Practical Mobile Forensics - Third Edition

Extracting iCloud backups

Online backups stored on the iCloud are commonly retrieved when the original iOS device is damaged, upgraded, or lost. To extract a backup from iCloud, you must know the user's Apple ID and password. With the known Apple ID and password, you can log on to https://www.icloud.com/ and get access to contacts, notes, email, calendar, photos, reminders, and more. To extract the complete backup from iCloud, you can use Elcomsoft Phone Breaker. As iCloud is not the fastest cloud storage service, downloading a large backup with Elcomsoft Phone Breaker can take hours and may not be successful. To speed up the investigation, the tool provides an option to download selected files.

To extract the iCloud backup, perform the following ...