ElcomSoft blog

«…Everything you wanted to know about password recovery, data decryption,
mobile & cloud forensics…»

iCloud backups inside out

February 25th, 2013 by Vladimir Katalov

It’s been a while since we released the new version of Elcomsoft Phone Password Breaker that allows downloading backups from iCloud (read the press release). Many customers all over the world are already using this new feature intensively, but we still get many questions about its benefits, examples of cases when it can be used and how to use it properly. We also noticed many ironic comments in different forums (mostly from users without any experience in using iOS devices and so have no idea what iCloud backups actually are, I guess), saying that there is nothing really new or interesting there, because anyone with Apple ID and password can access the data stored in iCloud backup anyway.

Well, it seems some further explanation is needed. If you are already using EPPB (and this feature in particular) you will find some useful tips for future interaction with iCloud, or even if you don’t have an iOS device (you loser! just kidding :)) please go ahead and learn how iCloud can be helpful and dangerous at the same time.

Let’s start from the very beginning. Once you got an iPhone (iPad or even iPod) you definitely should create backups on a regular basis. Just in case you get it stolen, lose it, or break it. I should confess that I personally have the 8th iPhone. No, not the Chinese-made 8th gen one with 3 SIM cards, removable battery and TV J. I simply had 7 of them before. And from those seven, I lost as many as three. One was left in a taxi in Vienna on my way to the airport, in just half an hour before boarding to Brussels where I was going to attend another security conference. The other one was lost in a cold Russian forest (please don’t ask me what I was doing there at 4 AM at 30 degrees below zero J). And the last one was dropped in the North Sea when I was yachting around Norway. And you know what? The very same day I got everything back. Well, not my iPhone itself, but all the contacts, SMS messages, pictures and whatever else that was stored in my iPhone. Even though I did not have a computer with me.

There is no magic here at all. I simply purchased a new iPhone and restored it from backup saved in the iCloud. As already noted, I did not have computer handy, and never cared to connect my phone to anything but the charger and Wi-Fi (or sometimes 3G only). Backups were created automatically, over the air, thanks to iCloud. Local backups are good (at least they’re faster), but in many situations iCloud backup comes like a life-saver. There are some security risks there (we will back to this later), but still it is extremely convenient. Please believe the owner of the 8th iPhone 🙂

There is a lot of valuable information about iCloud backups on Apple website; I would recommend you to start reading from the following articles:

However, all you can do with iCloud backup is just restoring your device from it. The same (well, similar) device; you can restore from iPhone to iPad (or from iPad to iPod and vice versa), but some information will not be available then. And this process only goes over the air, which means Wi-Fi. You should either get a new iPhone, or completely reset an available one. During the setup, you will be ask to enter your Apple ID and password to get the backup loaded into it. So, if you have both local (offline) and iCloud backups, you can choose between them to restore the most recent or complete one.

But what if you have Apple ID and password, but don’t have an appropriate i-device at hand or Wi-Fi connection? Well, almost nothing (it’s so typical of Apple. I really love them, but sometimes they think they know better what I really need, like my mom). You know that your information is stored in a safe place (well, the term “safe” is questionable, but that’s the other story: yes, Apple do have access to your backups, because though they are encrypted – read the iCloud: iCloud security and privacy overview – but the encryption key is stored along with the backup; the only exception is keychain encryption, see below). But you cannot reach it. You can only get to www.icloud.com and get your contacts, notes and documents, that’s all – you can get neither SMS conversations nor call logs, for example.

And what can you do using the EPPB? Simply download the whole backup. It is stored (and encrypted) the other way than the local one, but we do convert it to the same format as iTunes uses (well, in fact it creates hundreds of files with long unreadable names and encrypted contents, but keep on reading). Another option available in EPPB is to rename the files to their real names — so you will easily get your pictures, as well as SQLite databases with SMS and iMessages and whatever else you have.

By the way, did I also mention that EPPB downloads iCloud backups using any available (not just wireless) Internet connection? Well, now you know :).

However, using iTunes format is preferable, because instead of wasting your time browsing through hundreds or even thousands of files, it’s much easier to use a special software that works with iTunes backups. Here are my two favorite programs: Oxygen Forensic Suite and iBackupBot.

The first one is for professionals. It gets everything from backups, even some data you never thought would be there). Not just the contacts, messages, and pictures, but also conversations in different messengers such as WhatsApp and Skype, GPS location data, deleted conversations, and much more. If you never used this excellent package before, you will be really surprised. Especially when looking at the contents of someone else’s iPhone (just kidding :)). This is probably the best software of this kind on the market – it just extracts everything and shows it in a very convenient way.

iBackupBot (available for both Windows and Mac, btw) is not so advanced as Oxygen software but still extremely worthy. This small goodie only shows SMS messages (including iMessage conversations, of course), as well as contact list, call logs, notes and media (pictures and videos). A must-have tool if you need to get the most important information from backup in just seconds.

There is one more important point worth mentioning: iCloud stores not just one backup, but the latest three – and EPPB can get all three backups. Backup process, btw, is very intelligent, for they are incremental. Once a backup is created, next time this smart device backs up only the changes, saving your time and traffic. So, downloading backups with EPPB also gets faster – you should be patient only when downloading your backup the very first time; after that it only gets the latest changes.

We also get questions how to get the password to someone else’s Apple account. Sorry, but we only give such advices to law enforcement. All I can say is that in most cases a password is stored in the device (particularly, in the keychain), and once you have the local backup (which should be password-protected, and you should know the password – if you do not, EPPB can help you to crack this password, too), you can extract it easily. That may sound like a “chicken and egg” problem, and sometimes it is, but there is still one of the ways to get the password – better than nothing.

Oh, one more thing, now it’s time for some bad news, sorry. In iCloud backup keychain is encrypted the same way as in local backup without password, i.e. using the hardware key unique for the device. That means that you cannot get some data from it, such as saved passwords to mail accounts, Wi-Fi access points, web sites etc.

And the last for today. How can you protect yourself from downloading your backup by someone else (from law enforcement agencies to your curious girlfriend)? Just keep your password safe. Nothing new. It should be long, complex, unique (that’s probably the most important!), with good security questions, and it is a good idea to change it from time to time; some tips are available at  iCloud: Change your iCloud account password article on Apple web site. Moreover, Apple has very strict requirements to passwords, as described in Frequently asked questions about Apple ID article:

(Interestingly, these requirements have been strengthened only recently. I still have one very old Apple ID with simple password that contains lowercase letters only, and it works just fine; however, I cannot use iCloud services with it)

You can even use different Apple IDs for Store purchases and iCloud services. Or you can just neglect iCloud backups at all and keep only the local ones, but as previously noted, this is not so convenient. As always, you should find your best balance between convenience and security – you can never have both to the full degree.

To my mind, Apple has done everything right – iCloud security is good enough. There are no vulnerabilities or security holes there. However, if I were Apple, I would add an extra layer of security by allowing users to set an additional password to iCloud backup, so even if someone knows your Apple ID and password, they still would not be able to access your backup. And though I personally trust Apple, they will not have a chance to read your private data either.

Conclusions? Please make them yourself. We only give you the tool, and that’s your choice how to use it. May be you don’t need it at all. In an ideal world, nobody loses or breaks their iPhones or forgets passwords. And there are no bad guys trying to get access to your private data. But once you find this world, please let us know – I have my credit card ready to get one-way ticket to this magic place :).


Tags: , , , ,

Sign up for free ElcomSoft Password Recovery Software newsletter

139 Responses to “iCloud backups inside out”

  1. Fortunata says:

    Thanks…. for all the effort !!
    Here 3 PM now, but still no update.

  2. Dan says:

    Hi Fortunata,

    Although the build number of the program did not change, the new installer found on the website contains today’s update. Try installing that, and see if you notice any changes.



  3. bill says:

    will this work for 3.1 build 138?

  4. Fortunata says:

    Hi Dan,

    Thanks for the info, but i am in trouble.
    Before i had the EPPB program, but this doesnt exist anymore at Elcomsoft, so i installed EPB.
    But entering the registration code, it says : invalid.
    What did i wrong?

  5. Fortunata says:

    After back out, i am back on EPPB version 3.1 build 138
    But still curl error, how do i update this version EPPB to avoid the Curl error?

  6. Fortunata says:

    Upgraded EPPB to Version 4.0 build 2047 succesfull.
    But still the curl problem.

  7. Dan says:

    Hi Fortunata,

    The current program I have on my machine is 4.1 build 5116. Are you getting these builds directly from the Elcomsoft website?

    Maybe Vladimir can shed some more light on the situation.



  8. Fortunata says:

    Hi Dan,

    I already send an email to Vladimir yesterday, for more info.
    Dan, Do you use EPB or EPPB ?
    I believe EPB is the follow up of EPPB, but i am not sure about that, can’t find info about that.
    Yes, i have updated EPPB to 4.0 this morning via elcomsoft site, at mine REGISTRATION KEY STATUS i could update to 4.0, so i dont know where i can find the 4.1 version.

  9. Fortunata says:

    Hi Dan,

    To rectify, the update i made to 4.0 is now idd the EPB program, and my registration cod is accepted. (EPPB is history now, i will not mention it anymore 🙂

  10. Augusta says:

    Hi, I am also getting a Curl Error, but not sure why. I have upgraded to v4.0 a short while ago and my registration code was accepted but still i get the error?

  11. Gray says:

    I downloaded the newest version and it says the program fails to initialize when I try and run it. Whats the deal?

  12. JOhn says:

    New problem, trying to download my backup and it says “Keyset is invalid”

  13. John says:

    I submitted a ticket as stated above to see if there was going to be a patch for older versions, but because the license was expired I will have to pay the renewal price of $559 to have a functional product again,which I guess means I will be going with the cheaper competitor which offers lifetime license so I will not have to worry about the lack of support again

  14. kingnology corp says:

    i bought the home eddition by 79 dollars but it give me nothing

    • This (Home) version is mostly to recover password-protected local (iTunes) backups. What exactly do you want to do want to do with it? In any case, please create the ticket in our online support system.

  15. Sam says:

    The backups created with iOS 9 do not appear on the newest EPB. Is this by design? I can see the backup in icloud.com but neither in icloud control panel or EPB.

  16. Sam,

    iOS 9 iCloud backups are not supported in the current version, but we are almost done! New version is on the way.

  17. Rikee says:

    Hello Vladimir, is there any news on the new version with ios 9 support?

  18. Vladimir Katalov says:


    It will be available this Thursday (Oct 29th), sorry for the delay!

  19. Rikee says:

    Hi Vladimir, the new version crashes every time I try to download an iOS 9 backup. Old iOS 8 backup works fine.

  20. Vladimir Katalov says:


    Please contact me directly at v.katalov@elcomsoft.com. What we need to fix the issue is the debug-level log file created by the program; here is how to create it:


  21. Perfect10 says:

    When i try to download a backup with eppb last version it says “The icloud terms of service have changed” , and to log into the panel , i go to icloud.com and log and there is no area to accept terms of service .. and it just keeps giving me that message.

    What can i do?

  22. Vladimir Katalov says:

    Instead of icloud.com, log off (and then log on again) from “iCloud for Windows” — that should fix the problem.

  23. Sanky says:

    Hi Vladimir, the same problem. I get “The icloud terms of service have changed” on the latest version. If I log off and log in again from icloud for windows, i do not get a pop up to accept the T&C. This used to work with older versions! Is there a fix coming up for this?

  24. Shahid says:

    Hello ,,
    I have lost my icloud id password, And i lost all details about it only have Email used for apple id on my phone, my iphone is active now , but I want to erase my phone
    so can Elcomsoft can help me to find my icloud password from my iphone backup?

  25. Vladimir Katalov says:


    Sorry, no. Only Apple can help.

  26. Vinny says:

    I cannot use the software on my account due to “The icloud terms of service have changed”. I have completed the above steps, but like Sanky, who’s question went unanswered, I am having the same problem.

  27. Aaron says:

    Hello, I am trying to download my backup and getting error “can’t create zone share protection”. please help. this is a ios 9.3 backup. i am using latest version of epb.

    • Aaron,

      Sorry for the inconvenience. Updated version of EPB (that fixes this problem) will be available tomorrow; Apple has changed something is iCloud backup encryption (yes, again).

  28. lee says:

    “can’t create zone share protection”
    Funny how this seems to happen just when my license runs out and i cant download a fixed copy, aint buying it again you can fuck off

  29. Vladimir Katalov says:


    The problem you have encountered is not related to the license expiration but only to changes in Apple iCloud protocol (that happen from time to time). Please contact me at v.katalov@elcomsoft.com with your order ID or registration code, and I will prolong your license so you will be able to download the latest version of EPB.