Google account snapshots

<< Click to Display Table of Contents >>

Navigation:  Elcomsoft Cloud Explorer > Working with Google account vackups >

Google account snapshots

With ECX, you can download information from the account, store it as a backup, and then explore the backup content.


The following data categories are available:

User Info: The Google account user data, including name, account type (person or company), birth date, the URLs to social network profiles, and more.

Chats: Google Hangouts chat history.

Contacts: The Google account user contacts and all available information on them.

Google Keep: The user's notes downloaded from Google Keep.

Chrome: Google Chrome data, including passwords, bookmarks, autofills, and pages transitions.

Calendars: Events planned in Google Calendar, including one time and regular events, birthdays, holidays, etc.

Dashboard: The Google Dashboard content, including, but not limited to:

odevices associated with the Google account.

othe Google account.

othe user's Google search history.

othe user's activity on YouTube.

othe user's connected apps.

othe user's location history and saved places.

othe user's photos.

othe user's calendar events and so on.

Locations: The user's location history tracked in the Google Timeline service.

Media: The user's photos stored in Google Photos.

History: The user's Google History information, including search history,  search history, YouTube search and watch history, visited web-sites history, and device history.

Mail: The user's email data from Gmail.

Wi-Fi: Information on Wi-Fi connections stored in the user's Google account.

Calls: The information on user's call history stored in the user's Google account.

Messages: The user's text messages stored in the user's Google account.

Google Fit: The user's activity data downloaded from Google Fit.


NOTE: The Wi-Fi, Calls, and Messages information will not be downloaded, if Android device (v. 9.0 and higher) is protected by the cryptographic key or passcode.


To download information from the Google account, do the following:

1. In the main menu, click File, and then click Add Google Snapshot; or click the add_snapshot_icon button in the bottom-left corner of the ECX screen.

2. On the Download snapshot page, define the authentication type:

Password: Select this option to use the Google account credentials (Google ID (in the format) and password).

Token: Select this option to use the authentication token extracted from the Google Chrome browser using Google Token Extractor (GTEX). For more information about extracting the token, see the Extracting authentication token topic.


3. Click Sign in.

NOTE: If you have any issues with signing in, please see Signing in.

4. Select the data categories you wish to download.


For the Mail and Media categories, you can click Add filter and then define the time interval for which the data must be downloaded.

To define the time interval, click the Calendar icon icon in each Date field, select the dates from the calendar, and then click OK.


5. Click Download.


NOTE: Some Chrome data may be encrypted with a passphrase (for more information, please see If you select to download the Chrome data category, and Chrome information in your Google account is encrypted with a passphrase, ECX requires you to enter this passphrase. If you enter the passphrase, all the Chrome data is downloaded. If you don't enter the passphrase, the encrypted data is not downloaded.


Once the download is completed, you can see the Google account profile and its backup in the Google Accounts pane on the left. The backup title consists of its creation date and time. If the Google account has several backups, they are all listed under this Google account.


In the main window, you can see what data categories have been downloaded in each backup, as well as how many records each backup contains. Data categories that were not selected to be downloaded and categories that have no data are displayed in gray.




To explore the backup content, just click the desired backup record.

To remove a Google account profile or a backup, select the desired record and click the remove_snapshot_icon icon in the bottom-right corner of the Google Accounts pane, or, in the main menu, select File, and then click Remove Backup.