So let us see the different extraction options available for the five top instant messaging apps for iOS. Imaging the file system (and, in some cases, decrypting the keychain) is always enough to gain full access to conversation histories. For some messaging apps, logical extraction via iTunes-style backups is enough, while some other messengers don’t store anything in local backups. It’s up to the vendor to decide where and how to store the data more on that later.įinally, the data can be extracted from the iPhone device itself. We’ll discuss it in detail for each of the messaging apps.Ĭloud extraction may be possible from several sources, which include iCloud synchronized data (including end-to-end encrypted data), iCloud backups and stand-alone backups in iCloud Drive. The policies of different vendors vary greatly from near-instant full disclosure to flat non-disclosure with stops in between. The ability to obtain communication histories from the vendor is a great tool in the hands of the law enforcement. Even on Android devices, a MITM attack would require installing a third-party SSL certificate, and even that may not work for some instant messengers. The MITM (man-in-the-middle) attack is practically out of the question for most modern instant messaging apps if there are exceptions, we aren’t aware of those. Speaking of iOS, there are several methods to acquiring communications going through an instant messaging app.

Elcomsoft whatsapp