Elcomsoft Phone Breaker

Description

All Features and Benefits

• Recover Password-Protected BlackBerry and Apple Backups
• Retrieve Cloud Data: Apple iCloud and Microsoft Account
• Two-Step Verification and Two-Factor Authentication
• Accessing iCloud without Login and Password
• Decrypt FileVault 2 Volumes
• Synced Data
• iCloud Files
• iCloud Photo Library
• Unlock Apple and BlackBerry Backups
• Decrypt BlackBerry 10 Backups
• Selective Access to iCloud Backups
• GPU Acceleration
• Advanced Attacks
• Extract, Decrypt and View Passwords Stored in iOS Keychain
• Password Managers

Supports local iOS backups (iTunes); iCloud and iCloud Drive backups; iCloud synced data (call logs, photos, browsing history etc.); BlackBerry 10 backups; Microsoft Account (with valid authentication credentials); Windows Phone 8, 8.1, Windows 10 Mobile backups; iCloud authentication tokens.

NEW FEATURES

• iMessages in iCloud
  iOS 11.4 adds long-awaited support for iMessages sync through iCloud. Elcomsoft Phone Breaker 8.30 becomes the first tool on the market that can extract and decrypt iMessages from iCloud. To access iMessages, the login and password to the user’s Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices are required.
• Faster Access to iCloud Files
  Elcomsoft Phone Breaker 8.30 significantly speeds up access to accounts with large numbers of files and folders (e.g. accounts that sync with Mac Documents or Desktop). As a result, detailed file system structure will be no longer displayed at the time of acquisition.

Logical Acquisition of Mobile Devices

Elcomsoft Phone Breaker enables forensic access to information stored in a wide range of mobile devices. The tool delivers logical acquisition for Apple iOS devices, BlackBerry OS and BlackBerry 10 smartphones, as well as devices powered by Windows 10, Windows Phone and Windows 10 Mobile operating systems. Acquisition of local and cloud backups, as well as cloud extraction of synchronized data, are available.

Decrypting iOS Backups

Decrypt password-protected local backups produced by Apple iPhone, iPad and iPod Touch devices. Hardware-accelerated attacks make use of existing AMD and NVIDIA video cards to speed up the recovery.

Cloud Acquisition via Apple iCloud and Microsoft Account

Cloud acquisition is a highly effective way of retrieving up-to-date information backed up or synced by modern smartphones with their respective cloud services. Elcomsoft Phone Breaker supports the extraction of cloud backups and synced data from Apple iCloud and Microsoft Account, enabling remote acquisition of iPhone and iPad devices as well as smartphones running Windows Phone and Windows 10 Mobile.

Online backups can be acquired by forensic specialists without having the original iOS or Windows Phone device in hands. All that’s needed to access online backups stored in the cloud service are the original user’s credentials including Apple ID or Live ID accompanied with the corresponding password.

Accessing iCloud without Login and Password

If the user’s Apple ID and password are not available, Elcomsoft Phone Breaker can use a binary authentication token created by Apple iCloud Control Panel in order to log in to iCloud and retrieve information. The use of authentication tokens allows bypassing two-factor authentication even if no access to the secondary authentication factor is available.

Acquiring iCloud Keychain

Elcomsoft Phone Breaker is the only tool on the market to access, extract and decrypt iCloud Keychain, Apple’s cloud-based system for storing and syncing passwords, credit card data and other highly sensitive information across devices. As opposed to authorizing a new Apple device, Elcomsoft Phone Breaker does
not become part of the circle of trust and does not require a middleware device, thus offering truly forensic extraction of protected records.

Downloading iMessages from iCloud

iOS 11.4 adds long-awaited support for iMessages sync through iCloud. Elcomsoft Phone Breaker 8.30 becomes the first tool on the market that can extract and decrypt iMessages from iCloud. To access iMessages, the login and password to the user’s Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices are required.

FileVault 2 Decrypting

Elcomsoft Phone Breaker can extract escrow decryption keys from the user’s Apple account, and make use of those keys to decrypt macOS FileVault 2 volumes even if user account password is not known.

System requirements

Elcomsoft Phone Breaker supports password-protected backups to iPhone, iPhone 3G, iPhone 3GS, iPhone 4, iPhone 4S, iPhone 5, iPhone 5C, iPhone 5S, iPhone 6, iPhone 6 Plus, iPhone 6S, iPhone 6S Plus, iPhone 7, iPhone 7 Plus, iPhone 8 and 8 Plus, iPhone X, iPad (all generations including iPad Pro), iPad Mini and iPod Touch (all generations) devices are supported.

Additional Requirements

• manifest.plist file from iTunes backup (for iTunes backup password recovery)
• Complete iTunes backup (to read keychain data)
• Apple ID and password or authentication token (to download iCloud backup or files from iCloud)
• Windows Live! ID and password (to download Windows Phone backup)
• BlackBerry ID and password (to decrypt BB 10 backup)
• One or more of supported NVIDIA or AMD cards(recommended for hardware acceleration of password recovery)

Trial Limitations

Free trial version (Windows) uses all available CPUs and GPUs, but shows only first two characters of backup passwords (hiding the rest under the asterisks), and does not allow dictionary mutations (Windows version only; Mac version does not have password recovery features at all). Also, the trial version (Windows and MacOS X) does not show passwords extracted from the keychain and allows to download only a few specific categories from iCloud backup.