Elcomsoft Phone Breaker 11.05 adds support for iCloud backups of iOS 27 and iPadOS 27 devices, including the iPhone 18 lineup, and restores access to iCloud data on accounts where every registered device runs OS version 26 or 27.

Apple has once again changed how it stores data in iCloud. If every device registered to an Apple Account runs version 26 or 27 of iOS, iPadOS, macOS or another Apple platform, Apple switches that account to a new storage format. As users update their devices and retire older ones, more accounts move to the new format, and previous versions of Elcomsoft Phone Breaker stopped working on such accounts. Version 11.05 supports the new format for iCloud backups, synced data, and iCloud Drive files.

A separate change on Apple's side affected the authentication protocol, causing issues with cloud extractions for all categories, including cloud backups, synchronized data, and iCloud files. We fixed the issue in version 11.05. Essentially, Apple adjusts its cloud protocols and storage formats regularly and without notice, which regularly breaks forensic tools relying on those protocol. As a result, the tools need constant updates to keep working with current devices and accounts.

Elcomsoft Phone Breaker extracts data from Apple accounts: iCloud backups, iCloud Drive, iCloud Photos, and synced data such as call logs, messages and Keychain records. Access requires the account credentials, including the second authentication factor. It's a standard tool for cloud forensics in law enforcement and corporate security work.

Release notes

• iCloud: added support for iPhone 18, 18 Pro, 18 Pro Max, and 18 Duo cloud backups
• iCloud: added support for iOS 27 and iPadOS 27 iCloud backups
• iCloud: improved support for iCloud data (backups, synced, files) for accounts with OS 26/27 devices only
• Bugfix: fixed program initialization issue on Intel-based Macs