Every time a new iOS version comes out,
the tools almost struggle to keep up
with being able to do cloud extractions.
Every time I get an update on my device,
I try to extract using Physical Analyzer
because of work and also Elcomsoft, which
is one of my preferred tools.
At the time of writing this, Physical Analyzer
did a really good job pulling iOS 15 backup files.
So here, you can see, I go in, and I choose Cloud,
I'm choosing iCloud.
I enter in my username and password.
And you can say, "Use those credentials
for all iCloud accounts," if you want.
And then it prompts me right away.
It's saying, hey, two-factor authentication is required.
If you're doing covert operations,
this is when you back out.
If you are afraid of leaving a trace behind you, stop.
If you are OK with leaving a trace behind,
and you have their trusted device,
you will need to have that device, click
on two-factor authentication.
It's going to send it a code, and you can continue.
If you do multiple tools over and over and over,
it may lock their iCloud account and force
them to reset their passcode.
So be careful with that.