Elcomsoft Phone Breaker 9.20 extracts Screen Time passwords and Voice Memos from iCloud

Elcomsoft Phone Breaker 9.20 expands the list of supported data categories, adding iOS Screen Time and Voice Memos. Screen Time passwords and some additional information can be extracted from iCloud along with other synchronized data, while Voice Memos can be extracted from local and cloud backups and iCloud synchronized data.

Elcomsoft Phone Breaker and Elcomsoft Phone Viewer are updated with support for two additional data categories. Users of EPB 9.20 and EPV 4.70 can now extract and analyze audio recordings made with Apple’s Voice Memos app. In addition, the tools allow extracting and analyzing Screen Time passwords as well as certain additional data.

Voice Memos

Apple’s Voice Memos app makes audio recordings using the iPhone’s built-in microphone. In iOS 12, Voice Memos became a fully-featured audio recording and editing app. Voice Memos is frequently used to record lectures and presentations, interviews and auditions. iOS 12 and 13 can synchronize the recorded audio clips to iCloud. The audio clips are also included as part of local and iCloud backups.

Elcomsoft Phone Breaker adds the ability to download Voice Memos clips from iCloud synced data, while Elcomsoft Phone Viewer provides a view on the audio clips extracted from local and cloud backups as well as from iCloud synced data.

Screen Time

Once the user activates the “Share across devices” feature, iOS Screen Time delivers comprehensive usage statistics on enrolled devices connected to iCloud. Screen Time restrictions are enforced with a password. That password is separate to the device screen lock passcode. If one or more child accounts are configured for the family, each child can have their own Screen Time password, which is normally different from their parents’ passwords.

Even if no specific restrictions are configured, the Screen Time password, if enabled, protects devices against resetting the local backup password, effectively blocking logical acquisition on devices with unknown backup passwords. Users can configure a separate restriction to prevent installing new apps, which will in turn block the ability to install a jailbreak and perform physical acquisition. We have recently started extracting Screen Time passwords from encrypted local backups; however, if the backup itself is protected with a password, there is a certain deadlock preventing acquisition attempts.

By extracting and analyzing Screen Time information, experts can extract Screen Time passwords, thus gaining the ability to remove Screen Time protection and/or to reset the password protecting local (iTunes) backups. This in turn makes logical acquisition easily possible.

Elcomsoft Phone Breaker 9.20 can now extract a subset of Screen Time information synchronized by all enrolled devices from iCloud. In order to access Screen Time data, the expert will need the user’s Apple ID credentials (login, password and 2FA code) as well as screen lock password from one of the user’s enrolled iOS devices. Elcomsoft Phone Viewer 4.70 can parse and display Screen Time data downloaded with Elcomsoft Phone Breaker.

The following Screen Time data is extracted: the Screen Time password (both parents’ and children’s, if any child accounts are present); information about all devices sharing Screen Time data through iCloud, including the list of installed applications on these devices. In addition, the tool extracts information about configured restrictions.

The update is free of charge to all customers who purchased or renewed their Elcomsoft Phone Breaker or Elcomsoft Mobile Forensic Bundle license within one year. Discounted renewal is available to customers whose maintenance plan has already expired.

Elcomsoft Phone Breaker release notes: