Security firm recovers iCloud Notes beyond Apple's 30-day deletion window
Despite an Apple policy of permanently wiping deleted iCloud Notes older than 30 days, it appears to be possible to recover notes that are far older, a security firm said on Friday.
Using a new version of its Phone Breaker tool, Russia's Elcomsoft said it was able to retrieve notes dating weeks, months, or years beyond Apple's 30-day window. In extreme cases, notes were retrieved from as far back as 2015.
One iPhone produced 334 notes, despite it only having 288 listed -- including those in the "Recently Deleted" folder. The ability to extract old notes isn't rock-solid, however, as some test iCloud accounts generated older results than others.
Aside from Phone Breaker, the Elcomsoft hack requires only an Apple ID login or binary authentication token, along with the company's Phone Viewer software.
"There is no doubt Apple will fix the current issue," the firm said, noting that Apple has solved past retention issues it discovered, namely ones with iCloud Photo Library and Safari data.
In the latter case, iCloud was found to be retaining Safari histories and Google search terms for over a year. Apple was quick to respond to the bad publicity by scrubbing the older data.
Using a new version of its Phone Breaker tool, Russia's Elcomsoft said it was able to retrieve notes dating weeks, months, or years beyond Apple's 30-day window. In extreme cases, notes were retrieved from as far back as 2015.
One iPhone produced 334 notes, despite it only having 288 listed -- including those in the "Recently Deleted" folder. The ability to extract old notes isn't rock-solid, however, as some test iCloud accounts generated older results than others.
Aside from Phone Breaker, the Elcomsoft hack requires only an Apple ID login or binary authentication token, along with the company's Phone Viewer software.
"There is no doubt Apple will fix the current issue," the firm said, noting that Apple has solved past retention issues it discovered, namely ones with iCloud Photo Library and Safari data.
In the latter case, iCloud was found to be retaining Safari histories and Google search terms for over a year. Apple was quick to respond to the bad publicity by scrubbing the older data.
Comments
https://blog.elcomsoft.com/2017/05/we-did-it-again-deleted-notes-extracted-from-icloud/
It's also not about others (i.e. those without iCloud access for your account) being able to access such deleted notes. It's about someone who otherwise has access to your iCloud account (perhaps nefariously, but more commonly properly) being able to retrieve such deleted notes - i.e., they have your account password and, if you're using two-factor authentication, have a trusted device.
My question is: If you go into your iCloud account and empty the trash for your recently deleted notes (which are supposed to be retrievable for 30 days), might this still be the case? By design you have 30 days to (easily) retrieve deleted notes, but you can foreclose that possibility by deleting what's in the recently deleted folder.