Clearing Confusion About our Password Recovery Tools

There is a bit of confusion about our software designed to allow breaking into password-protected systems, files, documents, and encrypted containers. We have as many as three products (and five different tools) dealing with the matter: Elcomsoft Forensic Disk Decryptor (with an unnamed memory dumping tool), Elcomsoft System Recovery and Elcomsoft Distributed Password Recovery, which also includes Elcomsoft Hash Extractor as part of the package. Let’s briefly go through all of them. Hopefully it will help you select the right product for your needs and save time in your investigation.

👉 https://blog.elcomsoft.com/2020/05/clearing-confusion-about-our-password-recovery-tools/

By Oleg Afonin

#password #passwordrecovery #encryption #itsecurity #cybersecurity #dataaccess #dfir #difitalforensics

Full File System and Keychain Acquisition with unc0ver jailbreak: iOS 13.1 to 13.5

The unc0ver v5 jailbreak has been available for a while now. It supports the newest versions of iOS up to and including iOS 13.5, and this is fantastic news for DFIR community, as it allows extracting the full file system and the keychain when acquiring the newest latest iPhone models such as the iPhone 11 and 11 Pro, and SE 2020. In this article, I’ll talk about the unc0ver jailbreak, the installation and usage for the purpose of file system extraction, and discuss the differences between jailbreak-based and jailbreak-free extraction.

👉 https://blog.elcomsoft.com/2020/05/full-file-system-and-keychain-acquisition-with-unc0ver-jailbreak-ios-13-1-to-13-5/

By Vladimir Katalov

#uncover #ios #iphone #iOS135 #cybersecurity #itsecurity #mobileforensics

Elcomsoft iOS Forensic Toolkit 6.10: jailbreaking all the way

Elcomsoft iOS Forensic Toolkit 6.10 delivers major improvements to jailbreak-based extraction, now offering keychain acquisition and file system extraction for iOS 13.5, 13.4.1, 13.4 and 13.3.1 with unc0ver v5, as well as keychain acquisition and file system extraction for iOS 13.5 and 13.5.1 with checkra1n. Jailbreak-based acquisition engine received a major overhaul, now offering greater than ever speed and stability.

👉 https://www.elcomsoft.com/news/749.html

#jailbreak #iphone #itsecurity #unc0ver #checkra1n #keychain #mobilesecurity #dfir #mobileforensics

Apple Two-Factor Authentication: SMS vs. Trusted Devices

Multi-factor authentication is the new reality. A password alone is no longer considered sufficient. Phishing attacks, frequent leaks of password databases and the ubiquitous issue of reusing passwords make password protection unsafe. Adding “something that you have” to “something that you know” improves the security considerably, having the potential of cutting a chain attack early even in worst case scenarios. However, not all types of two-factor authentication are equally secure.

Let’s talk about the most commonly used type of two-factor authentication: the one based on text messages (SMS) delivered to a trusted phone number.

👉 https://blog.elcomsoft.com/2020/06/apple-two-factor-authentication-sms-vs-trusted-devices/

#2fa #itsecurity #cybersecurity #authentication #clouds #mobilesecurity #smartphone

ElcomSoft Phone Breaker 9.60 and Elcomsoft Phone Viewer 5.10 streamline iCloud data analysis

Elcomsoft Phone Breaker 9.60 streamlines access to iCloud data, breaking down the 17 types of iCloud synced data, the content of iCloud Drive and iCloud backups, into three large groups. By accessing the categories via three distinct groups, experts will be able to save time by analyzing the available information faster.

👉 https://www.elcomsoft.com/news/750.html

#ios #iphone #cloud #mobilesecurity #mobileforensics #keychain #cybersecurity #itsecurity

The Mysterious Apple DCSD Cable Demystified

A lot of people have asked me over the past couple of months – “What’s that cable on your desk, James?”. Today I’ll tell you all about it. Every accessory that connects to your iPhone via lightning is ‘flashed’ with an Accessory ID. The Accessory ID essentially identifies the device connected to the iPhone as a specific type. For example, a Lightning-To-Ethernet adapter will identify itself with it’s assigned Accessory ID so the iPhone knows how to treat the device and interact with it. It’s sort of like directing the iPhone to use a specific driver to interact with said device.

👉 https://blog.elcomsoft.com/2020/06/the-mysterious-apple-dcsd-cable-demystified/

#ios #iphone #mobileforensics #itsecurity #dcsd #cybersecurity

Unlocking BitLocker Volumes by Booting from a USB Drive

BitLocker is Windows default solution for encrypting disk volumes. A large number of organizations protect startup disks with BitLocker encryption. While adding the necessary layer of security, BitLocker also has the potential of locking administrative access to the encrypted volumes if the original Windows logon password is lost. We are offering a straightforward solution for reinstating access to BitLocker-protected Windows systems with the help of a bootable USB drive.

👉 https://blog.elcomsoft.com/2020/06/unlocking-bitlocker-volumes-by-booting-from-a-usb-drive/

#bitlocker #password #recoverykey #usbkey #boot #encryption #fde #cybersecurity #itsecurity #tpm

Elcomsoft System Recovery adds BitLocker support

We updated Elcomsoft System Recovery, a Windows PE-based tool to recover or reset passwords to local Windows accounts and Microsoft accounts in all versions of Windows. The tool adds native support for BitLocker volumes, enabling users to mount BitLocker-encrypted partitions using one of the three supported disk protectors.

📝 Release Notes

👉 https://www.elcomsoft.com/news/752.html

#bitlocker #password #recoverykey #usbkey #boot #encryption #fde #cybersecurity #itsecurity #computerforensics

Extracting and Using Stored Passwords from Web Browsers

Breaking passwords becomes more difficult with every other update of popular software. Microsoft routinely bumps the number of hash iterations to make Office document protection coherent with current hardware. Apple uses excessive protection of iTunes backups since iOS 10.1, making brute force attacks a thing of the past. VeraCrypt and BitLocker were secure from the get go. However, everything is not lost if you consider human nature.

👉 https://blog.elcomsoft.com/2020/07/extracting-and-using-stored-passwords-from-web-browsers/

#browsers #password #passwordrecovery #cybersecurity #itsecurity #digitalforensics

Extracting Passwords from Tencent QQ Browser

QQ Browser is one of China’s most popular Web browsers. With some 10% of the Chinese market and the numerous Chinese users abroad, QQ Browser is used by the millions. Like many of its competitors, QQ Browser offers the ability to store website passwords. The passwords are securely encrypted, and can be only accessed once the user signs into their Windows account. Learn what you need to do to extract passwords from Tencent QQ Browser.

👉 https://blog.elcomsoft.com/2020/07/extracting-passwords-from-tencent-qq-browser/

#browsers #password #passwordrecovery #tencent #qqbrowser #cybersecurity #itsecurity #digitalforensics

Elcomsoft Internet Password Breaker 3.20 extracts Yandex Browser, Tencent QQ and UC Browser passwords

Elcomsoft Internet Password Breaker 3.20 adds the ability to extract stored passwords from the newest versions of Yandex Browser, Tencent QQ and UC Browser. Yandex Browser is Russia’s second most popular desktop Web browser based on usage with some 17.2 per cent of the market, while QQ Browser in China floats around the 10% mark.

👉 https://www.elcomsoft.com/news/753.html

#browsers #password #passwordrecovery #tencent #qqbrowser #ucbrowser #cybersecurity #itsecurity #digitalforensics

Advanced Office Password Recovery 6.60 adds Hancom Office, iWork 2020 v10 support

Advanced Office Password Recovery (AOPR) adds support for the latest edition of Hancom Office 2020, now supporting Hancom documents saved in the new format. Version 6.60 offers full compatibility with Hancom Office Word 2020 documents and Cell 2020 workbooks, as well as the documents produced by iWork 2020.

👉 https://www.elcomsoft.com/news/754.html

#password #hancom #office #iwork #passwordprotection #cybersecurity #itsecurity #infosec

Extracting and Decrypting iOS Keychain: Physical, Logical and Cloud Options Explored

The keychain is one of the hallmarks of the Apple ecosystem. Containing a plethora of sensitive information, the keychain is one of the best guarded parts of the walled garden. At the same time, the keychain is relatively underexplored by the forensic community. The common knowledge has it that the keychain contains the users’ logins and passwords, and possibly some payment card information. The common knowledge is missing the point: the keychain contains literally thousands of records belonging to various apps and the system that are required to access lots of other sensitive information. Let’s talk about the keychain, its content and its protection, and the methods used to extract, decrypt and analyze the various bits and pieces.

👉 https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/

#ios #iphone #mobilesecurity #dfir #passwords #itsecurity #keychain

New Elcomsoft iOS Forensic Toolkit 6.50: jailbreak-free extraction without an Apple Developer Account

The macOS edition of Elcomsoft iOS Forensic Toolkit 6.50 drops the requirement for using a paid Apple Developer account when extracting the file system and decrypting the keychain from a compatible iPhone or iPad device. The new release also adds jailbreak-free agent-based extraction for iOS versions up to and including iOS 13.5.

👉 https://www.elcomsoft.com/news/762.html

##dfir #iphone #ios #itsecurity #iossecurity #mobileforensics

It’s Hashed, Not Encrypted

How many times have you seen the phrase: “Your password is securely encrypted”? More often than not, taking it at face value has little sense. Encryption means the data (such as the password) can be decrypted if you have the right key. Most passwords, however, cannot be decrypted since they weren’t encrypted in the first place. Instead, one might be able to recover them by running a lengthy attack. Let’s talk about the differences between encryption and hashing and discuss why some passwords are so much tougher to break.

👉 https://blog.elcomsoft.com/2020/09/its-hashed-not-encrypted/

#passwords #passwordsecurity #itsecurity #encryption #hashingpasswords #saltedhash

Using Screen Time Password to Protect iPhone Local Backups

The iOS backup system is truly unrivalled. The highly comprehensive, versatile and secure backups can be created with Apple iTunes. For the user, local backups are a convenient and easy way to transfer data to a new device or restore an existing one. In malicious hands, the backup becomes a dangerous weapon. Logins and passwords from the Keychain allow hackers accessing the user’s social accounts, messages, and financial information. A backup password can be set to protect local backups, but it can be removed just as easily shall the hacker have access to the physical iPhone and know its passcode. Let's discuss how the Screen Time password can be used to further strengthen the protection of local backups.

👉 https://blog.elcomsoft.com/2020/09/using-screen-time-password-to-protect-iphone-local-backups/

#iphone #ios #itsecurity #backups #mobilesecurity

Everything You Wanted to Ask About Cracking Passwords


Making tools for breaking passwords, I am frequently asked whether it’s legal, or how it works, or what one can do to protect their password from being cracked. There are people who have “nothing to hide”. There are those wearing tin foil hats, but there are a lot more people who can make a reasonable effort to secure their lives without going overboard. This article is for them.

👉 https://blog.elcomsoft.com/2020/10/everything-you-wanted-to-ask-about-cracking-passwords/

#passwords #cybersecurity #itsecurity

Forensically Sound Cold System Analysis

As opposed to live system analysis, experts performing the cold analysis are not dealing with authenticated user sessions. Instead, cold analysis can be viewed as an intermediary measure with live system analysis on the one end and the examination of a forensic disk image on another. Why and when would you use cold system analysis, what can you do and what benefits does it bring compared to the traditional approach? Read along to find out.

👉 https://blog.elcomsoft.com/2020/12/forensically-sound-cold-system-analysis/

#dfir #datasecurity #encryption #windows #itsecurity

Password Crackers’ Gold Mine: Browser Passwords

How to break ‘strong’ passwords? Is there a methodology, a step by step approach? What shall you start from if your time is limited but you desperately need to decrypt critical evidence? We want to share some tips with you, this time about the passwords saved in the Web browsers on most popular platforms.

👉 https://blog.elcomsoft.com/2021/06/password-crackers-gold-mine-browser-passwords/

#browser #passwords #passwordbreaker #cybersecurity #itsecurity #digitalforensics

Worthless Security Practices

Many security practices still widely accepted today are things of the past. Many of them made sense at the time of short passwords and unrestricted access to workplaces, while some were learned from TV shows with “Russian hackers” breaking Pentagon. In this article we’ll sort it out.

👉 https://blog.elcomsoft.com/2021/12/worthless-security-practices/
#passwords #itsecurity