As explained by Katalov, when the user opts to upload their WhatsApp data to the iCloud Drive, and they've entered a texted verification code sent by the Facebook-owned firm, a unique encryption key is generated. To understand what barriers Oxygen's Forensic Detective is up against, it's necessary to first understand what WhatsApp actually did. While Oxygen isn't fibbing about its ability to retrieve WhatsApp messages from the iCloud, its tools will only work in a very specific scenario, he said. Vladimir Katalov, CEO of rival forensics firm, Elcomsoft, explained to me how the update worked and what Oxygen was doing to circumvent the encryption.
