To use Elcomsoft Phone Breaker (EPB), select "Choose backup." Navigate to the backup file you want to crack. The option includes:

  •  Apple: iOS device backup (backup file created with iTunes or a tool utilizing iTunes).

Once your selection is made, navigate to the backup file.

To manually determine if an iOS backup file is encrypted, simply go to the Manifest.plist and read the status flag:

0 = Not Encrypted

1 = Encrypted

If the Boolean values are not listed, the words “true” and “false” will be leveraged in the Manifest.plist.

This screenshot shows Elcomsoft Phone Password Breaker recognizing that the file is not encrypted. This normally occurs for non-encrypted images or when the backup is corrupt. If your tool prompts you to enter a password and you get this error when attempting to crack the manifest.plist, manually verify for encryption by opening the plist and looking to see if encrypted is set to true.