Hi guys !
Long time reader, first time poster/problem poser !
We don't have have access to the iphone (device was destroyed), however we do have access to the computer on which a backup from the device was made via itunes. I used Elcomsoft's Phone password breaker (v 1.81 I think, will check to make sure). We have managed to get the password for the backup and decided to take a look at the keychain via this programs explorer. There appears to be a few entries that are still encrypted. What methodologies could be utilized to possibly further decrypt this ? I've located the lockdown folder on the computer and looked at it with a XML editor and found the escrow keybag entry, which is hex 64 encoded. Could this be utilized to decrypt what I'm seeing in the keychain ?
Thanks for your help in advance. If anyone needs anymore info, I'll provide as much as I can !
Cheers,
Steve