ElcomSoft Claims It’s Able to Recover Deleted iCloud Notes Well Past Apple’s 30-Day Window

Russian software company ElcomSoft today claimed in a
blog post
that iCloud notes marked as
deleted are being stored on Apple’s servers well past the
advertised 30-day period they are kept in the “Recently Deleted”

ElcomSoft said it used an updated version of its Phone Breaker tool,
version 6.5, to recover dozens of iCloud notes deleted more
than a month ago. ElcomSoft said many of the notes were deleted
a few weeks past the 30-day window, but in some cases, it was
allegedly able to extract notes deleted “several months ago.”

When a user deletes a note in Apple’s Notes app, it’s moved to
the “Recently Deleted” folder, which explicitly states that
“notes are permanently deleted after 30 days.” Likewise, a
on Apple’s website says users can view and recover
notes for up to 30 days before they’re permanently deleted.

However, ElcomSoft CEO Vladimir Katalov said the oldest note it
was able to retrieve was deleted around five years ago:

“We did it again,” says Vladimir Katalov, ElcomSoft CEO. “After
recovering deleted photos and Safari browsing history from
iCloud, we now add the ability to recover deleted notes from
the same source regardless of how much time has passed after
the deletion. The oldest record we’ve been able to pull was
deleted back in 2012.”

In its blog post, ElcomSoft said it was able to
extract 334 notes from an iPhone with only 288 notes stored on
it, including those in the “Recently Deleted” folder. In other
words, ElcomSoft claims it was able to recover 46 notes deleted
more than 30 days ago, and that was only one example.

Nevertheless, ElcomSoft said that its ability to extract iCloud
notes deleted more than 30 days ago is “not necessarily”
guaranteed. “While some of our test accounts did indeed contain
deleted notes going all the way back to 2015, some other
accounts contained much less than that,” it explained.

ElcomSoft said its Phone Breaker tool is the only software it
knows of that can be used to recover iCloud notes deleted more
than 30 days ago. It also said the latest version of its
Phone Viewer
is needed to view them. The tools start at $79 each
and appear to be compatible with both Mac and Windows.

To extract and view deleted notes, ElcomSoft says all someone
has to do is launch Phone Breaker version 6.5 or newer, click
“Download Synced Data from iCloud,” authenticate with an Apple
ID and password or a
binary authentication token
, wait for the download to
complete, and open the file in Phone Viewer.

ElcomSoft’s Phone Viewer tool appears to show recovered
iCloud notes

ElcomSoft said “there is no doubt Apple will fix the current
issue,” but it didn’t confirm if it has been in contact with the
company. MacRumors has opted not to use the Phone Breaker tool
out of an abundance of caution. Apple did not immediately respond
to a request for comment today.

Last year, ElcomSoft generated headlines when it claimed Apple

“secretly” syncs Phone and FaceTime call history logs on
, even with backups turned off. In a statement, Apple
said it offers call history syncing “as a convenience to our
customers so that they can return calls from any of their

In February, ElcomSoft also found that
iCloud was allegedly storing deleted Safari browser history

for a long period of time, ranging from several months to over
a year. Forbes reported that Apple quietly “started
purging older history records” once the news broke, but Apple
never officially commented.

%d bloggers like this: