Elcomsoft Phone Viewer

The Applications view allows viewing information about the apps installed on the iOS device being analyzed. The expert can access the list of all apps installed on the device along with their acquisition date (date of purchase for paid apps or date of first install for the free apps). Additional information includes the app version, category, and Apple ID that was used to make the purchase. Since some of that information is not available in the backup, Elcomsoft Phone Viewer automatically requests additional data via an online connection through iTunes.

By making use of the Applications view, experts can gain insight into which apps the user had, which social networks they use, and which messaging tools they communicate with.

The Wi-Fi view enables access to the list of Wi-Fi networks saved in password-protected iOS backups. SSID, MAC address and password for each network is displayed. Additional network parameters include network BSSID and encryption standard. In addition, Elcomsoft Phone Viewer automatically extracts the date and time of first joining and last using the network.

Experts can sort the list by last connection time, thus tracking the user by seeing which networks they joined during a given time period.

Since version 2.30, Elcomsoft Phone Viewer can display iCloud Photo Library images extracted by Elcomsoft Phone Breaker. Automatic grouping by albums and advanced filtering are supported.

Elcomsoft Phone Viewer allows viewing iOS notifications extracted from iCloud backups as well as local backups produced with iTunes. The tool can display notifications going several years back, unless they are read or dismissed by the user.

Notifications are an essential part of the system, and may contain large amounts of volatile, highly sensitive information. Nearly all applications that are of forensic significance make use of notifications. Email clients, instant messengers, taxi and travel apps, social networks and many other applications can push notifications. Unless dismissed, these notifications are included into both local and cloud system backups.

Access EXIF information stored in the images with ease. Elcomsoft Phone Viewer displays when, where and in which lighting conditions the image was captured. Detailed camera info allows determining whether an image was captured on this device or received from another one. Looking for images captured around the time of an incident? Just specify a data range, and Elcomsoft Phone Viewer will automatically display images captured during that period based on the images’ EXIF tags.

Elcomsoft Phone Viewer is the perfect tool for exploring information contained in online backups downloaded from the cloud, while Elcomsoft Phone Breaker is the perfect tool for downloading mobile backups from iCloud. Use Elcomsoft Phone Breaker to quickly download selective information from Apple iCloud, and review information you acquired in Elcomsoft Phone Viewer. The two tools enable investigators obtain essential information about the suspect such as their calls, messages, address books and location history in a matter of minutes.

Elcomsoft Phone Viewer is a perfect tool when time is the ultimate priority. By using Elcomsoft Phone Viewer together with other ElcomSoft tools such as Elcomsoft Phone Breaker, investigators can save time by reviewing essential bits of information in just a few moments. By quick downloading selective information from Apple iCloud with Elcomsoft Phone Breaker and viewing acquired information in Elcomsoft Phone Viewer, investigators can obtain essential information about the suspect such as their calls, messages, address books and location history in a matter of minutes. The ability to view Calls and Messages databases with many thousand entries as well as convenient full-text and category-based searching and filtering make navigating through acquired information a snap.

Export evidence in just a few clicks! You can export digital evidence obtained from iOS devices including local and cloud backups, iCloud synchronized data and file system images received as a result of physical acquisition. In addition, location data is exported into the industry-standard KML format. Elcomsoft Phone Viewer exports data in Microsoft Excel format, enabling experts to continue the investigation in their forensic product of choice. The ability to export data collected from the many supported sources allows easy interoperability with most commonly used forensic and analytic toolkits.

Search through thousands of records in a snap! Elcomsoft Phone Viewer offers real-time filtering and full-text searching, allowing examiners locate records of interest in a matter of seconds. Search through Contacts, Calls, Notes and Messages, look up contact by names, numbers and other available fields, and locate messages with full-text search.

With real-time filtering, you can opt to only display favorite contacts or only display contacts from one or more accounts (Exchange, iCloud, Google, Facebook, or any combination). For messages, you can specify date range, type of message (SMS, MMS, iMessage) and whether to display incoming, outgoing or all messages.

Since iOS 12, the Screen Time password can be used to secure the Content & Privacy Restrictions. With Screen Time password enabled and restrictions configured, experts cannot access many features of the iPhone. Elcomsoft Phone Viewer can display iOS Screen Time passwords if they are present. For iOS 12 specifically, the Screen Time password can be obtained from password-protected iTunes backups; the backup password must be known. For all newer iOS releases, iCloud extraction is the only way to obtain Screen Time passwords.

Elcomsoft Phone Viewer is a fast, compact tool that requires no learning curve. Using Elcomsoft Phone Viewer is just as easy as viewing an Excel spreadsheet. Designed to simplify the entry into mobile forensics, Elcomsoft Phone Viewer offers more than enough features for many IT security departments, offices and one-off investigations.

Elcomsoft Phone Breaker is the only tool on the market to access, extract and decrypt iCloud Keychain, Apple's cloud-based system for storing and syncing passwords, credit card data and other highly sensitive information across devices. Elcomsoft Phone Viewer can display keychain records obtained with Elcomsoft Phone Breaker from Apple iCloud. Not limited to iCloud Keychain, the tool can display keychain records obtained from password-protected local backups and extracted with Elcomsoft iOS Forensic Toolkit from jailbroken devices or using the acquisition agent.

Elcomsoft Phone Viewer can decrypt Signal conversation databases extracted from the iPhone via physical acquisition. Experts using Elcomsoft iOS Forensic Toolkit will open the file system image in Elcomsoft Phone Viewer and use the extracted keychain file to decrypt the Signal database. Elcomsoft Phone Viewer will then decrypt the database and display its content in a blink of an eye.

Telegram supports secure chats. According to Telegram developers, all messages in secret chats use end-to-end encryption. Secret chats are device specific. They are not part of the Telegram cloud, and they cannot be extracted with cloud acquisition. Elcomsoft Phone Viewer can display Telegram conversations and secret chats obtained from TAR images extracted with Elcomsoft iOS Forensic Toolkit.