Despite an Apple policy of permanently wiping deleted iCloud Notes older than 30 days, it appears to be possible to recover notes that are far older, a security firm said on Friday.
Using a new version of its Phone Breaker tool, Russia’s Elcomsoft said it was able to retrieve notes dating weeks, months, or years beyond Apple’s 30-day window. In extreme cases, notes were retrieved from as far back as 2015.
One iPhone produced 334 notes, despite it only having 288 listed —including those in the “Recently Deleted” folder. The ability to extract old notes isn’t rock-solid, however, as some test iCloud accounts generated older results than others.
Aside from Phone Breaker, the Elcomsoft hack requires only an Apple ID login or binary authentication token, along with the company’s Phone Viewer software.
“There is no doubt Apple will fix the current issue,” the firm said, noting that Apple has solved past retention issues it discovered, namely ones with iCloud Photo Library and Safari data.
In the latter case, iCloud was found to be retaining Safari histories and Google search terms for over a year. Apple was quick to respond to the bad publicity by scrubbing the older data.