iCloud stores files used by different iOS device applications together with other data synchronized with iCloud. EPB allows downloading and viewing these files.
To download files from iCloud, do the following:
1. In the Tools menu, select the Apple tab.
2. Select Download files from iCloud.
3. On the Download files from iCloud page, define the authentication type:
•Password: To use your Apple credentials (Apple ID and password)
•Token: To use the Authentication token extracted from iCloud using Elcomsoft Apple Token Extractor. For more information about extracting the token, see the Extracting Authentication token topic.
4. Click Sign in.
NOTE: If you have entered the Apple ID in a wrong format, the message about the account being locked will be displayed. Close the message and try again. Please make sure to enter your apple ID in the standard format (i.e., example@example.com).
NOTE: If the Apple ID is protected with two-factor authentication, you need to confirm sending the verification code to all of your trusted devices or to your phone.
You can select the Save credentials for future use option when logging in so that you don't need to enter them when you log in with this Apple ID again.
5. If the Apple ID is protected with two-step verification, verify your account by selecting one of the following authentication types:
▪Secure Code: in the Trusted device field, select a phone number or a trusted device to which the code will be sent, click Get code, and then enter the received 4-digit code in the Secure code field.
▪Recovery Key: enter a 14-character key generated defined in the Apple account settings.
6. Click Verify.
7. If the Apple ID is protected with two-factor authentication, perform authentication in one of the following ways:
▪Select Trusted Device and enter the 6-digit code in the Verification code field. Click Resend code for the verification code to be sent to all trusted devices.
▪Select Text message and enter the 6-digit code in the Verification code field. Click Send code for the verification code to be sent as text message to the selected trusted phone number. If you have not received the code, you can resend it by clicking Resend code.
NOTE: macOS 10.12 or higher is required for sending text messages.
NOTE: Authentication via the Text message is available for the Forensic edition only.
▪Select Code generator and enter the 6-digit code in the Verification code field. The code is generated on the trusted device or via Cloud Panel.
8. Click Verify.
9. The iCloud opens.
You can view files and folders in the Application column.
The Creation time column displays the date and time the file/folder was created.
The Size column displays the size of a file/folder. The total size of the following folders is displayed under the grid:
•Recently Deleted (iCloud Drive): Contains recently deleted files that have been synced with iCloud.
•Documents & Desktop (iCloud Drive): Contains files and folders from the Desktop and Documents folders in iCloud Drive.
•Other Documents (iCloud Drive): Contains other files and folders from iCloud Drive.
NOTE: Files and folders that are not available for downloading in the current version of EPB, are disabled and cannot be selected.
Hover mouse over the 
icon to view the storage capacity and used size.
To select files made by a different iCloud user, click Change user.
The following types of files are supported:
•Regular files
•iWorks bundles
•Other bundles
10. Select the folders and files you would like to download by selecting check boxes on the left. The files will be saved in their native format.
11. Select the Pack files into a single tar archive option, if you want to download the data in an archive.
12. Click Download.
13. Define the location for storing downloaded data.
14. The downloading of files structure starts. It will take time to download the structure of files.
.png)
15. Once the structure of files is downloaded, the process of downloading files from iCloud begins.
16. When it is finished, click Finish to exit the downloading wizard.