Elcomsoft Phone Viewer offers a convenient interface for viewing information extracted from local and cloud backups of devices running Apple iOS, BlackBerry 10 and Windows Phone 8, 8.1 and Windows Mobile 10. With it, you can view user contacts, read messages, view call list, notes and calendar data, analyze user activities on the Internet. When working with backup copies of these devices running Apple iOS using Elcomsoft Phone Viewer, you can view deleted messages – SMS and iMessage.
Viewing data from “cloud” storage
Elcomsoft Phone Viewer is optimized to work in conjunction with other products of the company. So, with the help of Elcomsoft Phone Breaker, you can quickly extract basic information from Apple iCloud cloud storage. You can view the extracted information using Elcomsoft Phone Viewer. Using both products together can speed up investigations and make it easier to extract and analyze user data, including call and message history, phone books, and map coordinates.
View data synced with iCloud
Synchronized ones get to iCloud with minimal delay and regardless of the main backups. This data is available even when iCloud backups are disabled. With Elcomsoft Phone Viewer, you can view synchronized data retrieved with Elcomsoft Phone Breaker. It supports viewing data such as synchronized call logs, contacts, calendars, notes, bookmarks and user activity history in the Safari browser, including deleted entries.
The history of the Safari browser from the synchronized data is retrieved and displayed over a long period of time. More information is retrieved than is available on the device itself and its local copies. A filter is available to view deleted records. The following types of data are available for viewing:
• SMS and iMessage messages synced with iCloud, including attached photos, media files and documents
• Data about the state of the body and activity of the user from the Apple Health app
• Safari browser (history, bookmarks, open tabs)
• Calendars, notes, contacts
• Detailed call history
• Apple Maps (routes, searches, marked places)
• Wi-Fi (access point information, MAC addresses, date and device from which they were added)
• Wallet (except payment cards)
• User information (address , phones, name) and its devices (including serial numbers and OS version)
Physical data extraction: viewing file system images
Since the release of the iPhone 5s, the first Apple device to run a 64-bit processor, the process and outcome of physical data retrieval has changed dramatically. If for 32-bit models (iPhone 5c and older) it was possible to remove and decrypt the full image of the data partition, then for 64-bit models equipped with the Secure Enclave security subsystem, it is only possible to copy the file system.
Capturing a file system image with an exact recreation of file paths and directory structure is carried out in the Elcomsoft iOS Forensic Toolkit for mobile forensics. The command is processed by the device itself using the iOS operating system. The result of the work is an image of the file system, packed into an archive in TAR format. Third party solutions work in a similar way, producing exactly the same image in exactly the same format. With Elcomsoft Phone Viewer, you can view and analyze the contents of an iOS file system image packaged as a TAR archive.
Data export
Elcomsoft Phone Viewer allows you to export data retrieved from iOS devices to Microsoft Excel format. Data is exported from local and cloud iOS backups, synced data from the iCloud cloud, and data from file system images obtained from the physical analysis of iPhone and iPad devices. The user’s location history is saved in KML format. With support for data export, experts can continue to work with the collected information using third-party tools and popular forensic analysis packages.
Speed and compactness
Elcomsoft Phone Viewer is fast, compact and easy to use. High speed, small installation size, simple and intuitive interface distinguish Elcomsoft Phone Viewer from the products of the “monsters” of the industry, offering “all-in-one” packages, which require powerful equipment and special courses for effective use. Compared to most forensic analysis packages, Elcomsoft Phone Viewer compares favorably with price, size, ease of use, and no training required.
Accessing iOS Notifications
Notifications are an important part of iOS. Notifications come from email clients, from instant messaging applications, from online banks and shops, ticket booking, delivery and taxi services; from forums and social networks. A user can receive dozens and hundreds of notifications every day, many of which remain unread. All unread notifications that have not been deleted by the user end up in iOS backups both in the iCloud “cloud” and in local ones created using iTunes. Notifications can be stored in backups for up to several years. Their analysis may provide missing information important for the investigation. Elcomsoft Phone Viewer allows you to view and export application notifications from cloud and local backups.
Searching and filtering data
Elcomsoft Phone Viewer is ideally suited for fast processing of large volumes of information. Elcomsoft Phone Viewer makes it easy to find the records and messages you need by using the full-text search or data filtering.
Search and filters work in real time and provide instant results. Full-text search is supported for all data fields, including message body. The filtering feature is available for contacts, notes, call history and messages. With the help of a filter, you can display records that fit within a certain time period, belong to a certain account, or contain a certain combination of characters in any of the available fields. For calls and messages, display modes are available for all records, only incoming or only outgoing.
Analyzing user activity on the Internet
Analyzing user activity – their search queries, web pages viewed and open browser tabs – is a necessary part of any investigation. With the help of the analysis of search queries, not one crime was solved, but evidence of visits to certain resources – an important part of the evidence base in a number of investigations.
Using Elcomsoft Phone Viewer, you can analyze the user’s search history, browsing history, bookmarks list, as well as a list of browser tabs, including thumbnail images of open pages. This mode is available for iOS (cloud and local) and BlackBerry 10 backups.
Photos and videos
Starting with the second version of the product, Elcomsoft Phone Viewer has a built-in universal tool for viewing images and videos taken or received by the user of the device. Elcomsoft Phone Viewer users do not have to search for the files they need in a huge gallery. The program will automatically organize photos and videos into folders. Files taken using the phone’s built-in camera will be displayed separately from photos received as attachments, while images from system and user programs (buttons, menus, logos and splash screens) are displayed in a separate folder. A view mode is available with automatic breakdown of media files into albums.
iCloud Photo Library
Starting with version 2.30, Elcomsoft Phone Viewer supports viewing photos retrieved from iCloud Photo Library using Elcomsoft Phone Breaker. Supports automatic breakdown into albums and image filtering (by data type and date).
Wi-Fi Wireless Connections
The Saved Wi-Fi Connection Viewer allows you to view a list of SSIDs and passwords for Wi-Fi networks saved in iOS backups, but also determine the date and time of both the first and most recent connection to the hotspot access. In addition, information about the BSSID of access points and the encryption algorithm used is available.
Sorting the list of networks by last access date will allow you to find out which networks the user connected to and in what order during a given period of time.
Installed Applications
Elcomsoft Phone Viewer users can view the entire list of applications installed on their iPhone or iPad. App versions, date and time of purchase (purchase or first download if the app is free) and the Apple Account used to make the purchase are displayed. Some of this data is not available in the device backup itself, and is automatically requested through iTunes.
Access to the list of installed applications allows you to quickly determine in which social networks and through which messaging programs the user communicates, in which banks he has accounts and in which applications he meets.
Support for EXIF
tags EXIF tags contain information about the location, time and shooting settings, lighting conditions, and technical specifications of the camera or camera. All this data is retrieved and displayed in Elcomsoft Phone Viewer. Need to find photos taken on the day of the incident being investigated? Elcomsoft Phone Viewer has a built-in filter that allows you to set the time period and displays only those photos that were taken within the specified time.
Location data aggregation
Location data is pulled from multiple sources, including photos, iMessages and attachments, system logs, temporary files, and individual app data areas (Uber, Google Maps, Apple Maps, and more).
In modern smartphones, the coordinates of the shooting location are automatically stored in the EXIF tags of each image. Binding and displaying these coordinates on the map will allow the expert to find out the exact place where this or that shot was taken.
Data extracted from all sources is displayed as a single list, after analyzing which you can understand where the user of the device was within a given period of time. The analysis of coordinates will allow to present the route of the user’s movement within a given time period.
OS: Windows 11, Windows 10, Windows 8/ 8.1, Windows 7 and Windows Server 2008/2016 Download Elcomsoft Phone Viewer Forensic Edition 5.40.39041 (150 MB):
