Recovering Passwords for Mobile Data
You can use the Passware Kit to acquire iCloud backups, recover passwords for Apple iPhone and iPad backups, Android backups, and Android images.
To get started, display the Passware Kit Start Page and click Mobile Forensics. This displays the following window:
Recovering Apple iTunes and Android Backup Passwords
Apple stores iPhone and iPad backups in an iTunes backup file (*.PLIST). This file, named Manifest.plist, is normally located in the Apple Computer directory. For example, for Windows 8, the full path is:
C:\Documents and Settings\User\AppData\Roaming\Apple Computer\MobileSync\Backup\BackupID\Manifest.plist
Android backup files are usually created with an ADB tool from Android SDK and normally have an *.AB extension.
Passwords for iTunes and Android backup files are recovered using regular password-recovery attacks. The process can be accelerated with GPU cards and distributed computing.
To start the password-recovery process, click Mobile Forensics on the Start Page, choose either the iPhone Backup or Android Backup option and locate your file. A brute-force password recovery process will start.
Recovering Passwords for Android Images
Passware Kit recovers passwords for Android physical images acquired from the encrypted devices using third-party tools, such as Oxygen Forensic Passware Analyst.
Passwords for Android image files are recovered using regular password-recovery attacks. The process can be accelerated with GPU cards and distributed computing.
To start the password-recovery process, click Mobile Forensics on the Start Page, choose the Android Image option and locate your file. A brute-force password recovery process will start.
Acquiring iCloud Backups
Passware Kit acquires full iOS backups from iCloud if Apple ID credentials are known. The backups are downloaded in iTunes format (readable by Apple software and Oxygen Forensic Suite Passware Analyst) and plain readable format. All versions of iOS, including the latest 8.1, are supported.
Below are the steps to acquire an iOS backup from iCloud.
- On the Start Page click Mobile Forensics, then choose the iCloud Backup option
- Enter your iCloud login. Both Apple ID and password should be entered as shown on the screen below:
- Click Next. The following screen appears:
- Choose the backup snapshots you want to download. The latest snapshot is listed first. By selecting other snapshots you will be able to download all previous versions of the backup.
- Choose where to save the backup (make sure you have enough space on your disk. Passware Kit will display the size of the backup to be downloaded).
- Choose the format you want to save the backup in. By default, it is the "iTunes default format" readable by Apple iTunes. You can also save the backup in plain readable format, i.e. without iTunes default folders, but as a plain list of files.
- Click Next.
- The acquisition process starts. Passware Kit downloads the necessary backup files from iCloud to your local computer.
- The full iOS backup is now downloaded.
Now that you have acquired the iOS backup from iCloud, you are ready to analyze it with Oxygen Forensic Passware Analyst or open it with Apple iTunes to see the device data.