Recovering Passwords to Storages

<< Click to Display Table of Contents >>

Navigation:  Elcomsoft Phone Breaker > [Windows] Recovering passwords >

Recovering Passwords to Storages

EPB running on Windows OS allows you to recover the passwords to various storages, such as:

iTunes backup

BlackBerry backup

BlackBerry device

The following files are necessary for decrypting different types of storages:

Storage type

Necessary files

iTunes backup

Manifest.plist (for iOS 10 or later, the Manifest.db file must be present in the same folder)

BlackBerry device backup

*.ipd or *.bbb backup file

BlackBerry Password Keeper backup

*.ipd or *.bbb backup file

BlackBerry Wallet backup

*.ipd or *.bbb backup file

BlackBerry device password

 info.mkf file from the encrypted media card

NOTE: You can recover BlackBerry device password even if Device Password or Device Password & Device Key option is set on the device.

EPB allows you to recover the password by "attacking” the backup or container, so the attack is actually a task that is intended to find the correct password. A combination of attacks makes up a recovery pipeline.


To recover the password, do the following:

1.Run EPB on Windows OS.

2.Open the Password Recovery Wizard page.

choose source

3.To add the backup or container file, drag and drop it into the Password Recovery Wizard window, or click Choose source and select the necessary storage type.

4.In the opened window navigate to the storage file by entering the file path in the path box. Select the necessary file and click Choose.

NOTE: The properties of the selected storage are displayed below the grid. 

custom window

5.When the storage is added, define the attacks that will be used to break the password.

Click the plus “+” sign to add various attacks for breaking the password. By default, Dictionary and Brute-Force attacks are already added. For more information about attacks and their settings, see the Password recovery attacks topic.

Click Change backup to select a different backup for recovery.

recovery pipeline

6.Click Start recovery.

7.The password recovery starts. You can view the estimated time left and the currently processed word.

processing recovery

Click More Info next to the attack to view the average speed of password processing and the number of already processed words.

8. You can pause or stop the recovery process by clicking the Pause and Stop buttons.

9. When the recovery process is finished, you can view the found password in the Recovery results window.


recovery results

To decrypt the backup whose password has been restored, click Decrypt backup.

To view the information in the Keychain explorer for iTunes backups, click Show in Keychain explorer.  Please note, all the backup files must be located in the same folder as the Manifest.plist file.

To proceed to recover passwords from a different backup, click Recover other password.