Elcomsoft Phone Viewer is updated to support local Apple Health data extracted from iOS local backups and file system images. In addition, the tool can now list trusted devices in iCloud. A passcode or system password from any trusted device can be used to decrypt iCloud Keychain and access Health data and iCloud Messages.

Elcomsoft Phone Viewer receives an update to support local Apple Health data extracted from iOS local backups and file system images. In addition, the tool can now display the list of trusted devices as downloaded from Apple iCloud with Elcomsoft Phone Breaker. A passcode or system password from any trusted device can be used to decrypt iCloud Keychain and access Health data and iCloud Messages. Finally, the speed of opening encrypted iTunes backups has been significantly improved thanks to the new multi-threaded decryption engine.

Apple Health Support

Health data can serve as essential evidence during investigations. At very least, the data includes step count, running and walking distances with exact timestamps the user was walking or running. Significantly more evidence is available if the user wears a HealthKit compliant device such as the Apple Watch or a third-party fitness tracker. A multitude of third-party apps may contribute to Health data significantly.

Elcomsoft Phone Viewer can now display Health data stored in password-protected iTunes backups and file system images obtained from iOS devices in TAR/ZIP format with Elcomsoft iOS Forensic Toolkit or GrayKey during physical extraction.

iCloud Trusted Devices

Certain types of data Apple devices sync with iCloud feature additional protection. These types of data include iCloud Keychain, Health, and iCloud Messages. Due to additional encryption, these types of data are not available to law enforcement via government requests. Without a proper encryption key, neither of these categories can be decrypted. The encryption key is based on the user’s screen lock passcode or system password of one of the trusted devices.

Elcomsoft Phone Viewer 4.40 can now display the list of trusted devices downloaded from iCloud with Elcomsoft Phone Breaker. By knowing which of the user’s Apple devices are trusted, experts can provide the corresponding passcode or system password, download and decrypt protected information.

Encrypted iTunes Backups

Encrypted iTunes backups now open up to 4 times faster thanks to the new multi-threaded decryption engine. A 60GB backup now opens in just 9 minutes instead of 38 minutes in the previous version.

Release notes:

• View information about trusted devices from iCloud
• Health: extract and decrypt Health data from iTunes backups and iOS device images (tar/zip)
• Encrypted iTunes backups: improved decryption speed due to multi-threaded processing