Perform logical and over-the-air acquisition of iOS devices, break into encrypted backups, obtain and analyze backups, synchronized data and passwords from Apple iCloud.
Break passwords and decrypt iOS backups with GPU acceleration
Decrypt iCloud Keychain and Messages with media files and documents from iCloud
Obtain synchronized data from Apple and Microsoft accounts
Download iCloud backups and synced data with or without Apple ID password
Logical Acquisition of Mobile Devices
Elcomsoft Phone Breaker enables forensic access to information stored in a wide range of mobile devices. The tool delivers logical acquisition for Apple iOS devices, BlackBerry OS and BlackBerry 10 smartphones, as well as devices powered by Windows 10, Windows Phone and Windows 10 Mobile operating systems. Acquisition of local and cloud backups as well as cloud extraction of synchronized data are available.
Decrypt iOS Backups
Decrypt password-protected local backups produced by Apple iPhone, iPad and iPod Touch devices. Hardware-accelerated attacks make use of existing AMD and NVIDIA video cards to speed up the recovery.
Cloud Acquisition via Apple iCloud and Microsoft Account
Cloud acquisition is a highly effective way of retrieving up-to-date information backed up or synced by modern smartphones with their respective cloud services. Elcomsoft Phone Breaker supports the extraction of cloud backups and synced data from Apple iCloud and Microsoft Account, enabling remote acquisition of iPhone and iPad devices as well as smartphones running Windows Phone and Windows 10 Mobile.
Online backups can be acquired by forensic specialists without having the original iOS or Windows Phone device in hands. All that’s needed to access online backups stored in the cloud service are the original user’s credentials including Apple ID or Live ID accompanied with the corresponding password.
Access iCloud without Login and Password 
If the user’s Apple ID and password are not available, Elcomsoft Phone Breaker can use a binary authentication token created by Apple iCloud Control Panel in order to login to iCloud and retrieve information. The use of authentication tokens allows bypassing two-factor authentication even if no access to the secondary authentication factor is available.
Acquire iCloud Keychain
Elcomsoft Phone Breaker is the only tool on the market to access, extract and decrypt iCloud Keychain, Apple’s cloud-based system for storing and syncing passwords, credit card data and other highly sensitive information across devices. As opposed to authorizing a new Apple device, Elcomsoft Phone Breaker does
not become part of the circle of trust and does not require a middleware device, thus offering truly forensic extraction of protected records.
Download Health and Messages from iCloud
Apple supports Health and Messages sync through iCloud. Elcomsoft Phone Breaker is the first tool on the market to extract and decrypt messages from iCloud complete with attachments, extract and decrypt Health data. To access Health and Messages, the login and password to the user’s Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices are required.
Decrypt FileVault 2
Elcomsoft Phone Breaker can extract escrow decryption keys from the user’s Apple account, and make use of those keys to decrypt macOS FileVault 2 volumes even if user account password is not known.
Note: At this time, Elcomsoft Phone Breaker can only decrypt HFS+ volumes.
Device-based iCloud Authentication
EPB 10 adds the ability to use a trusted iPhone or iPad to perform iCloud extraction without the need to input a password or solve the two-factor authentication challenge. This new authentication method makes every type of data extractable including cloud backups, iCloud photos, and synchronized data including the end-to-end encrypted types.
Extract Skype Conversations, Messages, Files and Metadata
The latest update enables the downloading of Skype conversation histories, files, contact lists and metadata directly from the user’s Microsoft account. Individual and group chats, text messages and attachments are extracted. The downloading of the entire conversation of an average Skype history only takes minutes!
For deleted chats and messages as well as for files purged from Skype servers after the 30-day retention period, Elcomsoft Phone Breaker can obtain metadata such as the date and time the file was deleted, the file’s name and size, sender’s Skype ID and the name of the chat.
OneDrive, Vault and Timeline
EPB can now download files from the user’s OneDrive storage. The downloaded files include the content of OneDrive Vault, which is a protected cloud storage for keeping the most sensitive kinds of information. In addition, the tool can obtain metadata for files that have been recently deleted from OneDrive.
In addition, Elcomsoft Phone Breaker can now download Windows 10 Timeline data synchronized to the user’s Microsoft account, enabling experts’ access to timestamped information about the app usage, searches and opened Web pages.
Elcomsoft Phone Breaker supports Windows 7, Windows 8/8.1/10 x32 and x64 architectures. Supports password-protected backups to iPhone, iPhone 3G, iPhone 3GS, iPhone 4, iPhone 4S, iPhone 5, iPhone 5C, iPhone 5S, iPhone 6, iPhone 6 Plus, iPhone 6S, iPhone 6S Plus, iPhone 7, iPhone 7 Plus, iPhone 8 and 8 Plus, iPhone X/Xs/Xr, all editions of the iPhone 11, iPad (all generations including the iPad Pro), iPad Mini and iPod Touch (all generations).