Category: How-To / How to recover passwords for mobile data


You can use the Passware Kit to acquire iCloud backups, recover passwords for Apple iPhone and iPad backups, Android backups, and Android images. 


NOTE: Not all Android versions and devices are supported, please contact our Support for details. 

To get started, display the Passware Kit Start Page and click Mobile & Cloud Forensics. This displays the following window:

Mobile_Cloud.jpg 

Recovering Apple iTunes and Android Backup Passwords

Apple stores iPhone and iPad backups in an iTunes backup file (*.PLIST). This file, named Manifest.plist, is normally located in the Apple Computer directory. For example, for Windows 8, the full path is:
C:\Documents and Settings\User\AppData\Roaming\Apple Computer\MobileSync\Backup\BackupID\Manifest.plist

Android backup files are usually created with an ADB tool from Android SDK and normally have an *.AB extension.

Passwords for iTunes and Android backup files are recovered using regular password-recovery attacks. The process can be accelerated with GPU cards and distributed computing.

To start the password recovery process, click Mobile & Cloud on the Start Page, choose either the iPhone Backup or Android Backup option and locate your file. A brute-force password recovery process will start. 

 

Recovering Passwords for Android Images

Passware Kit recovers passwords for Android physical images acquired from encrypted devices using third-party tools, such as Magnet Acquire.

Passwords for Android image files are recovered using regular password-recovery attacks. The process can be accelerated with GPU cards and distributed computing.

To start the password recovery process, click Mobile & Cloud Forensics on the Start Page, choose the Android Image option and locate your file. The brute-force password recovery process will start. 

Not all Android versions and devices are supported, please contact our Support for details. 

 

Acquiring iCloud Backups

Passware Kit acquires full iOS backups from iCloud if Apple ID credentials are known. The backups are downloaded in iTunes format (readable by Apple software and Oxygen Forensic Suite Passware Analyst) and in a plain readable format. At the moment, due to Apple limitations, only iOS up to 10.2 is supported.

Below are the steps to acquire an iOS backup from iCloud.

  1. On the Start Page click Mobile Forensics, then choose the iCloud Backup option
  2. Enter your iCloud login. Both Apple ID and password should be entered as shown on the screen below:
    iCloud_login_and_password_600px.png
  3. Click Next. The following screen appears:
    Choose_backup_600px.png
  4. Choose the backup snapshots you want to download. The latest snapshot is listed first. By selecting other snapshots you will be able to download all previous versions of the backup.
  5. Choose where to save the backup (make sure you have enough space on your disk. Passware Kit will display the size of the backup to be downloaded).
  6. Choose the format you want to save the backup in. By default, it is the "iTunes default format" readable by Apple iTunes. You can also save the backup in plain readable format, i.e. without iTunes default folders, but as a plain list of files.
  7. Click Next.
  8. The acquisition process starts. Passware Kit downloads the necessary backup files from iCloud to your local computer.
    iCloud_download_process_600px.png
  9. The full iOS backup is now downloaded.
    iCloud_results_page_600px.png

Now that you have acquired the iOS backup from iCloud, you are ready to analyze it with Oxygen Forensic Passware Analyst or open it with Apple iTunes to see the device data.