Elcomsoft System Recovery 6.0 Extracts Hibernation Files and Data to Break Full Disk Encryption Passwords For BitLocker, PGP, TrueCrypt and VeraCrypt

The update makes it easy to process full-disk encryption by simply booting from a flash drive. The tool automatically detects full-disk encryption, extracting and saving information required to brute-force passwords to encrypted volumes. In addition, the tool can save the system’s hibernation file to the flash drive for subsequent extraction of decryption keys for accessing encrypted volumes. More 👉 https://www.elcomsoft.com/news/719.html

#BitLocker #PGP #TrueCrypt #VeraCrypt #passwords #encryption #windows #hiddendisks #crypto #code #encryptionkey

iOS Acquisition on Windows: Tips&Tricks

When you perform Apple iCloud acquisition, it almost does not matter what platform to use, Windows or macOS (I say almost, because some differences still apply, as macOS has better/native iCloud support). Logical acquisition can be done on any platform as well. But when doing full file system acquisition of jailbroken devices using Elcomsoft iOS Forensic Toolkit, we strongly recommend using macOS. If you are strictly tied to Windows, however, there are some things you should know.

👉 https://blog.elcomsoft.com/2019/09/ios-acquisition-on-windows-tipstricks/

#ios #toolkit #windows #mobileforensics #decryption #shh #dmg

It's been a great pleasure meeting with you at China Computer Forensics Conference this month! Thank you for your sheer interest to our forensic technologies, for your numerous questions and involvement! We could not possibly cover all of your questions at the conference, but you can definitely dive deeper at our trainings where you are always welcome to participate:

👉 https://www.elcomsoft.com/elcomsoft_trainings.html

#dataextraction #dfir #elcomsoft #itsecurity #software #cybersecurity #informationtechnology #computerscience #riskmanagement #privacy #pentest #bruteforce #passwordcracking #code #apple #windows #innovation #security #digitalforensics #computercrime

Introduction to BitLocker: Protecting Your System Disk

BitLocker is Microsoft’s implementation of full-disk encryption that is built into many versions of Windows. At the same time, BitLocker encryption is not available by default on desktops if you are using the Home edition of Windows 10. Activating BitLocker on your system disk can be tricky and may not work right away even if your Windows edition supports it. In this article, we are offering an introduction to BitLocker encryption. We’ll detail the types of threats BitLocker can effectively protect your data against, and the type of threats against which BitLocker is useless. Finally, we’ll describe how to activate BitLocker on systems that don’t meet Microsoft’s hardware requirements, and evaluate whether it’s worth it or not security-wise.

👉 https://blog.elcomsoft.com/2020/01/introduction-to-bitlocker-protecting-your-system-disk/

By Oleg Afonin

#BitLocker #systemdisk #windows10 #passwords #encryption #windows #hiddendisks #crypto #encryptionkey

A Comprehensive Guide on Securing Your System, Archives and Documents

How can you make your system and documents secure? Today, 256-bit AES encryption is offered by everyone and their dog. However, AES encryption does not mean much when it comes to the real security of your data. Implementing encryption at the right time and in the right spot is no less important than choosing strong encryption credentials and managing the encryption keys.
If you are a Windows user, it all comes down to choosing the optimal data protection strategy for your particular usage scenario; protecting your storage media and the data you keep on them.

👉 https://blog.elcomsoft.com/2020/01/a-comprehensive-guide-on-securing-your-system-archives-and-documents/

By Oleg Afonin

#systemdisk #windows10 #passwords #encryption #windows #AES #crypto #encryptionkey #archive #disk

Elcomsoft System Recovery update: enhanced password extraction and account recovery algorithms

We updated Elcomsoft System Recovery, a Windows PE-based tool to recover or reset passwords to local Windows accounts and Microsoft accounts in all versions of Windows. Elcomsoft System Recovery now utilizes an enhanced, smarter and significantly more efficient algorithms for recovering account passwords.

👉 https://www.elcomsoft.com/news/742.html

#cybersecurity #passwords #fde #windows #encryption #diskencryption #datasecurity #itsecurity

How to Unlock Windows Systems with a Bootable Flash Drive


Accessing a locked system is always a challenge. While you might be tempted to pull the plug and image the disk, you could miss a lot of valuable evidence if you do. Full-disk encryption, EFS-encrypted files and folders and everything protected with DPAPI (including the passwords stored in most modern Web browsers) are just a few obstacles to mention. Recovering the original Windows logon is a must to access the full set of data, while resetting the logon password may help unlock working accounts in emergencies.

Dealing with Full Disk Encryption

Full-disk encryption presents an immediate challenge to forensic experts...

👉 https://blog.elcomsoft.com/2020/04/how-to-unlock-windows-systems-with-a-bootable-flash-drive/

#windows #systempasswords #passwords #EFS #encryption #dataprotection #desktopforensics

Elcomsoft Encrypted Disk Hunter discovers encrypted disk volumes on live systems

Elcomsoft expands its range of forensic products with a new portable tool. Elcomsoft Encrypted Disk Hunter is a free command-line tool to help experts quickly discover the presence of encrypted volumes when performing live system analysis. TrueCrypt/VeraCrypt, BitLocker, PGP WDE, FileVault2, and LUKS are supported.

👉 https://www.elcomsoft.com/news/757.html

#encrypteddisk #cryptocontainer #truecrypt #veracrypt #pgp #filevault2 #luks #bitlocker #windows #macos #linux

Forensically Sound Cold System Analysis

As opposed to live system analysis, experts performing the cold analysis are not dealing with authenticated user sessions. Instead, cold analysis can be viewed as an intermediary measure with live system analysis on the one end and the examination of a forensic disk image on another. Why and when would you use cold system analysis, what can you do and what benefits does it bring compared to the traditional approach? Read along to find out.

👉 https://blog.elcomsoft.com/2020/12/forensically-sound-cold-system-analysis/

#dfir #datasecurity #encryption #windows #itsecurity

Elcomsoft System Recovery 8.30 recovers PIN-protected Windows accounts, supports LUKS2 encryption

Elcomsoft System Recovery, a digital field triage tool, is updated to support PIN-protected Windows 10 and Windows 11 accounts with in-place PIN recovery. The update adds LUKS2 support, detects Microsoft Azure accounts, and improves bootable forensic tools with custom filters.

📝 Release notes (PDF)

👉 https://www.elcomsoft.com/news/819.html

#ESR #Windows #MicrosoftAzure #LUKS2

Windows Account Passwords: Why and How to Break NTLM Credentials

Windows account passwords, or NTLM passwords, are among the easiest to recover due to their relatively low cryptographic strength. At the same time, NTLM passwords can be used to unlock DPAPI-protected data such as the user’s passwords stored in Web browsers, encrypted chats, EFS-protected files and folders, and a lot more. In this article we argue about prioritizing the recovery of NTLM hashes over any other types of encrypted data.

👉 https://blog.elcomsoft.com/2022/12/windows-account-passwords-why-and-how-to-break-ntlm-credentials/

#windows #ntlm #password #edpr #dpapi #microsoftaccount

Accelerating digital forensics: Elcomsoft System Recovery boosts efficiency in forensic analysis

Elcomsoft System Recovery, a bootable forensic analysis tool for Windows, receives an update that introduces several new features designed to enhance efficiency and simplicity during in-field investigations. The updated tool enables the collection, extraction, and analysis of essential artifacts available on the computers being investigated.

👉 https://www.elcomsoft.com/news/841.html

#ESR #Windows #DFIR #digitalforensics

Accelerating Computer Forensics: Elcomsoft System Recovery and the Low-Hanging Fruit Strategy

In the world of digital investigations, the sheer volume of data and the challenge of identifying valuable evidence can be overwhelming. Often, investigators find themselves faced with the need for optimization — the ability to quickly and seamlessly identify what is valuable and requires further examination. We aim to fulfill this need by introducing a new forensic toolkit in Elcomsoft System Recovery, a powerful bootable tool designed to speed up investigations, quickly identify and collect digital evidence right on the spot. 🔥

👉 https://blog.elcomsoft.com/2023/07/accelerating-computer-forensics-elcomsoft-system-recovery-and-the-low-hanging-fruit-strategy/

#ESR #Windows #DFIR #digitalforensics

Elcomsoft iOS Forensic Toolkit 8.41: portable Windows edition 🔥

Elcomsoft iOS Forensic Toolkit 8.41 is now available for Windows users in the all-new Windows edition. This new update maintains and extends the functionality of EIFT 7, which is now approaching the end of its life cycle. EIFT 8 is provided as a portable edition, eliminating the need for installation. In addition, the updated extraction agent can now access individual folders or file system metadata.

👉 https://www.elcomsoft.com/news/844.html

#EIFT #Agent #dataextraction #iOS #Windows #MacOS

iOS Forensic Toolkit 8 Lands on Windows

We have exciting news: iOS Forensic Toolkit 8 is now available for Windows users in the all-new Windows edition. The new build maintains and extends the functionality of EIFT 7, which is now approaching the end of its life cycle. In addition, we’ve made the Toolkit portable, eliminating the need for installation.
Learn what’s new in the eights version of the Toolkit!

👉 https://blog.elcomsoft.com/2023/10/ios-forensic-toolkit-8-lands-on-windows/

#EIFT #Agent #dataextraction #iOS #Windows #MacOS