There are so many options for extracting cloud data of iOS devices. We are going to discuss several options in the upcoming slides. For iOS 11.2+, icloud backups using 2FA require a new type of authentication token, similar to the one that is needed to get the iCloud Keychain and synced messages. The problem is that generating such a token requires some device-specific data to be sent to Apple servers, and it seems that this kind of data can be generated on iOS devices only. Elcomsoft has worked hard on this issue to reverse engineer the kernel code (and related protocols) and can successfully extract updated iOS versions of cloud data. The screenshots below show a successful iCloud extraction from iOS 15.