Building an Open Forensic Tool for iCloud Backups When Commercial Extractors Say “Access Denied”

Giordano Sconti — Fri, 30 Oct 2026 04:35:19 +0000

Commercial iCloud extractors often hit a wall when iCloud.com is disabled, Advanced Data Protection (ADP) is on, or Lockdown Mode is enabled. In those conditions I have seen solid products return a blunt Access Denied—even when the account owner still holds a Recovery Key or Octagon PIN.

That gap is why I built iCloudKit Extractor (IKE): an experimental Windows forensic lab tool, written in .NET 10, that walks the undocumented Apple auth → Escrow/PCS → CloudKit/MMCS path instead of relying only on the “easy” web-facing APIs.

This is research software, not a polished product. Undocumented protocols change. Accounts can be banned. There is no warranty. Use it only with your own Apple ID, for ethical / forensic work, and at your own risk.

Why I released it

Over roughly seven months of protocol work with Forensis-Lab, I got stable, full downloads of personal device backups with ADP both on and off—when the Octagon PIN or Recovery Key was available.

Extreme recoveries of backups and CloudKit data should still be possible when the only alternative is the physical device. Shipping the tool as MIT open source was the cleanest way to keep that path alive for labs that need it.

What it can do today

Area	Capability
Access	Apple ID login, HSA2 / trusted devices, Anisette OTP (Frida → AuthKit/`akd` preferred)
Escrow & PCS	Keybag / bottle unlock, Recovery Key → TLKShares, Manatee keysets
Backup	List device backups, MMCS download, iTunes-style materialization
WhatsApp	CloudKit / CloudDocs document crypto path
iCloud Drive	Drive probe and file pull
Mail	IMAP export
Sync Data	Photos / Notes CloudKit paths + a PhotosViewer payload

Several UI tabs are still marked Work in progress. The demos below show the flows that already run end-to-end in the lab.

Demo: Recovery Key → login → backup

Highlight MP4 · Full recording (~32 MB)

When commercial tools stop

Same account conditions where Elcomsoft 11.0.5 returned Access Denied with iCloud.com off and ADP enabled—IKE continued along the Escrow / Octagon path:

Live personal backup download (progress → completion):

Recovery Key & Octagon (short version)

Recovery Key unlock hits an Octagon endpoint that can surface the encrypted TLKShares. From those shares you can recover the ones tied to Recovery Key peers, verify whether a given Recovery Key is present, and—if it is—recover the Manatee / PCS KeySet for CloudKit zones, including ADP-protected backups and Keychain.

That is the piece commercial “web API” paths often cannot take when ADP and iCloud.com restrictions are in play.

Anisette: why a real device still matters

Apple’s Anisette / device attestation story has made pure software emulation fragile. IKE prefers OTP minted on a jailbroken iPhone via Frida (AuthKit / akd), then served by a small AnisetteServer.

There is a temporary public preview endpoint for labs that want to try before hosting their own stack:

https://www.icloudkitextractor.eu:27042

Leave the License field empty on first connect to receive a one-shot Package-C license. The preview server binds licenses to connection / fingerprint metadata so abuse can be revoked. If that endpoint is used for unauthorized attacks, I will shut the preview down. Self-host docs live in the repo under docs/ANISETTE_LICENSED.md.

Quick start

Needs: Windows · .NET 10 SDK · a physical Anisette source · an Apple ID you control.


powershell
dotnet build src/iCloudKitExtractor/iCloudKitExtractor.csproj -c Release
dotnet run --project src/iCloudKitExtractor/iCloudKitExtractor.csproj -c Release

DEV Community: Giordano Sconti