Safari history in the cloud: you can't delete, you can check it out

[Демитрий]

Safari story in the “cloud”: cannot be deleted, extracted - possible.

Browser history actually displays your life. Search on Google, page views, reading blogs, chatting in forums and social networks, web mail ... Perhaps this is almost the most intimate information in the field of privacy. Few would want his story to be publicly available. In recent years, even the current has begun to gain strength, the followers of which joke - "when I die, first delete my browser history."

As often happens, there is only a fraction of the joke in this joke. The problem is that, as it turned out, deleting the story, as they say, “meet” is very difficult, if at all possible. Delete Safari story? Recent entries no longer callous? But it’s not at all a fact that the story really went away. On the contrary, the data is neatly stored in the “cloud”, and your act of “deleting” the story just hides the records. But everything that is not completely destroyed can be extracted. This happened with the history of the browser.

In recent years, Apple has been actively developing "cloud" services based on iCloud. “Cloud” backups, “cloud” photos, Continuity mode, synchronization of call history, contacts and many other data between devices tied to a user account are just some of the things that are done through iCloud.

Through the "cloud" is synchronized and the history of user visits in the Safari browser. Information about sites and pages that a user has opened is automatically transferred to Apple servers, from which it gets to other user devices that are tied to the same account.

The history of visits to the Safari browser can be deleted as a whole, or as separate entries. Deleted records regularly disappear from synchronized devices. If you try to reset the device and then restore it from the "cloud" - it will only contain those records that have not been deleted (and from the current ones - only in the last 30 days).

Researchers from the Elcomsoft lab managed to find out that the Safari browser history records “deleted” by the user are not actually deleted from the “cloud” and remain in iCloud for a long time. Based on this data, we have updated the Elcomsoft Phone Breaker product to version 6.40. Now, using Elcomsoft Phone Breaker, you can extract not only the records of the history of visits to Safari that are visible to the user on devices or in the iCloud “cloud”, but also the records that the user deleted. We were able to recover records that were deleted more than a year ago. The deleted records themselves are retrieved, as well as information about the date and time of the last visit to the link, as well as the date and time of its removal.

Practical value
The practical sense of extracting synchronized data from the point of view of forensic experts is the prompt receipt of user information. Unlike cloud-based backups, which are updated daily, synchronized data falls into the cloud with minimal delay - almost in real time.

Investigating deleted Safari browser history records may help in investigating evidence collection.

Third Party Tools and Products
Third-party tools for extracting synchronized Safari data from the cloud exist, but their capabilities are very limited. Some products are represented by devices running iOS, and receive only valid entries from the cloud. Other products work through a web interface and also receive a very limited amount of information.

At the moment, Elcomsoft Phone Breaker 6.40 is the only product that can retrieve the full history of user visits from iCloud, including deleted recordings. Very old records deleted more than a year ago can be retrieved.

How to extract Safari browser history from iCloud "cloud"
Information from the “cloud” is extracted through a real-time data synchronization mechanism. Access to iCloud will require authentication (Apple ID and password or authentication token extracted from the user's computer). When using an authentication token, there is no need to use a password; in addition, additional protection by the two-factor authentication mechanism is bypassed (as a result of which the user does not receive a warning that his account has been accessed from a new device).

Use Elcomsoft Phone Breaker 6.40 to retrieve deleted Safari history, and Elcomsoft Phone Viewer 2.25 (or newer versions) to view it.

• Launch Elcomsoft Phone Breaker 6.40 or later
• Click “Download Synced Data from iCloud” and make sure that the Safari data is checked:

• Log in to your user account using your Apple ID login and password or using a binary authentication token (you can extract it from the user's computer using Elcomsoft Phone Breaker)
• Wait for data to download from the cloud.

To view the remote history of Safari data, use Elcomsoft Phone Viewer 3.25 or newer:

• Launch Elcomsoft Phone Viewer
• Open the downloaded data and click "Web"

• The history of sites visited by the user will be shown.

• Using the filter (funnel icon in the upper left of the program) select the mode for viewing the full browser history, only current or only deleted entries.

Attention : Web links are retrieved as well as information about the date and time of the last visit to the link, as well as the date and time the record was deleted from the browser history. For the most complete study of the entire history of user visits, use the viewing of the entire data set.

Where to get the password
Retrieving synchronized data and cloud backups from iCloud requires authorization in the user account. Authorization can be done using a username and password, or through a binary authentication token. Token authorization has several advantages:

• Two-factor authentication is bypassed
• The user does not receive a warning about logging into his account

You can retrieve the authentication token from the user's computer if the iCloud Control Panel application was installed on it and the user turned on synchronization with the iCloud cloud. The marker can be retrieved using the tools built into Elcomsoft Phone Breaker.
*****
Source:
Safari story in the “cloud”: can’t be deleted, can be removed - can be