Elcomsoft Phone Breaker 11.1 resolves the backup download issues we noted in the EPB 11 point release, delivering complete and dependable extraction of iCloud backups. The update finishes the cloud extraction overhaul introduced in EPB 11.0, restoring stable access to one of the most valuable sources of cloud evidence available to law enforcement and forensic specialists.

EPB 11 rebuilt iCloud extraction from the ground up after Apple’s sweeping changes to authentication and encryption blocked previous methods. That release restored downloads of iCloud Drive files and synchronized data but flagged unresolved issues that could interrupt backup extraction partway through.

Backups that previously stalled now download completely, and the reconstruction step produces a consistent backup you can actually work with - but only if the backup was made by a device running iOS or iPadOS 18 or earlier. Cloud backups produced by iOS or iPadOS 26 are not supported just yet. Support for them is coming in a follow-up release.

Resolving backup extraction

Pulling backups from the cloud is often the only way to reach critical evidence when a suspect’s device is missing or locked without the possibility of a hardware unlock. It is also one of the most technically demanding operations in cloud forensics. iCloud backups are not stored as single, ready-to-download files; they are assembled from large numbers of separate fragments, which the tool has to collect and reconstruct into a coherent backup.

Recent changes to Apple’s communication protocols and to the format of certain server responses called for substantial rework of the underlying extraction logic. The initial 11.0 implementation had teething issues; version 11.1 applies the final fixes. Supported backups that previously stopped after the first few gigabytes now download in full, and the reconstruction step produces a consistent, usable result.

Support for downloading iCloud Drive files and extracting synchronized data (pictures, videos, calendars and other categories) continues unchanged. End-to-end encrypted categories such as iCloud Keychain, Health and Messages remain inaccessible for the time being, and authentication tokens can no longer be used to download data from iCloud, backups included. Current Apple infrastructure requires full account authentication.

Cloud backup extraction since 2012

Elcomsoft has a long history with this technology. Elcomsoft Phone Breaker was the first tool of its kind to download iOS device backups directly from iCloud, a capability introduced back in 2012. We have maintained and developed it continuously ever since, through every major change to Apple’s cloud infrastructure. Claims about who pioneered cloud-based evidence collection are not always anchored to the actual timeline. Working iCloud backup extraction first shipped in 2012 – a useful reference point whenever such claims come up.

Availability

The update is free of charge to all customers who purchased or renewed their Elcomsoft Phone Breaker or Elcomsoft Mobile Forensic Bundle license within one year. Discounted renewal is available to customers whose free update period has already expired.