Forensis-Lab

Notes

A research diary of the last seven months—starting 25 March 2026—tracing how an ADP-protected backup need became iCloudKit Extractor. Newest bookends sit at the top.

  1. Opening the public experimental phase

    Why the project is on GitHub now, what “experimental” means for testers, and how Forensis-Lab attribution works under MIT.

  2. Recovery Key: dumping TLKShares and opening the account vault

    Octagon RK peer via HKDF, fetchRecoverableTLKShares, ECIES unwrap to Manatee/PCS TLKs—account recovery when the bottle PIN path is unavailable.

  3. Octagon opens: bottles, iCDP records, and the trusted-device PIN

    Escrowproxy com.apple.icdp.record.* bottles, SRP with the device PIN, BottledPeerEntropy, and Cuttlefish fetchViableBottles toward the KeySet.

  4. Closing the loop: an iTunes-shaped backup on disk

    Backup/xx/fileID, Manifest.db, Domain loops, and iTunes sidecars so forensic tools see a familiar tree.

  5. One nibble: when 0xC4 stopped looking like broken Ford

    Lead 0x04 vs 0xC4 as the fulcrum of a clean download—plus orphaned CloudKit files and non-Apple ciphertext (e.g. Mozilla translation models).

  6. Ford vs ChunkInfo: forcing the plan, then learning to wait

    AuthorizeGet FileGroups, failed force/demux paths, and checksum21 caching when chunk data arrives after Ford gates.

  7. IKM: the key that opens Ford before any chunk makes sense

    contents.protectionInfo unwrap with the zone master → IKM → HKDF PCSMMCS2—not the file-list EncryptionKey trap.

  8. MMCS opens: edge-content and the byte-range circus

    Past Lock into MMCS: edge hosts, Ford vs chunk data in the same ranges, life beyond EPB/jailbreak—with August’s lead-byte story foreshadowed.

  9. Prepare Restore Session: the first absurd Lock

    After snapshots: mbksync Lock, Foreground hw/sha, Frida + jailbreak, EPB fossils—and why Invalid lock id is the real gate before download.

  10. Snapshots on the wire, ADP still a wall

    Resuming the path: snapshot fetch vs a drifting codebase, EPB’s iOS 26 build still blocked by ADP 403, captures past snapshot listing, backupProperties still opaque.

  11. ADP on the table: when commercial tools were not enough

    Commercial suites failed on an ADP backup. First questions about Apple’s private APIs, EPB plus a jailbroken iPhone, idmsa vs mobile GrandSlam, and the mbksync zone.