Snapshots on the wire, ADP still a wall
I picked the path back up on 11 April 2026. By then I had reached the endpoints that start a snapshot recovery—and the friction was anything but mild. Every request I sent to kick off snapshot retrieval seemed to rewrite the surrounding code: the coding agent kept pulling in fragments that resembled material published online, so the tree drifted under me while I was still trying to stabilize a single flow.
Meanwhile I checked whether Elcomsoft had moved on their side. They had: a new Phone Breaker build could download backups for iOS 26. Worth a try. With ADP still on, it went nowhere—responses came back HTTP 403. Commercial recovery of that protected backup remained closed.
So I used their release the way a lab should when the product path is blocked: as an oracle for how they had unblocked snapshot access at all. Reconstructing the outbound network story was hard; the traffic did not hand you a clean playbook. Still, enough captures landed that I could at least get past snapshot enumeration—list what was there, move one step further than March.
What I could not do yet was decrypt backupProperties, where
the device UDID lives. At that point I barely knew those fields existed;
they were still an opaque blob on the far side of a door I had only just found the handle for.
Progress, then, was uneven: snapshots visible, ADP still denying the commercial path, and the identity material inside backup metadata still locked—waiting for later months.
← All notes