Breaking Windows Passwords: LM, NTLM, DCC and Windows Hello PIN Compared
Modern versions of Windows have many different types of accounts. Local Windows accounts, Microsoft accounts, and domain accounts feature different types of protection. There is also Windows Hello with PIN codes, which are protected differently from everything else. How secure are these types of passwords, and how can you break them? Read along to find out!
👉 https://blog.elcomsoft.com/2022/08/breaking-windows-passwords-lm-ntlm-dcc-and-windows-hello-pin-compared/
#edpr #Windows11 #pincode #dfir #windowshello #password
Modern versions of Windows have many different types of accounts. Local Windows accounts, Microsoft accounts, and domain accounts feature different types of protection. There is also Windows Hello with PIN codes, which are protected differently from everything else. How secure are these types of passwords, and how can you break them? Read along to find out!
👉 https://blog.elcomsoft.com/2022/08/breaking-windows-passwords-lm-ntlm-dcc-and-windows-hello-pin-compared/
#edpr #Windows11 #pincode #dfir #windowshello #password
Probing Linux Disk Encryption: LUKS2, Argon 2 and GPU Acceleration
Disk encryption is widely used desktop and laptop computers. Many non-ZFS Linux distributions rely on LUKS for data protection. LUKS is a classic implementation of disk encryption offering the choice of encryption algorithms, encryption modes and hash functions. LUKS2 further improves the already tough disk encryption. Learn how to deal with LUKS2 encryption in Windows and how to break in with distributed password attacks.
👉 https://blog.elcomsoft.com/2022/08/probing-linux-disk-encryption-luks2-argon-2-and-gpu-acceleration/
#LUKS2 #EDPR #EFDD #diskencryption #dfir
Disk encryption is widely used desktop and laptop computers. Many non-ZFS Linux distributions rely on LUKS for data protection. LUKS is a classic implementation of disk encryption offering the choice of encryption algorithms, encryption modes and hash functions. LUKS2 further improves the already tough disk encryption. Learn how to deal with LUKS2 encryption in Windows and how to break in with distributed password attacks.
👉 https://blog.elcomsoft.com/2022/08/probing-linux-disk-encryption-luks2-argon-2-and-gpu-acceleration/
#LUKS2 #EDPR #EFDD #diskencryption #dfir
Elcomsoft iOS Forensic Toolkit 7.60 extends agent-based full file system extraction
Elcomsoft iOS Forensic Toolkit 7.60 extends agent-based extraction support all the way up to iOS 15.3.1 on Apple A11-A15 and M1 devices. The new release delivers full file system extraction for iOS 15.2 through 15.3.1, while still offering file system and keychain extraction support for all earlier versions of iOS.
👉 https://www.elcomsoft.com/news/821.html
#eift #ios #agent #mobileforensics #dfir
Elcomsoft iOS Forensic Toolkit 7.60 extends agent-based extraction support all the way up to iOS 15.3.1 on Apple A11-A15 and M1 devices. The new release delivers full file system extraction for iOS 15.2 through 15.3.1, while still offering file system and keychain extraction support for all earlier versions of iOS.
👉 https://www.elcomsoft.com/news/821.html
#eift #ios #agent #mobileforensics #dfir
Low-Level Extraction of iOS 15.2-15.3.1
iOS Forensic Toolkit 7.60 brings gapless low-level extraction support for several iOS versions from iOS 15.2 up to and including iOS 15.3.1, adding full file system extraction support for Apple devices based on Apple A11-A15 and M1 chips.
Read more in our blog 👉 https://blog.elcomsoft.com/2022/08/low-level-extraction-of-ios-15-2-15-3-1/
#eift #ios #apple #dfir #mobileforensics
iOS Forensic Toolkit 7.60 brings gapless low-level extraction support for several iOS versions from iOS 15.2 up to and including iOS 15.3.1, adding full file system extraction support for Apple devices based on Apple A11-A15 and M1 chips.
Read more in our blog 👉 https://blog.elcomsoft.com/2022/08/low-level-extraction-of-ios-15-2-15-3-1/
#eift #ios #apple #dfir #mobileforensics
Entering DFU: iPhone 8, 8 Plus, and iPhone X
DFU (Device Firmware Update) is a special service mode available in many Apple devices for recovering corrupted devices by uploading a clean copy of the firmware. Forensic specialists use DFU during checkm8 extractions (Elcomsoft iOS Forensic Toolkit). Unlike Recovery, which serves a similar purpose, DFU operates on a lower level and is undocumented. Surprisingly, there might be more than one DFU mode, one being more reliable than the others when it comes to forensic extractions. The method described in this article works for the iPhone 8, 8 Plus and iPhone X.
👉 https://blog.elcomsoft.com/2022/09/entering-dfu-iphone-8-8-plus-and-iphone-x/
#iphone #DFU #iOS #eift #mobileforensics
DFU (Device Firmware Update) is a special service mode available in many Apple devices for recovering corrupted devices by uploading a clean copy of the firmware. Forensic specialists use DFU during checkm8 extractions (Elcomsoft iOS Forensic Toolkit). Unlike Recovery, which serves a similar purpose, DFU operates on a lower level and is undocumented. Surprisingly, there might be more than one DFU mode, one being more reliable than the others when it comes to forensic extractions. The method described in this article works for the iPhone 8, 8 Plus and iPhone X.
👉 https://blog.elcomsoft.com/2022/09/entering-dfu-iphone-8-8-plus-and-iphone-x/
#iphone #DFU #iOS #eift #mobileforensics
Elcomsoft iOS Forensic Toolkit 8.0 brings forensically sound bootloader-based extraction for select iPhone & iPad models
Elcomsoft iOS Forensic Toolkit 8.0 is a major release bringing support for repeatable, verifiable, and truly forensically sound bootloader-level extraction of 76 Apple devices ranging from the ancient iPhone 4 all the way up to the iPhone X, a large number of iPad, iPod Touch, Apple Watch, and Apple TV models, and featuring a refreshed, command-line driven user interface.
👉 https://www.elcomsoft.com/news/822.html
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16
Elcomsoft iOS Forensic Toolkit 8.0 is a major release bringing support for repeatable, verifiable, and truly forensically sound bootloader-level extraction of 76 Apple devices ranging from the ancient iPhone 4 all the way up to the iPhone X, a large number of iPad, iPod Touch, Apple Watch, and Apple TV models, and featuring a refreshed, command-line driven user interface.
👉 https://www.elcomsoft.com/news/822.html
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16
iOS 16: Extracting the File System and Keychain from A11 Devices
Bootloader-based acquisition is the only 100% forensically sound data extraction method for Apple devices. It is the only way to acquire the full set of data from those devices that run iOS 16, albeit with a huge caveat that makes the whole thing more of a brain exercise than a practical forensic tool. Let’s review the iOS 16 compatibility in iOS Forensic Toolkit and go through the whole process step by step.
👉 https://blog.elcomsoft.com/2022/09/ios-16-extracting-the-file-system-and-keychain-from-a11-devices/
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain
Bootloader-based acquisition is the only 100% forensically sound data extraction method for Apple devices. It is the only way to acquire the full set of data from those devices that run iOS 16, albeit with a huge caveat that makes the whole thing more of a brain exercise than a practical forensic tool. Let’s review the iOS 16 compatibility in iOS Forensic Toolkit and go through the whole process step by step.
👉 https://blog.elcomsoft.com/2022/09/ios-16-extracting-the-file-system-and-keychain-from-a11-devices/
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain
iOS Forensic Toolkit 8.0 Now Official: Bootloader-Level Extraction for 76 Devices
iOS Forensic Toolkit 8.0 is officially released! Delivering forensically sound checkm8 extraction and a new command-line driven user experience, the new release becomes the most sophisticated mobile forensic tool we’ve released to date.
👉🏻 https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain
iOS Forensic Toolkit 8.0 is officially released! Delivering forensically sound checkm8 extraction and a new command-line driven user experience, the new release becomes the most sophisticated mobile forensic tool we’ve released to date.
👉🏻 https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain
iOS 16: SEP Hardening, New Security Measures and Their Forensic Implications
iOS 16 brings many changes to mobile forensics. Users receive additional tools to control the sharing and protection of their personal information, while forensic experts will face tighter security measures. In this review, we’ll talk about the things in iOS 16 that are likely to affect the forensic workflow.
👉🏻 https://blog.elcomsoft.com/2022/09/ios-16-sep-hardening-new-security-measures-and-their-forensic-implications/
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #checkm8
iOS 16 brings many changes to mobile forensics. Users receive additional tools to control the sharing and protection of their personal information, while forensic experts will face tighter security measures. In this review, we’ll talk about the things in iOS 16 that are likely to affect the forensic workflow.
👉🏻 https://blog.elcomsoft.com/2022/09/ios-16-sep-hardening-new-security-measures-and-their-forensic-implications/
#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #checkm8
How to Put Apple TV 3 (2012-2013), Apple TV HD (2015) and Apple TV 4K (2017) into DFU
The title says it all. In this article we’ll explain the steps required to put the listed Apple TV models into DFU mode. These Apple TV models are based on the A5, A8, and A10X chips that are susceptible to the checkm8 exploit and checkm8-based extraction with iOS Forensic Toolkit 8, and DFU mode is the required initial step of the process.
👉 https://blog.elcomsoft.com/2022/10/how-to-put-apple-tv-3-2012-2013-apple-tv-hd-2015-and-apple-tv-4k-2017-into-dfu/
#dfu #appletv #eift #mobileforensics #dfir
The title says it all. In this article we’ll explain the steps required to put the listed Apple TV models into DFU mode. These Apple TV models are based on the A5, A8, and A10X chips that are susceptible to the checkm8 exploit and checkm8-based extraction with iOS Forensic Toolkit 8, and DFU mode is the required initial step of the process.
👉 https://blog.elcomsoft.com/2022/10/how-to-put-apple-tv-3-2012-2013-apple-tv-hd-2015-and-apple-tv-4k-2017-into-dfu/
#dfu #appletv #eift #mobileforensics #dfir
Elcomsoft Phone Breaker 10.12: better compatibility, iCloud-related improvements
Elcomsoft Phone Breaker 10.12 fixes bugs and improves compatibility with Windows 11, macOS 12 and 13. The new build also improves compatibility with iOS 16 backups and recognizes iCloud backups created by iPhone 14 series and iPhone SE 2022 devices.
👉 https://www.elcomsoft.com/news/823.html
#phonebreaker #dfir #mobileforensics #icloud #ios16
Elcomsoft Phone Breaker 10.12 fixes bugs and improves compatibility with Windows 11, macOS 12 and 13. The new build also improves compatibility with iOS 16 backups and recognizes iCloud backups created by iPhone 14 series and iPhone SE 2022 devices.
👉 https://www.elcomsoft.com/news/823.html
#phonebreaker #dfir #mobileforensics #icloud #ios16
checkm8 Extraction Cheat Sheet: iPhone and iPad Devices
The newly released iOS Forensic Toolkit 8.0 delivers forensically sound checkm8 extraction powered with a command-line interface. The new user experience offers full control over the extraction process, yet mastering the right workflow may become a challenge for those unfamiliar with command-line tools. In this quick-start guide we will lay out the steps required to perform a clean, forensically sound extraction of a compatible iPhone or iPad device.
👉 https://blog.elcomsoft.com/2022/11/checkm8-extraction-cheat-sheet-iphone-and-ipad-devices/
#eift #toolkit #checkm8 #ios16 #dfir #dfu #mobileforensics
The newly released iOS Forensic Toolkit 8.0 delivers forensically sound checkm8 extraction powered with a command-line interface. The new user experience offers full control over the extraction process, yet mastering the right workflow may become a challenge for those unfamiliar with command-line tools. In this quick-start guide we will lay out the steps required to perform a clean, forensically sound extraction of a compatible iPhone or iPad device.
👉 https://blog.elcomsoft.com/2022/11/checkm8-extraction-cheat-sheet-iphone-and-ipad-devices/
#eift #toolkit #checkm8 #ios16 #dfir #dfu #mobileforensics
iOS Backups: Leftover Passwords
In Apple ecosystem, logical acquisition is the most convenient and the most compatible extraction method, with local backups being a major contributor. Password-protected backups contain significantly more information than unencrypted backups, which is why many forensic tools including iOS Forensic Toolkit automatically apply a temporary backup password before creating a backup. If a temporary password is not removed after the extraction, subsequent extraction attempts, especially made with a different tool, will produce encrypted backups protected with an effectively unknown password. In this article we’ll talk about why this happens and how to deal with it.
👉 https://blog.elcomsoft.com/2022/11/ios-backups-leftover-passwords/
#EDPR #EIFT #PhoneBreaker #password #iOS #iTunes
In Apple ecosystem, logical acquisition is the most convenient and the most compatible extraction method, with local backups being a major contributor. Password-protected backups contain significantly more information than unencrypted backups, which is why many forensic tools including iOS Forensic Toolkit automatically apply a temporary backup password before creating a backup. If a temporary password is not removed after the extraction, subsequent extraction attempts, especially made with a different tool, will produce encrypted backups protected with an effectively unknown password. In this article we’ll talk about why this happens and how to deal with it.
👉 https://blog.elcomsoft.com/2022/11/ios-backups-leftover-passwords/
#EDPR #EIFT #PhoneBreaker #password #iOS #iTunes
Advanced Logical Extraction with iOS Forensic Toolkit 8: Cheat Sheet
Advanced logical acquisition is the most compatible and least complicated way to access essential evidence stored in Apple devices. In legacy versions of iOS Forensic Toolkit, we offered a 1-2-3 style, menu-driven extraction experience, while the updated release of iOS Forensic Toolkit 8.0 is driven by the command line. In this quick-start guide we will lay out the steps required to extract the most amount of data from Apple devices via the advanced logical process.
👉 https://blog.elcomsoft.com/2022/11/advanced-logical-extraction-with-ios-forensic-toolkit-8-cheat-sheet/
#eift #toolkit #ios #logicalacquisition #dfir #mobileforensics
Advanced logical acquisition is the most compatible and least complicated way to access essential evidence stored in Apple devices. In legacy versions of iOS Forensic Toolkit, we offered a 1-2-3 style, menu-driven extraction experience, while the updated release of iOS Forensic Toolkit 8.0 is driven by the command line. In this quick-start guide we will lay out the steps required to extract the most amount of data from Apple devices via the advanced logical process.
👉 https://blog.elcomsoft.com/2022/11/advanced-logical-extraction-with-ios-forensic-toolkit-8-cheat-sheet/
#eift #toolkit #ios #logicalacquisition #dfir #mobileforensics
Cloud Forensics: Obtaining iCloud Backups, Media Files and Synchronized Data
Apple offers by far the most sophisticated solution for backing up, restoring, transferring and synchronizing data across devices belonging to the company’s ecosystem. Apple iCloud can store cloud backups and media files, synchronize essential information between Apple devices, and keep highly sensitive information such as Health and authentication credentials securely synchronized. In this article we’ll explain what kinds of data are stored in iCloud and what you need to access them.
👉 https://blog.elcomsoft.com/2022/11/cloud-forensics-obtaining-icloud-backups-media-files-and-synchronized-data/
#cloudforensics #PhoneBreaker #EPB #iCloud #backup #iOS #dfir
Apple offers by far the most sophisticated solution for backing up, restoring, transferring and synchronizing data across devices belonging to the company’s ecosystem. Apple iCloud can store cloud backups and media files, synchronize essential information between Apple devices, and keep highly sensitive information such as Health and authentication credentials securely synchronized. In this article we’ll explain what kinds of data are stored in iCloud and what you need to access them.
👉 https://blog.elcomsoft.com/2022/11/cloud-forensics-obtaining-icloud-backups-media-files-and-synchronized-data/
#cloudforensics #PhoneBreaker #EPB #iCloud #backup #iOS #dfir
iOS Forensic Toolkit 8 Extraction Agent Cheat Sheet
iOS Forensic Toolkit 8 brings new powerful user experience based on the command line. While this approach offers experts full control over the extraction process, mastering the right workflow may become a challenge for those unfamiliar with command-line tools. In this quick-start guide we will lay out the steps required to extract the file system and decrypt the keychain of a compatible iPhone or iPad device.
👉 https://blog.elcomsoft.com/2022/11/ios-forensic-toolkit-8-extraction-agent-cheat-sheet/
#ios #eift #extractionagent #dfir #mobileforensics
iOS Forensic Toolkit 8 brings new powerful user experience based on the command line. While this approach offers experts full control over the extraction process, mastering the right workflow may become a challenge for those unfamiliar with command-line tools. In this quick-start guide we will lay out the steps required to extract the file system and decrypt the keychain of a compatible iPhone or iPad device.
👉 https://blog.elcomsoft.com/2022/11/ios-forensic-toolkit-8-extraction-agent-cheat-sheet/
#ios #eift #extractionagent #dfir #mobileforensics
Approaching iOS Extractions: Choosing the Right Acquisition Method
The extraction method or methods available for a particular iOS device depend on the device’s hardware platform and the installed version of iOS. While logical acquisition is available for all iOS and iPadOS devices, more advanced extraction methods are available for older platforms and versions of iOS. But what if more than one way to extract the data is available for a given device? In this guide, we’ll discuss the applicable acquisition methods as well as the order in which they should be used.
👉 https://blog.elcomsoft.com/2022/11/approaching-ios-extractions-choosing-the-right-acquisition-method/
#ios #checkm8 #agent #edpr #eift #toolkit #dfir #mobileforensics #dataextraction
The extraction method or methods available for a particular iOS device depend on the device’s hardware platform and the installed version of iOS. While logical acquisition is available for all iOS and iPadOS devices, more advanced extraction methods are available for older platforms and versions of iOS. But what if more than one way to extract the data is available for a given device? In this guide, we’ll discuss the applicable acquisition methods as well as the order in which they should be used.
👉 https://blog.elcomsoft.com/2022/11/approaching-ios-extractions-choosing-the-right-acquisition-method/
#ios #checkm8 #agent #edpr #eift #toolkit #dfir #mobileforensics #dataextraction
iOS Forensic Toolkit 8 Apple Watch S3 checkm8 Extraction Cheat Sheet
checkm8 is the only extraction method available for the Apple Watch S3 allowing full access to essential evidence stored in the device. In this guide, we will talk about connecting the Apple Watch S3 to the computer, placing the watch into DFU mode, applying the checkm8 exploit and extracting the file system from the device with iOS Forensic Toolkit 8.0.
👉 https://blog.elcomsoft.com/2022/11/ios-forensic-toolkit-8-apple-watch-s3-checkm8-extraction-cheat-sheet/
#applewatch #checkm8 #eift #dfir
checkm8 is the only extraction method available for the Apple Watch S3 allowing full access to essential evidence stored in the device. In this guide, we will talk about connecting the Apple Watch S3 to the computer, placing the watch into DFU mode, applying the checkm8 exploit and extracting the file system from the device with iOS Forensic Toolkit 8.0.
👉 https://blog.elcomsoft.com/2022/11/ios-forensic-toolkit-8-apple-watch-s3-checkm8-extraction-cheat-sheet/
#applewatch #checkm8 #eift #dfir
iOS Forensic Toolkit 8: Apple TV 3, 4, and 4K checkm8 Extraction Cheat Sheet
Several generations of Apple TV devices have a bootloader vulnerability that can be exploited with checkm8 to extract information from the device. The vulnerability exists in the Apple TV 3 (2012 and 2013), Apple TV HD (formerly Apple TV 4) 2015 and 2021, and Apple TV 4K (2017). Newer generations of Apple TV do not have the vulnerability. This guide lists the tools and steps required to fully extract a compatible Apple TV device.
👉 https://blog.elcomsoft.com/2022/12/ios-forensic-toolkit-8-apple-tv-3-4-and-4k-checkm8-extraction-cheat-sheet/
#EIFT #appleTV #checkm8 #dfir
Several generations of Apple TV devices have a bootloader vulnerability that can be exploited with checkm8 to extract information from the device. The vulnerability exists in the Apple TV 3 (2012 and 2013), Apple TV HD (formerly Apple TV 4) 2015 and 2021, and Apple TV 4K (2017). Newer generations of Apple TV do not have the vulnerability. This guide lists the tools and steps required to fully extract a compatible Apple TV device.
👉 https://blog.elcomsoft.com/2022/12/ios-forensic-toolkit-8-apple-tv-3-4-and-4k-checkm8-extraction-cheat-sheet/
#EIFT #appleTV #checkm8 #dfir
Windows Account Passwords: Why and How to Break NTLM Credentials
Windows account passwords, or NTLM passwords, are among the easiest to recover due to their relatively low cryptographic strength. At the same time, NTLM passwords can be used to unlock DPAPI-protected data such as the user’s passwords stored in Web browsers, encrypted chats, EFS-protected files and folders, and a lot more. In this article we argue about prioritizing the recovery of NTLM hashes over any other types of encrypted data.
👉 https://blog.elcomsoft.com/2022/12/windows-account-passwords-why-and-how-to-break-ntlm-credentials/
#windows #ntlm #password #edpr #dpapi #microsoftaccount
Windows account passwords, or NTLM passwords, are among the easiest to recover due to their relatively low cryptographic strength. At the same time, NTLM passwords can be used to unlock DPAPI-protected data such as the user’s passwords stored in Web browsers, encrypted chats, EFS-protected files and folders, and a lot more. In this article we argue about prioritizing the recovery of NTLM hashes over any other types of encrypted data.
👉 https://blog.elcomsoft.com/2022/12/windows-account-passwords-why-and-how-to-break-ntlm-credentials/
#windows #ntlm #password #edpr #dpapi #microsoftaccount
Elcomsoft Phone Viewer 5.40 updated for iOS 16
Elcomsoft Phone Viewer gains full support for the updated local and cloud backup formats introduced in iOS 16. The tool can now display the content of iTunes and iCloud backups and synchronized data produced by devices running the new OS. In addition, Elcomsoft Phone Viewer 5.40 adds support for file system images obtained from devices running iOS 16.
👉 https://www.elcomsoft.com/news/825.html
#EPV #iCloud #iOS16 #dfir #mobileforensics
Elcomsoft Phone Viewer gains full support for the updated local and cloud backup formats introduced in iOS 16. The tool can now display the content of iTunes and iCloud backups and synchronized data produced by devices running the new OS. In addition, Elcomsoft Phone Viewer 5.40 adds support for file system images obtained from devices running iOS 16.
👉 https://www.elcomsoft.com/news/825.html
#EPV #iCloud #iOS16 #dfir #mobileforensics