Working with iCloud Drive files

Top  Previous  Next

Adding iCloud Drive files

To start working with iCloud Drive files:

1.In the Backups Library pane, click the Acquire data for Applle iOS device icon apple_icon.

2.In the opened menu, click the Download Files from iCloud Drive icon load_icloud_drive_icon.

3.In the opened window, enter your Apple ID and password, or authentication token, extracted via EPB. Click Sign in.

NOTE: If the Apple ID is protected with two-factor authentication, you need to confirm sending the verification code to all of your trusted devices or to your phone.




4.If the Apple ID is protected with two-step verification, verify your account by selecting one of the following authentication types:

Secure Code: in the Trusted device field, select a phone number or a trusted device to which the code will be sent, click Get code, and then enter the received 4-digit code in the Secure code field.

Recovery Key: enter a 14-character key generated in the Apple account settings.

  Click Verify.





If the Apple ID is protected with two-factor authentication, the following message will be displayed after entering Apple ID and password:




Click OK in the message, enter the 6-digit code in the Secure code field, and then click Sign in.




You can select the Save user credentials for future sessions option when logging in. If this option is selected, the entered login and password will be saved to be quickly added into corresponding fields during next login.


Please note that after logging in the authentication token is saved and the Secure code is no longer required to be entered for the account in case of two-step verification or two-factor authentication.


4. Once the WhatsApp files are downloaded from iCloud Drive and processed, the following Apple ID information is displayed:


Display name

Apple Id

Person Id

Auth Type

Storage Total Size

Storage Used Size



The lower part of the window shows all WhatsApp backups available for the selected Apple ID with the following information:


Apple Id

Phone number



Calls Received

Calls Sent




Viewing data

When you select the target WhatsApp backup in the Backups Library, the lower part of the window displays all plugins available (some of them might be disabled if there is no appropriate information in backup):







Click the plugin icon to view the contents.




Exporting data

EXWA allows you to export data from a backup to your PC. Data is exported to an XLSX file, and all attachments/files are saved to a folder in the same location as the XLSX file.

Please note that data export is only available in the registered version of the program.


To export data, do the following:

1. In the Data View pane, click Export data.

2. Select the data categories to export.

3. Define the time interval for which you want to export data as follows: enable filters by switching the On/Off toggle and then select the dates in the From and Until fields.

4. Click Export.

5. The window will open in which you can select the location for exported data.

6. Once you select the location, click Save.

7. Data export will start.

8. To open exported data, click the icon next to the Data has been exported message highlighted in yellow or open it from the location to which it was saved.


Working with encrypted iCloud Drive backups


Encrypted backups are labeled with a red Encrypted_Icon icon in the backup list and a special "lock" element in the backup info panel.

Please note that decrypting iCloud Drive backups is only available in the registered version of the program.


To view an encrypted backup:


1. Select the target encrypted backup. A message will be displayed:




2. Make your choice:

Click Open to get an immediate access to the backup (but only Media data will be available to view).

Click Decrypt to decrypt the backup for a full access to the backup data.


3. If you select to decrypt the backup, the following dialog is displayed:




Click Send code to get a special registration code that will be sent to the device associated with the backup.

If you did not receive the code or it expired, click Resend code. A special timer shows when it will be possible to get a new code sent.

NOTE: EXWA cannot decrypt a backup if the WhatsApp account on iOS was protected with two-step verification while the backup was being created.


Once you receive the code, enter it in the Verification code field and click Decrypt.

The EXWA application will authenticate itself with WhatsApp and the current user will be logged out of WhatsApp on the device.

NOTE: Do not click the URL in the message with the secure code. You have to enter the secure code manually, otherwise EXWA will not be authenticated with WhatsApp and you will have to wait for a while until a new code issent.


4. Once EXWA is authenticated with WhatsApp, the decryption process starts.

Please note that after you decrypt a backup associated with a phone number, all other backups for this phone number will be decrypted automatically after the download or on clicking a backup.

Decrypted backups are labeled with a red Decrypted_icon  icon in the backup list.

 Get more information about Elcomsoft eXplorer for WhatsApp
 Get full version of Elcomsoft eXplorer for WhatsApp

 © 2018 ElcomSoft Co.Ltd.