Extracting token on live Windows OS

<< Click to Display Table of Contents >>

Navigation:  Elcomsoft Phone Breaker > Working with Apple devices > Extracting authentication token for iCloud > Extracting token on Windows OS >

Extracting token on live Windows OS

You can sign in to iCloud account to download the backups and files stored there using the iCloud authentication token.

To extract the token from the current system, you will need an Elcomsoft Apple Token Extractor for Windows OS. This tool is shipped together with EPB (atex.exe file). You can find it in EPB installation folder. It is not recommended to start atex.exe from EPB installation folder as there may be not enough permissions for performing token extraction. Copy a file to a folder where you would like the file with authentication token to be created.

EPB allows you to extract authentication tokens for:

Current iCloud for Windows user

Other Windows user who uses iCloud for Windows on the current computer

User of a non-live operating system (e.g., by using disk image mounted to the current computer)

NOTE: For tokens extracted using iCloud for Windows 7.3 or higher, for accounts with two-factor authentication, there are the following limitations:

The token cannot be used to download iCloud backups.

The token is valid only if it was extracted on the current computer and the user did not log out of iCloud.

 

User permissions required for getting authentication token:

Authentication Token For

Permissions Required

iCloud account of the currently logged Windows user

User's permissions are enough

iCloud account of a different Windows user

Run atex.exe as administrator (if UAC is turned on)

NOTE: When you run atex.exe from a system folder or from the folder you don't have enough permissions to modify, the Windows User Account Control message requesting permission for running this program might appear.

 

To extract the authentication token for the current iCloud for Windows user, do the following:

1.Launch atex.exe. The file "icloud_token_<timestamp>.txt" will be created in the directory from which atex.exe was launched (or in the C:\Users\<user name>\AppData\Local\Temp folder, if you don't have enough permissions for writing files to the folder where atex.exe was launched from).

You will see the full path to the file in the opened console window. Please note that Unicode symbols in the file path are not supported.

2.The created .txt file contains the Apple ID of the current iCloud for Windows user and its Authentication token.

Auth_token

 

To extract the Authentication token for a certain Windows user, do the following:

1.Open the Command Prompt.

2.Go to the folder where atex.exe is stored.

3.Enter the command atex.exe -l

EPB

4.The list of all local iCloud users will be displayed.

27

5.Launch atex.exe with getToken parameter and enter username of a specific local Windows user and the password to this Windows user account in the following form: atex.exe --getToken -n <username> -p <password>

For example: atex.exe --getToken -n user1 -p 1234

6.The "icloud_token_<timestamp>.txt" will be created in the directory from which atex.exe was launched.

The created .txt file contains the Apple ID of the current iCloud for Windows user and its Authentication token.

Auth_token

 

Parameters for running atex.exe in the command prompt:

Parameter

Meaning

-h or [--help]

Displays help message

-l or [--iCloudUserList]

Displays usernames of iCloud users

--getToken -n <username> -p <password>

Gets the authentication token for a specified user. Username and   password should be entered without brackets.

-n or [--username]

Indicates a specified user. Username should be entered without brackets.

-p or [--password]

Indicates a password for a specified user. Password should be entered without brackets.