Breaking the iCloud Keychain Artifacts

n0fate has released a new tool – it’s called iChainbreaker. As you can see, this Python script can be used for analyzing iCloud Keychain.

Here is how to use it:

usage: iChainbreaker.py [-h] -p PATH -k KEY [-x EXPORTFILE]

Tool for iCloud Keychain Analysis by @n0fate

optional arguments:

-h, –help show this help message and exit

-p PATH, –path PATH iCloud Keychain Path(~/Library/Keychains/[UUID]/)

-k KEY, –key KEY User Password

-x EXPORTFILE, –exportfile EXPORTFILE

Write a decrypted contents to SQLite file (optional)

You can download the script here.

Digital Forensics

DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.