Elcomsoft Phone Viewer 5.0 displays Telegram secret chats

Elcomsoft Phone Viewer is updated with support for Telegram conversation histories. Telegram analysis is available when accessing a file system image extracted from the iPhone or iPad device with Elcomsoft iOS Forensic Toolkit by using agent-based or jailbreak-based file system imaging. Experts can now decrypt and analyse the complete Telegram communication histories including secure chats when analysing the results of iOS file system acquisition.

👉 https://www.elcomsoft.com/news/743.html

📝 Release Notes

#telegram #signal #ios #iphone #mobileforensics #itsecurity #secretchats #datasecurity

How To Extract Telegram Secret Chats from the iPhone


With nearly half a billion users, Telegram is an incredibly popular cross-platform instant messaging app. While Telegram is not considered the most secure instant messaging app (this title belongs to Signal), its conversation histories do not appear in either iTunes or iCloud backups. Moreover, Telegram secure chats are not stored on Telegram servers. As a result, Telegram secret chats can be only extracted from the device of origin. Learn how to extract and analyse Telegram secret chats from the iPhone file system image.

Keep reading 👉 https://blog.elcomsoft.com/2020/04/how-to-extract-telegram-secret-chats-from-the-iphone/

By Oleg Afonin

#telegram #secretchats #ios #iphone #communications #messages

Forensic guide to iMessage, WhatsApp, Telegram, Signal and Skype data acquisition

Instant messaging apps have become the de-facto standard of real-time, text-based communications. The acquisition of instant messaging chats and communication histories can be extremely important for an investigation. In this article, we compare the five top instant messaging apps for iOS in the context of their forensic analysis.

👉 https://blog.elcomsoft.com/2020/04/forensic-guide-to-imessage-whatsapp-telegram-signal-and-skype-data-acquisition/

#telegram #skype #imessage #whatsapp #signal #iphone #messengers #secretchats #messages #mobilesecurity #mobileforensics

How to Unlock Windows Systems with a Bootable Flash Drive


Accessing a locked system is always a challenge. While you might be tempted to pull the plug and image the disk, you could miss a lot of valuable evidence if you do. Full-disk encryption, EFS-encrypted files and folders and everything protected with DPAPI (including the passwords stored in most modern Web browsers) are just a few obstacles to mention. Recovering the original Windows logon is a must to access the full set of data, while resetting the logon password may help unlock working accounts in emergencies.

Dealing with Full Disk Encryption

Full-disk encryption presents an immediate challenge to forensic experts...

👉 https://blog.elcomsoft.com/2020/04/how-to-unlock-windows-systems-with-a-bootable-flash-drive/

#windows #systempasswords #passwords #EFS #encryption #dataprotection #desktopforensics

Elcomsoft Cloud Explorer 2.31 extracts more of Google Dashboard

The updated Elcomsoft Cloud Explorer 2.31 offers enhanced support for extracting Google Dashboard data, a Google service for storing and managing personal data collected by Google Inc about its users. In this release, Elcomsoft Cloud Explorer significantly expands the number of categories obtained from Google Dashboard, extracting significantly more information than ever before. The newly added Dashboard categories include Maps, Calendar, Disk, Alerts, Analytics, Books, Groups, News, Package tracking, Payments, Photos, Google Play Music, Google Play, Tasks, Blogger, AdSense, Brand Accounts, FeedBurner, Search, and Keep.

👉 https://www.elcomsoft.com/news/744.html

#google #googlecloud #itsecurity #dashboard #googleservices #chrome #gmail #photos #mobileforensics #dfir

Extracting Google Dashboard Data

We have updated Elcomsoft Cloud Explorer, our Google Account extraction tool, with Google Dashboard support. The Google Dashboard service is little known among computer forensic specialists since Dashboard data cannot be downloaded from Google or obtained by serving a legal request. Yet, Dashboard aggregates massive amounts of data collected and stored in the user’s Google Account, offering an essential overview of the user’s activities. In this article, we’ll demonstrate how to obtain Dashboard data directly from the user’s Google account.

👉 https://blog.elcomsoft.com/2020/05/extracting-google-dashboard-data/

#google #googleservice #googlecloud #dashboard #gmail #chrome #googlefit #locations #datasecurity #itsecurity #mobilesecurity #dfir

Google Account Access Without a Password

Cloud acquisition is one of the most common ways to obtain valuable evidence. When it comes to Google, the Google Account analysis may return significantly more data compared to the extraction of a physical Android device. However, there is one feature that is often overlooked: the ability to extract data stored in the user’s Google Account without the login and password. Let’s talk about Google authentication tokens and what they bring for the mobile forensics.

👉 https://blog.elcomsoft.com/2020/05/google-account-access-without-a-password/

#google #password #token #authentication #dataaccess #datasecurity #itsecurity #mobileforensics #cloudsecurity

iOS Forensic Toolkit 5.50: iPhone extraction simplified

Elcomsoft iOS Forensic Toolkit 5.50 features a new communication channel empowering the tool’s acquisition engine. The newly designed communication channel offers faster and more robust extractions and simplifies the acquisition process by removing the need of disabling wireless connectivity.

👉 https://www.elcomsoft.com/news/745.html

📝 EIFT Release Notes

#iphone #ios #dataextraction #elcomsoftagent #toolkit #iOS13.5 #mobileforensics #mobilesecurity #filesystem #keychain

iOS Acquisition Reloaded

The new build of iOS Forensic Toolkit is out. This time around, most of the changes are “internal” and do not add much functionality, but there is a lot going on behind the scenes. In this article, we will describe in details what is new and important, and how it’s going to affect you. We’ll share some tips on how to use the software in the most effective way, making sure that you extract all the data from iOS devices in the most forensically sound possible.

👉 https://blog.elcomsoft.com/2020/05/ios-acquisition-reloaded/

#eift #iphone #ios #mobilesecurity #mobileforensics #dfir #itsecurity #smartphone #dataextraction #ElcomsoftAgent #decryption

Working Around the iPhone USB Restricted Mode

The USB restricted mode was introduced in iOS 11.4.1, improved in iOS 12 and further strengthened in iOS 13. The USB restrictions are a real headache for iPhone investigators. We’ve discovered a simple yet effective trick to fool it in some cases, but currently it securely protects the iPhones from passcode cracking and BFU (Before First Unlock) extractions. However, there is a trick allowing you to obtain some information from devices with disabled USB interface. Learn how to use this trick with the recently updated iOS Forensic Toolkit.

👉 https://blog.elcomsoft.com/2020/05/iphone-usb-restricted-mode-workaround/

#ios #iphone #ecx #dataextraction #mobileforensics #dfir #usbrestrictedmode #mobilesecurity

Apple vs. Law Enforcement – iOS 4 through 13.5

Today’s smartphones are a forensic goldmine. Your smartphone learns and knows about your daily life more than everything and everyone else. It tracks your location and counts your footsteps, AI’s your pictures and takes care of your payments. With that much data concentrated in a single device, it is reasonable to expect the highest level of protection. In this article, we’ll review the timeline of Apple’s measures to protect their users’ data and the countermeasures used by the law enforcement. This time no cloud, just pure device forensics.

👉 https://blog.elcomsoft.com/2020/05/apple-vs-law-enforcement-ios-4-through-13-5/

#ios #iphone #apple #encryption #protection #itsecurity #cybersecurity #mobileforensics #dfir #mobilesecurity

Apple vs. Law Enforcement: poker face?

“We shouldn’t ask our customers to make a tradeoff between privacy and security. We need to offer them the best of both. Ultimately, protecting someone else’s data protects all of us.” Guess who said that? The answer is at the end of the article. In the meantime, we keep talking of iPhone and iOS security, following up the Apple vs. Law Enforcement – iOS 4 through 13.5 article. This time we are about to discuss some other aspects of iOS security.

The Exploits

I think you know about the renewed Apple Security Bounty program. Participants can earn up to $100,000 for a new lock screen bypass, and up to $250,000 for user data extraction.

👉 https://blog.elcomsoft.com/2020/05/apple-vs-law-enforcement-poker-face/

#mobileforensics #apple #lawenforcement #encryption #privacy #exploits #grayshift #cellebrite

All mobile and cloud forensic practitioners are welcome to refresh their skills and get another professional overview of the current situation in iOS, Android, and Windows forensics allowing you to effectively retrieve and analyze mobile and cloud data. Learn the latest forensic techniques to investigate mobile devices across various mobile platforms with the help of both open source and paid solutions. The fourth edition of Practical Mobile Forensics written by our colleagues offers to explore the real-life scenarios. Thank you guys for using our tools in it!

👉 https://www.amazon.com/dp/183864752X/

#iOS #security #iphone #mobileforensics #macos #informationtechnology #digitalforensics #dfir #cloudsecurity

Elcomsoft Distributed Password Recovery 4.21 updated with stronger privacy control, breaks Mozilla Firefox master password

Elcomsoft Distributed Password Recovery 4.21 adds support for Mozilla Firefox master passwords, enabling accelerated attacks on the Firefox password storage database. In addition, we offer stricter privacy control, enabling EDPR to perform attacks on tiny files that only contain encryption metadata extracted from Microsoft Office, Open Document, Apple iWork, Hancom and Adobe Acrobat documents without any of the actual content.

👉 https://www.elcomsoft.com/news/746.html

📝 Release notes (PDF)

#firefox #hash #hashextractor #cloudcomputing #microsoftoffice #openoffice #hancom #adobe #passwordcracking #itsecurity #digitalforensics

Unlocking BitLocker: Can You Break That Password?

BitLocker is one of the most advanced and most commonly used volume encryption solutions. BitLocker is well-studied and extensively documented solution with few known vulnerabilities and a limited number of possible vectors of attack. BitLocker volumes may be protected with one or more protectors such as the hardware-bound TPM, user-selectable password, USB key, or combination thereof. Attacking the password is only possible in one of these cases, while other protectors require a very different set of attacks. Learn how to approach BitLocker volumes depending on the type of protector.

👉 https://blog.elcomsoft.com/2020/05/unlocking-bitlocker-can-you-break-that-password/

#bitlocker #computersecurity #datadecryption #password #hash #hashextrctor #diskecnryption #cybersecurity

Tighter Control over Personal Information with Attacks on Encryption Metadata


When attacking a password, the traditional forensic workflow requires uploading the entire encrypted file or document into a password recovery tool. This approach, while simple and intuitive, has one major drawback if you are using remote computers or cloud instances to perform an attack. If the remote computer is compromised, the entire file or document is leaked complete with its (still encrypted) contents. Learn how to overcome this issue and perform remote attacks without the reason of leaking personal information.

Encryption Metadata

The solution to the problem is obvious: use just the required minimum of information to run the attack. In the case of document passwords, this means...

👉 https://blog.elcomsoft.com/2020/05/tighter-control-over-personal-information-with-attacks-on-encryption-metadata/

#hashextractor #passwords #itsecurity #computersecurity #datasecurity #digitalforensics #dfir #cloudcomputing

Full File System Extraction for iOS 13.3.1, 13.4 and 13.4.1

Elcomsoft iOS Forensic Toolkit 6.0 is out, adding direct, forensically sound extraction for Apple devices running some of the latest versions of iOS including iOS 13.3.1, 13.4 and 13.4.1. Supported devices include the entire iPhone 6s, 7, 8, X, Xr/Xs, 11, and 11 Pro (including Plus and Max versions) range, the iPhone SE, and corresponding iPad models. Let’s review the changes and talk about the new acquisition method in general.

Agent-based extraction: the technology

For a long time, we relied on publicly available jailbreaks to perform full file system and keychain acquisition. That is not a forensically sound method as there are risks (though minimal) to brick the device. Even if you are using the rootless jailbreak, some significant changes to the system are still being made, and they cannot be always rolled back.

👉 https://blog.elcomsoft.com/2020/05/full-file-system-acquisition-for-ios-13-3-1-13-4-and-13-4-1/

#ios #iphone #dfir

iOS Forensic Toolkit 6.0: jailbreak-free extraction for iOS 11 through 13.4.1

Elcomsoft iOS Forensic Toolkit 6.0 offers direct, forensically sound extraction for Apple devices running all versions of iOS from iOS 11 through iOS 13.4.1 without a jailbreak. This release adds full file system extraction support for the latest iOS builds including iOS 13.3.1, 13.4, and 13.4.1 for the iPhone 6s, 7, 8, X, Xr/Xs, 11, and 11 Pro generation devices (including the corresponding Plus and Max versions), as well as latest iPhone SE.

👉 https://www.elcomsoft.com/news/747.html

📝 Release Notes (PDF)

#ios #iphone #mobileforensics #dfir #mobilesecurity #itsecurity #dataextraction

iOS Jailbreaks, SSH, and root Password

Modern jailbreaks, in addition to removing several iOS restrictions (for example, disabling signature verification, escalating privileges or bypassing the sandbox), allow obtaining low-level access to the device’s file system. This allows connecting to an iOS device via SSH and gaining almost unlimited access to the system. Some jailbreaks install an OpenSSH (or dropbear) server immediately as they are installed. If not, then SSH can be installed manually from the Cydia repository (OpenSSH package). In this article, I’ll discuss several issues related to SSH, including the following.

- How to understand if SSH is installed and working on the device?
- How to change the root password?
- How to reset the root password to its default value if one is unknown?

👉 https://blog.elcomsoft.com/2020/05/ios-jailbreaks-ssh-and-root-password/

#mobileforensics #ios #iphone #smartphone #jailbreak #password #ssh

Clearing Confusion About our Password Recovery Tools

There is a bit of confusion about our software designed to allow breaking into password-protected systems, files, documents, and encrypted containers. We have as many as three products (and five different tools) dealing with the matter: Elcomsoft Forensic Disk Decryptor (with an unnamed memory dumping tool), Elcomsoft System Recovery and Elcomsoft Distributed Password Recovery, which also includes Elcomsoft Hash Extractor as part of the package. Let’s briefly go through all of them. Hopefully it will help you select the right product for your needs and save time in your investigation.

👉 https://blog.elcomsoft.com/2020/05/clearing-confusion-about-our-password-recovery-tools/

By Oleg Afonin

#password #passwordrecovery #encryption #itsecurity #cybersecurity #dataaccess #dfir #difitalforensics

Full File System and Keychain Acquisition with unc0ver jailbreak: iOS 13.1 to 13.5

The unc0ver v5 jailbreak has been available for a while now. It supports the newest versions of iOS up to and including iOS 13.5, and this is fantastic news for DFIR community, as it allows extracting the full file system and the keychain when acquiring the newest latest iPhone models such as the iPhone 11 and 11 Pro, and SE 2020. In this article, I’ll talk about the unc0ver jailbreak, the installation and usage for the purpose of file system extraction, and discuss the differences between jailbreak-based and jailbreak-free extraction.

👉 https://blog.elcomsoft.com/2020/05/full-file-system-and-keychain-acquisition-with-unc0ver-jailbreak-ios-13-1-to-13-5/

By Vladimir Katalov

#uncover #ios #iphone #iOS135 #cybersecurity #itsecurity #mobileforensics