OAuth Token Acquisition
Definition
Cloud-extraction technique where a tool authenticates to the provider using the user's account credentials or a refresh token extracted from the phone, then pulls cloud data through the provider's own API. Used by Elcomsoft Phone Breaker, Magnet AXIOM Cloud, Oxygen Forensic Cloud Extractor and E3 Forensics.
- Type
- Cloud-extraction technique
- Mechanism
- Authenticates via account credentials or extracted refresh token
- Data path
- Pulls data through the provider's own API
- Example tools
- Elcomsoft Phone Breaker, Magnet AXIOM Cloud, Oxygen Forensic Cloud Extractor, E3 Forensics
Common questions
Why is a refresh token valuable in mobile cloud extraction even without the account password?+
A refresh token stored on the device can generate new access tokens without requiring the user's password or a fresh login, so an examiner who recovers it from the phone's app data can authenticate to the cloud provider's API as the account holder, bypassing the need for credentials or a two-factor prompt.
What legal or authorisation issues does OAuth token acquisition raise compared to a local device extraction?+
Because it pulls data from the provider's servers rather than the seized device, this technique can implicate a separate legal authority to access cloud-stored content, distinct from the warrant covering the physical device, and some jurisdictions require the extraction to be scoped or logged differently as a result.
Can a cloud provider detect or block this kind of automated token-based access?+
Providers can flag unusual access patterns, such as an API call from an unrecognised location or client, and may revoke the token or require reauthentication, which is why extraction tools are updated frequently to keep pace with provider-side security changes.
Related terms
- Advanced Data Protection (ADP)
- Apple's opt-in feature since iOS 16.2 (December 2022 in US, global by iOS 16.3) that extends end-to-end encryption to iCloud Backup, iCloud...
- Android Auto Backup
- The Android 6.0+ mechanism that uploads app data to the user's Google Drive automatically (up to 25 MB per app), alongside SMS,...
- BNSS Section 91
- Bharatiya Nagarik Suraksha Sanhita 2023 Section 91 (successor to CrPC 1973 Section 91) lets a court or officer in charge of a...
- iCloud Backup
- A daily encrypted snapshot of an iPhone or iPad stored in Apple's cloud. Includes app data the developer marks for backup, device...
- MLAT
- Mutual Legal Assistance Treaty. The formal mechanism for cross-border evidence requests. India has bilateral MLATs with over 40 countries including the US,...
- TCC.db
- Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts,...