Elcomsoft

Elcomsoft iOS Forensic Toolkit 8.0 brings forensically sound bootloader-based extraction for select iPhone & iPad models Elcomsoft iOS Forensic Toolkit 8.0 is a major release bringing support for repeatable, verifiable, and truly forensically sound bootloader-level extraction of 76 Apple devices ranging from the ancient iPhone 4 all the way up to the iPhone X, a large number of iPad, iPod Touch, Apple Watch, and Apple TV models, and featuring a refreshed, command-line driven user interface. 👉 https://www.elcomsoft.com/news/822.html #eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16

Entering DFU: iPhone 8, 8 Plus, and iPhone X DFU (Device Firmware Update) is a special service mode available in many Apple devices for recovering corrupted devices by uploading a clean copy of the firmware. Forensic specialists use DFU during checkm8 extractions (Elcomsoft iOS Forensic Toolkit). Unlike Recovery, which serves a similar purpose, DFU operates on a lower level and is undocumented. Surprisingly, there might be more than one DFU mode, one being more reliable than the others when it comes to forensic extractions. The method described in this article works for the iPhone 8, 8 Plus and iPhone X. 👉 https://blog.elcomsoft.com/2022/09/entering-dfu-iphone-8-8-plus-and-iphone-x/ #iphone #DFU #iOS #eift #mobileforensics

Low-Level Extraction of iOS 15.2-15.3.1 iOS Forensic Toolkit 7.60 brings gapless low-level extraction support for several iOS versions from iOS 15.2 up to and including iOS 15.3.1, adding full file system extraction support for Apple devices based on Apple A11-A15 and M1 chips. Read more in our blog 👉 https://blog.elcomsoft.com/2022/08/low-level-extraction-of-ios-15-2-15-3-1/ #eift #ios #apple #dfir #mobileforensics

Elcomsoft iOS Forensic Toolkit 7.60 extends agent-based full file system extraction Elcomsoft iOS Forensic Toolkit 7.60 extends agent-based extraction support all the way up to iOS 15.3.1 on Apple A11-A15 and M1 devices. The new release delivers full file system extraction for iOS 15.2 through 15.3.1, while still offering file system and keychain extraction support for all earlier versions of iOS. 👉 https://www.elcomsoft.com/news/821.html #eift #ios #agent #mobileforensics #dfir

Probing Linux Disk Encryption: LUKS2, Argon 2 and GPU Acceleration Disk encryption is widely used desktop and laptop computers. Many non-ZFS Linux distributions rely on LUKS for data protection. LUKS is a classic implementation of disk encryption offering the choice of encryption algorithms, encryption modes and hash functions. LUKS2 further improves the already tough disk encryption. Learn how to deal with LUKS2 encryption in Windows and how to break in with distributed password attacks. 👉 https://blog.elcomsoft.com/2022/08/probing-linux-disk-encryption-luks2-argon-2-and-gpu-acceleration/ #LUKS2 #EDPR #EFDD #diskencryption #dfir

Breaking Windows Passwords: LM, NTLM, DCC and Windows Hello PIN Compared Modern versions of Windows have many different types of accounts. Local Windows accounts, Microsoft accounts, and domain accounts feature different types of protection. There is also Windows Hello with PIN codes, which are protected differently from everything else. How secure are these types of passwords, and how can you break them? Read along to find out! 👉 https://blog.elcomsoft.com/2022/08/breaking-windows-passwords-lm-ntlm-dcc-and-windows-hello-pin-compared/ #edpr #Windows11 #pincode #dfir #windowshello #password

LM, NTLM и PIN-коды Windows Hello: сравнение безопасности В современных версиях Windows используется несколько типов учётных записей, каждый из которых может быть защищён своим неповторимым образом. Сегодня мы сравним безопасность учётных записей, защищённых механизмами LM, NTLM и PIN-кодами Windows Hello (на компьютерах без TPM). 👉 https://blog.elcomsoft.ru/2022/08/lm-ntlm-i-pin-kody-windows-hello-sravnenie-bezopasnosti/ #Windows11 #пинкод #edpr #взломпаролей

Elcomsoft Distributed Password Recovery 4.45 supports Windows Hello PIN codes and LUKS2 encryption We updated Elcomsoft Distributed Password Recovery and Elcomsoft Forensic Disk Decryptor with support for LUKS2, an updated version of Linux disk encryption tool. The tools work together to extract encryption metadata and launch a password recovery attack. In addition, Elcomsoft Distributed Password Recovery can now break PIN codes protecting Windows accounts on TPM-less systems. 📝 Release notes (PDF) 👉 https://www.elcomsoft.com/news/820.html #LUKS2 #Windows11 #EDPR #EFDD #diskencryption #pincode #dfir

Windows Hello: No TPM No Security While Windows 11 requires a Trusted Platform Module (TPM), older versions of Windows can do without while still using PIN-based Windows Hello sign-in. We prove that all-digit PINs are a serious security risk on systems without a TPM, and can be broken in a matter of minutes. 👉 https://blog.elcomsoft.com/2022/08/windows-hello-no-tpm-no-security/ #esr #Windows10 #Windows11 #TPM #edpr #WindowsHello

New in Elcomsoft System Recovery: Microsoft Azure Accounts, LUKS2 and Forensic Tool Filters Elcomsoft System Recovery 8.30 introduced the ability to break Windows Hello PIN codes on TPM-less computers. This, however, was just one of the many new features added to the updated release. Other features include the ability to detect Microsoft Azure accounts and LUKS2 encryption, as well as new filters for bootable forensic tools. 👉 https://blog.elcomsoft.com/2022/08/new-in-elcomsoft-system-recovery-microsoft-azure-accounts-luks2-and-forensic-tool-filters/ #ESR #Windows11 #Windows10 #MicrosoftAzure #LUKS2

Elcomsoft System Recovery 8.30 recovers PIN-protected Windows accounts, supports LUKS2 encryption Elcomsoft System Recovery, a digital field triage tool, is updated to support PIN-protected Windows 10 and Windows 11 accounts with in-place PIN recovery. The update adds LUKS2 support, detects Microsoft Azure accounts, and improves bootable forensic tools with custom filters. 📝 Release notes (PDF) 👉 https://www.elcomsoft.com/news/819.html #ESR #Windows #MicrosoftAzure #LUKS2

checkm8 Extraction: iPhone 7 Elcomsoft iOS Forensic Toolkit supports checkm8 extraction from all compatible devices ranging from the iPhone 4s and all the way through the iPhone X (as well as the corresponding iPad, iPod Touch, Apple Watch and Apple TV models). The new update removes an important obstacle to the acquisition of the iPhone 7 and iPhone 7 Plus devices running recent versions of iOS. 👉 https://blog.elcomsoft.com/2022/07/checkm8-extraction-iphone-7/ #eift #iphone7 #checkm8 #dfir #mobileforensics

Elcomsoft iOS Forensic Toolkit 8.0 beta 12 improves iPhone 7 extraction Elcomsoft iOS Forensic Toolkit 8.0 beta 12 improves checkm8-based low-level extraction support for the iPhone 7 and iPhone 7 Plus devices running the latest versions of iOS. The new beta drops the requirement to remove the device’s screen lock passcode prior to extraction, enabling a clean, forensically sound extraction process. 👉 https://www.elcomsoft.com/news/818.html #eift #checkm8 #dfir #mobileforensics

Apple TV 4K Keychain and Full File System Acquisition Mobile forensics is not limited to phones and tablets. Many types of other gadgets, including IoT devices, contain tons of valuable data. Such devices include smart watches, media players, routers, smart home devices, and so on. In this article, we will cover the extraction of an Apple TV 4K, one of the most popular digital media players. 👉 https://blog.elcomsoft.com/2022/07/apple-tv-4k-keychain-and-full-file-system-acquisition/ #eift #checkm8 #tvos #appletv #dfir #mobileforensics

Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds iOS 15.6 RC support Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds forensically sound checkm8-based low-level extraction support for the latest iOS, iPadOS and tvOS 15.6 RC, while also supporting watchOS 8.7 RC. In addition, several fixes are made to the checkm8 extraction engine. 👉 https://www.elcomsoft.com/news/817.html #eift #dfir #tvos #watchos #checkm8 #filesystem #keychain

Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds iOS 15.6 RC support Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds forensically sound checkm8-based low-level extraction support for the latest iOS, iPadOS and tvOS 15.6 RC, while also supporting watchOS 8.7 RC. In addition, several fixes are made to the checkm8 extraction engine. 👉 https://www.elcomsoft.com/news/817.html #eift #dfir #tvos #watchos #checkm8 #filesystem #keychain

Building an Efficient Password Recovery Workstation: Power Savings and Waste Heat Management This article continues the series of publications aimed to help experts specify and build economical and power-efficient workstations for password recovery workloads. Electricity costs, long-term reliability and warranty coverage must be considered when building a password recovery workstation. In this article we will review the most common cooling solutions found in today’s GPUs, and compare consumer-grade video cards with their much lesser known professional counterparts. 👉 https://blog.elcomsoft.com/2022/07/building-an-efficient-password-recovery-workstation-power-savings-and-waste-heat-management/ #edpr #gpuacceleration #nvidia #rtx #passwordrecovery

Keychain: the Gold Mine of Apple Mobile Devices Keychain is an essential part of iOS and macOS that securely stores the most critical data: passwords of all kinds, encryption keys, certificates, credit card numbers, and more. Extracting and decrypting the keychain, when possible, is a must in mobile forensics. We seriously improved this part in the latest build of iOS Forensic Toolkit. 👉 https://blog.elcomsoft.com/2022/07/keychain-the-gold-mine-of-apple-mobile-devices/ #ios #apple #dfir #mobileforensics #keychain #agent

Elcomsoft iOS Forensic Toolkit 7.50 closes the gap in keychain extraction Elcomsoft iOS Forensic Toolkit 7.50 extends agent-based keychain extraction support all the way up to iOS 15.1.1 on all supported devices. The new release fills the remaining gaps in iOS 14 support, adding agent-based keychain extraction for iOS 14.5 – 14.8.1 and iOS 15.0 – 15.1.1 devices. 👉 https://www.elcomsoft.com/news/816.html #ios #apple #iphone #agent #mobileforensics #dfir

iCloud backups: the Dark Territory Apple ecosystem includes a comprehensive backup ecosystem that includes both local and cloud backups, and data synchronization with end-to-end encryption for some categories. Today we’ll discuss the iCloud backups, particularly targeting issues that are not covered in the official documentation. 👉 https://blog.elcomsoft.com/2022/07/icloud-backups-the-dark-territory/ #epb #e2ee #icloud #icloudbackup