Commercial iCloud extractors often hit a wall when iCloud.com is disabled, Advanced Data Protection (ADP) is on, or Lockdown Mode is enabled. In those conditions I have seen solid products return a blunt Access Denied—even when the account owner still holds a Recovery Key or Octagon PIN.
That gap is why I built iCloudKit Extractor (IKE): an experimental Windows forensic lab tool, written in .NET 10, that walks the undocumented Apple auth → Escrow/PCS → CloudKit/MMCS path instead of relying only on the “easy” web-facing APIs.
This is research software, not a polished product. Undocumented protocols change. Accounts can be banned. There is no warranty. Use it only with your own Apple ID, for ethical / forensic work, and at your own risk.
Why I released it
Over roughly seven months of protocol work with Forensis-Lab, I got stable, full downloads of personal device backups with ADP both on and off—when the Octagon PIN or Recovery Key was available.
Extreme recoveries of backups and CloudKit data should still be possible when the only alternative is the physical device. Shipping the tool as MIT open source was the cleanest way to keep that path alive for labs that need it.
What it can do today
| Area | Capability |
|---|---|
| Access | Apple ID login, HSA2 / trusted devices, Anisette OTP (Frida → AuthKit/akd preferred) |
| Escrow & PCS | Keybag / bottle unlock, Recovery Key → TLKShares, Manatee keysets |
| Backup | List device backups, MMCS download, iTunes-style materialization |
| CloudKit / CloudDocs document crypto path | |
| iCloud Drive | Drive probe and file pull |
| IMAP export | |
| Sync Data | Photos / Notes CloudKit paths + a PhotosViewer payload |
Several UI tabs are still marked Work in progress. The demos below show the flows that already run end-to-end in the lab.
Demo: Recovery Key → login → backup
Sign in, unlock Escrow with a Recovery Key, then start a device backup pull.
Highlight MP4 · Full recording (~32 MB)
When commercial tools stop
Same account conditions where Elcomsoft 11.0.5 returned Access Denied with iCloud.com off and ADP enabled—IKE continued along the Escrow / Octagon path:
Live personal backup download (progress → completion):
Recovery Key & Octagon (short version)
Recovery Key unlock hits an Octagon endpoint that can surface the encrypted TLKShares. From those shares you can recover the ones tied to Recovery Key peers, verify whether a given Recovery Key is present, and—if it is—recover the Manatee / PCS KeySet for CloudKit zones, including ADP-protected backups and Keychain.
That is the piece commercial “web API” paths often cannot take when ADP and iCloud.com restrictions are in play.
Anisette: why a real device still matters
Apple’s Anisette / device attestation story has made pure software emulation fragile. IKE prefers OTP minted on a jailbroken iPhone via Frida (AuthKit / akd), then served by a small AnisetteServer.
There is a temporary public preview endpoint for labs that want to try before hosting their own stack:
https://www.icloudkitextractor.eu:27042
Leave the License field empty on first connect to receive a one-shot Package-C license. The preview server binds licenses to connection / fingerprint metadata so abuse can be revoked. If that endpoint is used for unauthorized attacks, I will shut the preview down. Self-host docs live in the repo under docs/ANISETTE_LICENSED.md.
Quick start
Needs: Windows · .NET 10 SDK · a physical Anisette source · an Apple ID you control.
powershell
dotnet build src/iCloudKitExtractor/iCloudKitExtractor.csproj -c Release
dotnet run --project src/iCloudKitExtractor/iCloudKitExtractor.csproj -c Release
Top comments (0)