A jailbreak is required in order to access the keychain.

While most keychain items are accessible via logical acquisition, WhatsApp targets a higher security class and can be only obtained with iOS Forensic Toolkit 4.0 via physical keychain extraction. The new decryption methods makes use of the encryption key stored on the iPhone in the keychain. The new release offers the ability to decrypt downloaded backups by using a copy of the iPhone keychain extracted from a jailbroken device. In previous versions, EXWA required access to the user`s verified phone number (SIM card) to obtain the encryption key and decrypt the backup. The new decryption method does not require a WhatsApp activation code.Įlcomsoft Explorer for WhatsApp 2.60 is an incremental update, adding the ability to decrypt stand-alone WhatsApp backups downloaded from iCloud Drive without receiving an activation code from WhatsApp. In addition, Elcomsoft Explorer for WhatsApp now supports HEIC (HEIF) images.Įlcomsoft Explorer for WhatsApp 2.60 adds the ability to decrypt WhatsApp conversations from stand-alone WhatsApp backups made on iPhone devices and retrieved from iCloud Drive. Version 2.60 gains the ability to decrypt backups from Cloud Drive using device keychain. updates Elcomsoft Explorer for WhatsApp, an all-in-one tool for easy acquisition and analysis of WhatsApp communication histories.

Elcomsoft explorer for whatsapp