contact lists and metadata directly from the user's Microsoft account. Individual and group chats, text messages and attachments are extracted. The downloading of the entire conversation of an average Skype history only takes minutes!

For deleted chats and messages as well as for files purged from Skype servers after the 30-day retention period, Elcomsoft Phone Breaker can obtain metadata such as the date and time the file was deleted, the file's name and size, sender's Skype ID and the name of the chat.

The tool can download files from the user's OneDrive. The downloaded files include the content of OneDrive Vault, which is a protected cloud storage for keeping the most sensitive kinds of information. In addition, the tool can obtain metadata for files that have been recently deleted from OneDrive.

Windows Timeline enhances Task View to display the currently running apps and past activities. The Timeline contains historical information about the user’s launched applications, searches, documents and Web browsing history. Along with Windows jumplists, the feature is little known and rarely disabled, giving a valuable insight into the history of system’s usage.

Elcomsoft Phone Breaker can now download Windows 10 Timeline data synchronized to the user's Microsoft account, enabling experts’ access to timestamped information about the app usage, searches and opened Web pages.

Access iCloud without Login and Password

If the user’s Apple ID and password are not available, Elcomsoft Phone Breaker may be able to use a binary authentication token to access limited sets of synchronized data. The use of authentication tokens allows bypassing two-factor authentication even if no access to the second authentication factor is available.

If you know the Apple ID and the password for entering iCloud, EPB can extract backup from the iCloud, decrypt it, and convert to the same format as used by iTunes. After converting iCloud backup to iTunes format, you can view the backup content in Elcomsoft Phone Viewer for further analysis. It is NOT recommended to restore the device from this copy.

EPB allows you to download iCloud backups created on iOS up to 14 (incl.).

To download an iCloud backup, do the following:

1. In the Tools menu, select the Apple tab.

2. Select Download backup from iCloud.

3. On the Download backup from iCloud page, define the authentication type:

•Password: To use your Apple credentials (Apple ID and password)

Elcomsoft Phone Password Breaker Free

•Token: To use the Authentication token extracted from iCloud using Elcomsoft Apple Token Extractor. For more information about extracting the token, see the Extracting Authentication token topic.

NOTE: Only backups created on iOS versions lower 11.2 can be downloaded using the tokens. In this case the Authentication token without limitations for the account with two-factor authentication or Authentication token for the account without two-factor authentication should be used.

4. Click Sign in.

NOTE: If you have entered the Apple ID in a wrong format, a message about the account being locked will be displayed. Close the message and try again. Please make sure to enter your apple ID in the standard format (i.e., example@example.com).

NOTE: If the Apple ID is protected with two-factor authentication, you need to confirm sending the verification code to all of your trusted devices or to your phone.

You can select the Save credentials for future use option when logging in so that you don't need to enter them when you log in with this Apple ID again.

5. If the Apple ID is protected with two-step verification, verify your account by selecting one of the following authentication types:

▪Secure Code: in the Trusted device field,select a phone number or a trusted device to which the code will be sent, click Get code, and thenenterthe received 4-digit code in the Secure code field.

▪Recovery Key: entera 14-character key generated defined in the Apple account settings.

6. Click Verify.

7. If the Apple ID is protected with two-factor authentication, perform authentication in one of the following ways:

▪Select Trusted Device andenter the 6-digit code in the Verification code field. Click Resend code for the verification code to be sent to all trusted devices.

▪Select Text message andenter the 6-digit code in the Verification code field. Click Send code for the verification code to be sent as a text message to the selected trusted phone number. Click Resend code for it to be sent again.

NOTE: macOS 10.12 or higher is required for sending text messages.

NOTE: Authentication via the Text message is available for the Forensic edition only.

▪Select Code generator andenter the 6-digit code in the Verification code field. The code is generated on the trusted device or via Cloud Panel.

8. Click Verify.

9. The iCloud storage of backups opens.

You can view the user name, user ID, and Apple ID of the iCloud user, and the list of backups belonging to this user. By default, 3 latest backups are displayed. Hover mouse over the blue i icon to view the storage capacity and used size.

To select backups made by a different iCloud user, click Change user.

Elcomsoft Phone Password Breaker Free Download

For every device, the following information is displayed:

▪Device name

▪Model

▪Serial number

▪Unique device ID

▪iOS version

▪Date when the latest backup was made

▪Size of backup

NOTE: The time is stated as it is (was) set on the device.

To view snapshot details for a device, click See details.

For every snapshot, the following information is displayed:

▪Device Name

▪iOS version

▪Date when the snapshot was made

▪Size of the snapshot

NOTE: For the snapshots other than the first one, the displayed size is the size of the data added by the time the snapshot was saved, not the snapshot itself.

10. Select the device(s) whose backups you would like to download by selecting check boxes on the left.

11. Define the options for downloading backups. Hover over check boxes to view hints for each option.

•Restore original file names: If selected, allows saving all backup files with the same file names as in the iOS operating system, including the full path: e.g. messages (SMS and iMessage) are saved as HomeDomainLibrarySMSsms.db (SQLite format).
If it is not selected, the backup will be saved in the same format as iTunes creates when you make the local backup. In that case, you will be able to analyze the downloaded backups with Elcomsoft Phone Viewer (if you are holding a license on EPB, you can get a discount on iBackupBot; contact us for more details) or any 3rd party software that supports iTunes backup format. Note that this option will be enabled automatically, if you select the next one (Download only specific data).

•Download only specific data: Allows selecting certain types of data to be downloaded.

12. Click Download or Download to in order to save the backup to the local computer.

Elcomsoft Phone Password Breaker License Key

13. Define the location for storing the backup and click Select Folder.

14. Downloading of the iCloud backup begins.

NOTE: If by this moment the token has expired, you will not be able to use it to download backups. However, using the expired token you can still download iCloud Files, and synced data.

You will have the following options:

•Log in again to generate a new token for further downloading of backups

•Proceed with the expired token to download iCloud Files, and synced data.

15. If you have selected several backups, you can click Skip to skip downloading either of them.

NOTE: The backups that have not been completely created yet will not be downloaded.

16. When downloading is finished, click the View button to view the backup on the local computer.

If you have Elcomsoft Phone Viewer installed on your computer, you can explore the backup content by clicking the Open in EPV link.

If you have an older version of Elcomsoft Phove Viewer installed, update it to explore downloaded data.

17. Click See details to view the detailed information about the download process.

18. Click Finish to exit the downloading wizard.

Please note, backups starting with iOS 9.x.x and higher have a different structure from iOS 8.0 and lower backups. That is why if there are several backups of different versions for the same device UDID, they will be saved to a local computer in the folder with UDID name. However, the snapshots belonging to different iOS versions will be stored in different subfolders:

▪For iOS 8.0 and lower: in the folder with the name in the form [01][YYYYMMDD_HHMMSSZ][R], where [YYYYMMDD_HHMMSSZ] is the backup date and time stamp.

▪For iOS 9.x.x and higher: in the folder with the name in the form [A30FD565-3776-4B8E-95AB-B4F06FD930BC][YYYYMMDD_HHMMSSZ], where [YYYYMMDD_HHMMSSZ] is the backup date and time stamp.