Downloading synced data from iCloud
|Top Previous Next|
EPB allows downloading device data synchronized with an iCloud account. This data can then be viewed on your computer or in Elcomsoft Phone Viewer.
To download iCloud synced data, do the following:
1. In the Tools menu, select the Apple tab.
2. Select Download synced data from iCloud.
3. On the Download synced data from iCloud page, define the authentication type:
•Password: Select this option to use your Apple credentials (Apple ID and password)
•Token: Select this option to use the Authentication token extracted from iCloud using Elcomsoft Apple Token Extractor. For more information about extracting the token, see the Extracting Authentication token topic.
4. Click Sign in.
NOTE: If you have entered the Apple ID in a wrong format, the message about the account being locked will be displayed. Close the message and try again. Please make sure to enter your apple ID in the standard format (i.e., email@example.com).
NOTE: If the Apple ID is protected with two-factor authentication, you need to confirm sending the verification code to all of your trusted devices or to your phone.
You can select the Save credentials for future use option when logging in so that you don't need to enter them when you log in with this Apple ID again.
5. If the Apple ID is protected with two-step verification, verify your account by selecting one of the following authentication types:
▪Secure Code: in the Trusted device field, select a phone number or a trusted device to which the code will be sent, click Get code, and then enter the received 4-digit code in the Secure code field.
▪Recovery Key: enter a 14-character key generated defined in the Apple account settings.
6. Click Verify.
7. If the Apple ID is protected with two-factor authentication, perform authentication in one of the following ways:
▪Select Trusted Device and enter the 6-digit code in the Verification code field. Click Resend code for the verification code to be sent to all trusted devices.
▪Select Text message and enter the 6-digit code in the Verification code field. Click Send code for the verification code to be sent as a text message to the selected trusted phone number. Click Resend code for it to be sent again.
NOTE: iCloud for Windows 4.0 and higher must be installed for sending text messages.
NOTE: OS X 10.11 or higher is required for sending text messages.
▪Select Code generator and enter the 6-digit code in the Verification code field. The code is generated on the trusted device or via Cloud Panel.
8. Click Verify.
9. The following information is displayed after signing in: user name, DSID, Apple ID.
NOTE: To download synced data for a different user, click Change user.
10. Select the data categories to download and click Download.
The Messages category contains messages synced from devices with the following operating systems:
•iOS 11.4 and higher
•macOS 10.13.15 and higher
NOTE: Messages are available only for accounts with activated two-factor authentication and cannot be downloaded using the authentication token.
NOTE: iCloud for Windows 4.0 and higher or OS X 10.11 and higher is required for downloading messages from iCloud.
Starting with EPB 6.40, the downloaded Safari history data includes the link status (Actual or Deleted) and the deletion date for deleted records, which can be explored in EPV after the download.
Safari history data for the latest two weeks is available for download.
For the Calls category, only calls for the last month are available for download.
11. The Select path to download synchronized data window opens.
12. In the Select path to download synchronized data window, define the location for storing downloaded data and click Select Folder.
13. If you select the Messages category, select a trusted device and enter the passcode (for iOS) or the password to the user account in the operating system (for OS X/macOS):
NOTE: If you enter the wrong device passcode 10 times, the device will be blocked in EPB. This will not affect the device itself but you will not be able to use it for downloading data in EPB. To unblock the device, you need to change its passcode, confirm it, and synchronize iCloud Keychain with this device again. You can also download data using another trusted device and its passcode.
14. Click Proceed. The process of downloading synced data from iCloud begins. The progress is displayed in the program window. To stop the downloading process, click Stop. (If some files have been downloaded before you stopped the process, you will be able to explore them.)
15. When downloading is finished, you can see the following information:
•Categories downloaded: The count of downloaded categories and the downloading status (no errors or with errors).
•Count of records for each downloaded category.
•For the Calendars, Calls, Apple Maps, and Notes categories, you can also see the date range (from the earliest to the latest record).
NOTE: The Trial/Home version of Elcomsoft Phone Breaker allows downloading only 10 most recent calls, notes, Wi-Fi hotspots, Apple Maps favorites and history searches, and Safari history records.
You can do the following:
•Click Explore files to open the folder with synced iCloud data.
•Click See log to open the journal and view the start time and end time of downloading and the errors that occurred during downloading.
•Click Open in EPV to view the synced iCloud data in Elcomsoft Phone Viewer.
NOTE: This option is available only if you have Elcomsoft Phone Viewer 3.10 or a higher version installed.
•Click Change user to download iCloud synced data for a different Apple ID.
•Click All tools to return to the list of tools for working with Apple backups.
•Click Finish to exit the downloading wizard.
Viewing downloaded iCloud synced data
You can explore downloaded iCloud synced data using Elcomsoft Phone Viewer.
To view downloaded iCloud synced data in Elcomsoft Phone Viewer, click the Open in EPV link after the downloading process is complete. The Elcomsoft Phone Viewer will open and you will be able to investigate the iCloud synced data.
You can also view the content of the iCloud synced data folder on your computer.
To view the content of the iCloud synced data folder on your computer, open the folder on your computer to which the data was downloaded.
The name of the folder with iCloud synced data is iCloud_sync_<apple_id>_<time stamp>.
NOTE: The time stamp in the name of the folder with iCloud synced corresponds to the time zone of the local computer.
In the iCloud_sync_<apple_id>_<time stamp> folder, the following items are displayed:
•Calls folder containing the calls.db file (a database in which the call record attributes are stored).
•Contacts folder with the following contents:
oContacts.db file (a database in which the contact record attributes are stored).
oVcards subfolder containing contact cards.
NOTE: vCards of groups are included into the count of downloaded contacts in EPB. Therefore, the number of contacts displayed in EPB might be greater than the one displayed in EPV.
•iCloud_synced.xml file containing the information about the Apple ID, start and end time of downloading, and the status of downloading (success, canceled, finished with errors).
Get more information about Elcomsoft Phone Breaker
Get full version of Elcomsoft Phone Breaker (Windows)
Get full version of Elcomsoft Phone Breaker (Mac)
© 2018 ElcomSoft Co.Ltd.