This method works only for Jailbroken devices. The software is called iAex (iCloud Authentification Token Extractor).
If you get Token, you wont need to know the credentials or the password to access the iCloud account. You can use it on any other reverse-engineering or educational purposes. 1)https://github.com/TwizzyIndy/iAex
Download TwizzyIndy iAex on Github for free.How it works
It would give you two kind of information stored in keychain. They are iCloud Account ID and a token which was automatically generated while signing into the iCloud API.
Elcomsoft Phone Breaker enables forensic access to password-protected backups for smartphones and portable devices based on RIM BlackBerry and Apple iOS platforms. The password recovery tool supports all Blackberry smartphones as well as Apple devices running iOS including iPhone, iPad and iPod Touch devices of all generations released to date, including the iPhone 6S Plus and iOS 9.Accessing iCloud without Login and Password
If the user’s Apple ID and password are not available, Elcomsoft Phone Breaker can use a binary authentication token created by Apple iCloud Control Panel in order to login to iCloud and retrieve information. The use of authentication tokens allows [...]
Currently there is no Jailbreak for iOS 9.2-9.3.2 devices because of no public jailbreak being available. (Updated 07/07/2016).
So stick on as a low a firmware version as possible, but only if that is deemed secure. As an example, iOS 9.3 had a really grinding issue with universal links bug, so it makes perfect sense to actually upgrade to get away from that issue. But if you are on iOS 9.2.1 or below, it’s advisable to stick to them. Of course, if you are on iOS 9.1 or below, it is worth noting that iOS 9.1 is currently the latest firmware for which a jailbreak is available. If you are on iOS 9.1 or below and care about jailbreaking, DO NOT update to iOS 9.3.2.
With no [...]
This method will help you unlock iCloud locked devices including the Apple iPad 2, iPad 3, iPad 4, iPad Air, iPad mini, iPad Air 2 and Pro that support 3G. The Hardware method can unlock all devices including ones in “Lost and erased” mode.
You will need to disassemble the iPad 3G and unsolder 1 or 2 items from the motherboard plate.
Instructions to unlock iCloud for the iPad miniRetina is not available. I do not have the circuit board. According to rumors, you need to remove 2 resistors of 4 pieces: R1213, R1204, R1205 and R1206.
The only disadvantage of this method is that you are not going to be able to use the 3G / 4G LTE [...]