Digital Triage Masterclass🇷🇺

For decades, the forensic “gold standard” was straightforward: isolate the machine, pull the plug, and image the drive. In that era, what you saw on the screen was exactly what you would extract, bit by bit, from the magnetic platters. Today, that assumption is outdated, and is actively detrimental to an investigation...

Enter digital triage❤️
Far from being just an industry buzzword, triage has emerged as a practical necessity for modern investigations. It serves as the bridge between the initial seizure of a device and the final lab report.

Instead of acquiring raw sectors and waiting for parsing, digital triage zeroes in on high-value artifacts – communications, web activity, system usage, and active sessions, – allowing investigators to bypass the imaging bottleneck and make immediate, actionable decisions in the field🔑

The primary advantage of this methodology is its operational efficiency: the ability to cut through hundreds of gigabytes of irrelevant system files to quickly extract just the data that matters. By prioritizing high-value evidence, investigators can make actionable decisions on the spot.

Let's discuss:

❓️The Toolkit: Elcomsoft Quick Triage and Elcomsoft System Recovery

We have two different tools that cover two distinct digital triage scenarios: Elcomsoft Quick Triage (EQT) and Elcomsoft System Recovery (ESR). Both tools are ultimately built to handle data extraction with basic features for quick on the spot analysis. The choice depends entirely on the system’s current power state and your level of access.

❓️The Masterclass of Digital Triage

Welcome to the Masterclass of Digital Triage. In this series of articles, we tackle the distinct roadblocks investigators face in modern environments, guiding you from initial system access to granular artifact analysis.

More in our new article📎

🆕New Security Features and Low-Level Extraction of iOS 26🆕

We updated iOS Forensic Toolkit, adding low-level extraction support for iOS 26 and 26.0.1 via the extraction agent.

This support is available for most iPhones and iPads compatible with the iOS 26 branch with a notable exception of the iPhone 17 range and M5-based iPads.

❓Why exactly are these devices exempt, and what else did Apple do to make iOS 26 tougher and more resistant? Let’s find out.

❗️Released on September 15, 2025, iOS 26 represents an important shift in mobile security. Apple made an attempt to transition the operating system’s defenses away from reactive software patching, anchoring it instead in hardware-enforced trust based on hardware-level memory safety and post-quantum encryption.

This shift establishes a framework designed to operate in highly sensitive environments. The underlying architecture is robust enough that devices running the iOS 26 branch are formally approved to process and store information classified up to the NATO Restricted level. Germany’s Federal Office for Information Security (BSI) evaluated and confirmed this certification.

And more information at the link📎

#EIFT

🆕Elcomsoft Phone Breaker 11 Restores iCloud Access🆕

Elcomsoft Phone Breaker 11 restores extraction capabilities for most data categories including synchronized data, iCloud Drive, and iCloud backups🏙

Extracting cloud data becomes increasingly valuable – and increasingly complex at the same time. In scenarios where a target device is physically unavailable cloud extraction is often the only real way to access evidence.

This is particularly relevant when devices are secured by an unknown passcode or locked under Apple’s Stolen Device Protection framework without available biometric authentication, rendering traditional extraction techniques ineffective.

Apple’s cloud ecosystem aggregates synchronized data from all devices tied to a specific Apple ID, providing forensic specialists with a comprehensive, cross-device dataset rather than a fragmented, single-device view. Accessing this data, however, requires more and more efforts🗄️

Beginning with the rollout of iOS 18, Apple initiated substantial modifications to its cloud infrastructure and access mechanisms. While backward compatibility with legacy access protocols was temporarily maintained to support devices running older versions of iOS, Apple executed a definitive cut-off in January and February of 2026. During this window, the old protocols were permanently blocked, and cloud authentication procedures were entirely overhauled, rendering prior extraction methods obsolete.

More information at the link📎

#EPB #iCloud

Using the Extraction Agent in 2026: Compatibility, Signing, Firewall, and Extraction Tips🎓

Over the years, we have published several articles about the extraction agent. However, the underlying technology changes quickly, and incremental changes often have significant cumulative effects. As a result, many of our older posts are no longer relevant and can be misleading if followed to the letter today🇷🇺

While last year’s recap, Installing and Troubleshooting the Extraction Agent (2025), remains a solid foundation for general setup, it does not account for the most recent hardware and software developments.

The agent is an in-house app that gets sideloaded directly onto the target device.

This article serves as the definitive point of reference, providing an up-to-date recap of everything you need to know about the extraction agent as of May 2026.

Let's talk about:

💡What is it?
💡Data Scope and Acquisition Benefits
💡May 2026: At a Glance
💡Supported Devices and OS Versions
💡Installation, Signing, and Network Isolation

More in our new article📎

#EIFT

🆕Downloading iPhone and iPad backups from Apple iCloud🆕

Pulling a backup out of iCloud is one of the more technically demanding jobs in cloud forensics.
An iCloud backup is not a single, ready-to-download file: instead, it is assembled from a large number of separate fragments that have to be collected and stitched back together into a coherent backup☁️

Recent changes to Apple’s communication protocols broke things for everyone except Apple themselves, meaning that we had to rework the underlying extraction logic. This is documented in Elcomsoft Phone Breaker 11 Restores iCloud Access.

Recent changes to Apple’s communication protocols and to the format of certain server responses meant that logic had to be substantially reworked. The first pass in version 11.0 had teething issues: backups could stop partway through, often after only the first few gigabytes...

⚡️...Version 11.1 applies the final fixes! Backups that previously stalled now download completely, and the reconstruction step produces a consistent backup you can actually work with – but only if the backup was made by a device running iOS or iPadOS 18 or lower. Cloud backups produced by iOS or iPadOS 26 are not supported just yet. Support for them is coming in a follow-up release😊

More information at the link📎

#EPB #iCloud

A Decade of BitLocker Vulnerabilities: What’s Patched, What’s Not, and What Still Works💬

A few days ago we wrote about YellowKey, the newest entry in what has become a remarkably long list of BitLocker bypasses. That article walked through one specific attack with a practical workflow. This follow-up steps back and surveys the broader landscape: where BitLocker has been broken before, where it is still broken today, and what an investigator should expect to encounter on a seized Windows machine in 2026.

We tried to keep it deliberately high-level. For a much deeper rabbit hole, the single best starting point is Rairii’s curated catalogue at github.com/Wack0/bitlocker-attacks, which tracks the boot-manager bug pipeline more thoroughly than any vendor write-up.

The newest entry in this catalogue, and the reason we are writing the overview, is YellowKey. It belongs in the software and boot-chain family alongside bitpixie and BitUnlocker: pure software, no special hardware, and TPM-agnostic – the bug sits inside the Windows Recovery Environment rather than in the boot manager or the TPM stack, so dTPM, fTPM, and Pluton platforms are equally exposed because none of them are in the loop🔥

The operational bar is unusually low even by the standards of that family. In our view that makes YellowKey the most accessible currently-active BitLocker bypass on the public record. The structural mitigation, Microsoft’s Trusted WIM Boot – which hashes WinRE.wim against a known-trusted value and refuses to auto-unlock the OS volume on mismatch – is enforced on some recent OEM images but is not the default across most of the fielded install base, which is why YellowKey fails on a some laptops and works on the others. Notably, as the attack lives inside WinRE rather than requiring a downgrade to an older signed bootloader, the eventual PCA 2011 DBX enforcement we discuss below will not retire YellowKey – only broader Trusted WIM Boot rollout will.

More in our new article📎

Forensic Implications of Apple Stolen Device Protection🧐

If you extract data from iPhones for a living, Stolen Device Protection is the change you can no longer afford to ignore. It does something deceptively simple: it puts Face ID or Touch ID in front of the “Trust This Computer” prompt.

The practical result is that an examiner who knows the device passcode still cannot pair an unfamiliar iPhone to a forensic workstation. That is the most disruptive change Apple has made to iPhone pairing behavior in roughly a decade, and as of spring 2026 it is switched on out of the box.

This article walks through what the feature is, how it has changed over time, what it is designed to stop, and – the part that matters most for a lab – exactly which steps of a data extraction it gets in the way of.

💡We are also in the process of finalizing our own solution for circumventing Stolen Device Protection that will allow sideloading and using the extraction agent with protection still engaged.

More in our new article📎

🆕Downloading iOS 26 iCloud Backups🆕

Elcomsoft Phone Breaker 11.2 adds the ability to download iCloud backups created on devices running iOS and iPadOS 26 and, by extension, iOS/iPadOS 27 beta.

⚡️With this release, Elcomsoft Phone Breaker becomes the first and only third-party tool capable of pulling these backups from Apple’s cloud. That might read like a routine compatibility update. It isn’t. In iOS 26, Apple reworked its iCloud backup mechanism from the ground up, breaking every third-party tool that relied on the previous scheme. Restoring access meant rebuilding a large part of our cloud extraction pipeline. Below is what changed, what we did about it, and where the current build still has rough edges.

Roughly the only thing left untouched is the authentication protocol – every other layer between an authenticated session and a reconstructed backup was redesigned. For example, the chunks that make up a single backup may be spread across multiple back-end servers, with different hosts holding different parts of the same copy.

Taken together, these changes made every existing third-party forensic tool incompatible with iOS 26 backups. Adding support wasn’t a matter of patching a parser; it required reworking the entire engine.

Let's talk about what we fixed❤️

More information at the link📎

#EPB #iCloud

“Get Verification Code” Is Missing in iOS 18 and iOS 26; Here’s Where It Went🤔

If you have an Apple device running iOS 18 or iOS 26 and gone looking for the old Get Verification Code option under:

Settings → [user name] → Sign-In & Security

..you’ve probably noticed it’s no longer there. A quick search turns up forum threads, support comments, and even GitHub issues all reaching the same conclusion: Apple removed it.
Some posts go further and call it “deprecated” or “Apple’s middle finger to users of older devices.” 

😊That conclusion is wrong. The option still exists in iOS 26. It just doesn’t show up the way it used to.

We tell you how to actually get an offline code in iOS 26 and iOS 18 and why this matters.

More information at the link📎

#Tips

🆕Bypassing Stolen Device Protection: Alternative Ways of Installing the Extraction Agent🆕

Stated plainly: iOS Forensic Toolkit can now get past Stolen Device Protection.

There is a catch, and it belongs up front: this is not a magic unlock, and anyone selling it as one is selling something.

🔥What we have built is a way to install the extraction agent without ever pairing the iPhone to the workstation over a USB port.
Because the most disruptive thing SDP does to a forensic workflow is place Face ID or Touch ID in front of that pairing step, bypassing the pairing step bypasses the gate.
You still need:
🟢the device passcode;
🟢a paid Apple Developer account;
🟢a device you are authorized to examine.

With those in hand, SDP is no longer the wall it was a month ago.

This is the solution promised in Forensic Implications of Apple Stolen Device Protection. The how – every command, in order – will appear in a separate technical write-up.

This piece covers what the method does, when you would reach for it, and whether it should concern anyone who is not an examiner.

More information at the link📎

#EIFT

Sideloading the extraction agent: a Stolen Device Protection workaround👤

A new update to iOS Forensic Toolkit is out.
The headline feature is an alternative installation method for the extraction agent – that is, deploying it onto an iPhone while bypassing the mandatory pairing requirement.
The agent can now be delivered across the network, which removes a number of limitations that came with the usual cable-based installation. One requirement up front: the device must already be unlocked – in other words, the passcode must be known. This method does not work with a fully locked iPhone.

☺️Why a new installation method was needed?

The reason is a feature called Stolen Device Protection (SDP), which we discussed in the previous article. It is designed for the situation where a phone ends up in someone else’s hands and that person also knows the passcode.
In this mode, certain actions require biometric authentication – the owner’s Face ID or Touch ID — with no option to confirm the operation by entering the passcode. The checks tighten when the device is away from familiar locations such as home or work, and in settings they can be enforced at all times, regardless of location.

❗️Previously this protection could only be enabled optionally, and it was rarely encountered. Starting with iOS 26.4, that has changed: Apple turns Stolen Device Protection on automatically. As a result, examiners increasingly run into devices that simply will not allow a USB connection to a new computer.

😊The alternative agent delivery methods solve this.

More information at the link📎

#EIFT #Tips

🆕Two-Factor Authentication and iCloud: A Short History, and What We Fixed in Phone Breaker 11.03🆕

Two-factor authentication is the least glamorous security feature, and probably the most important one.

A password is “something you know”, which really means “something that can be phished, reused, leaked, or guessed”.

The second factor is “something you have”, and, while it can still be phished, it makes stolen passwords much less of a catastrophe they used to be. Everything else in account security is built on top of that. If the second factor is not there, or if it does not cover the data that actually matters, the rest is decoration.

Apple gets this right today. They did not always. The story of how they got here is worth telling, because it explains a lot about how iCloud acquisition works in 2026, and it leads directly to the two 2FA-related fixes in Elcomsoft Phone Breaker 11.03.

More information at the link📎

#EPB

The Long, Strange History of PDF (In)Security – And the Arrest That Made It Personal👁‍🗨

PDF has a reputation as the boring, dependable file format – the one you reach for when you need a document to look exactly the same on every computer, forever. What gets forgotten is that PDF’s security model has been shaky since version 1.0, and its history includes an FBI arrest, a federal jury trial that helped define how the DMCA actually works, and – twenty years later – a fake GIF that hid a tiny working computer inside an image compression stream.

This is that story, roughly in order, including the part where we were personally on the receiving end of it.

❓Where it all started: Adobe’s eBook experiment

Back in 1999–2001, Adobe was chasing the “eBook” market with the Acrobat eBook Reader (originally the GlassBook Reader) and a back-end called the Adobe Content Server. Publishers could lock a book down with any of several plug-in “security handlers” – Adobe’s own PDF Merchant and EBX, plus third-party schemes like FileOpen and SoftLock – restricting printing, copying, lending, or text-to-speech.

All of them shared the same underlying weakness, and it wasn’t really about key length…

More information at the link📎

Cracking Legacy ZIP Encryption: The Known-Plaintext Attack and Why It Still Sometimes Works 🔒

When someone hands you a password-protected ZIP archive, one’s immediate thought is:

“I need to break the password”.

For most modern archives, that is exactly the case, and the password is the whole game. But there is a family of ZIP archives where the password does not matter at all. It can be four characters or forty, random or memorable, if the archive uses the legacy ZIP encryption, the whole thing can be unlocked in minutes without ever guessing the password.

This is one of the oldest tricks in our line of work, and it is worth telling the story properly, because it is equal parts computer history and practical forensics 🔑

A word of caution before we start. The attack we are about to describe applies to the classic ZIP 2.0 encryption, the scheme Phil Katz built into PKZIP in the late eighties. Almost nobody should be creating archives with it today. Modern archivers default to AES, which is a completely different situation.

So treat most of this article as a fascinating piece of history, with a long and narrow tail of cases where it still bites in real life.

More information at the link📎

Digital Triage and the Rules of Evidence: What Holds Up, and Where👆

The scene is familiar. A couple of desktops, a laptop, two or three phones, maybe a NAS or a bunch of external drives, and a limited amount of time before you decide what you do on the spot and what can wait till the lab.

You cannot image everything on the spot, and even if you could, the lab queue would swallow it for weeks. So you triage: you look at what is in front of you and decide what matters, what is urgent, and what can wait.

The catch is that the decisions made in that first hour cast a long shadow. They determine not only what you find, but whether what you find can be used later, in a courtroom.

❤️This article is about that connection. How triage actually works, what principles govern the handling of digital evidence everywhere – not just the US, and why the very same misstep can be fatal in one country and a minor footnote in another.

Reminder: this is exactly what Elcomsoft Quick Triage is built to do on Windows systems. It captures the volatile side of a live session fast, memory, browser and account credentials, communications and user activity, along with the system artifacts that reconstruct who did what and when, and it stores everything in a single open container that keeps each artifact tied to its source.

More information at the link📎

#EQT

An AI agent broke into Hugging Face. Five days later, OpenAI said it was theirs 👩‍💻

On 16 July 2026, Hugging Face disclosed that an autonomous AI agent had been inside part of its production infrastructure.

The company was clear about what it did not know: which model was driving the agent, or who was operating it.

Five days later, OpenAI answered both questions. The agent was its own, running an internal benchmark with its cyber safety refusals deliberately switched off, and it had gone looking for the answers to a test.

This is a good story on its own. It becomes a better one when you line it up against what people were saying about model governance in the same week.

More information at the link📎

Why Digital Forensic Reports Don’t Survive Cross-Examination❓

A forensic report is not a summary of finished work. It’s a claim that has to survive someone trying to take it apart, and most reports aren’t built for that.

A lot of what gets filed today is automated tool output with a cover letter attached: the examiner runs a parser, exports a spreadsheet, writes three sentences of narrative, and calls it analysis. That holds up fine until an opposing expert asks how the software actually reached its conclusion.

🔉Three real cases show what happens when nobody asks that question early enough.

More information at the link📎

How to recover deleted data from your iPhone 👤

You accidentally deleted an important file from your iPhone, panicked, and hit the web looking for a way to get it back...

Instantly, you’re hit with a barrage of search results pushing “iPhone data recovery” software. If you look closely, you’ll notice almost all of these apps are low-quality rebrands or slightly tweaked forks of just a handful of identical tools.

❓Before you pull out your credit card, you need to understand what can actually be recovered from an iPhone, and what is gone for good.

More information at the link📎

When the iCloud Backup Is the Only Copy Left ☁️

An iCloud backup is often the only surviving copy of data no longer on the device. Two ordinary situations show why, and neither involves anything clever on the suspect’s part.

What could possibly go wrong, and how can you access the data?

⏺Case one: the update that went wrong

Updates fail, usually for a boring reason: not enough free space. iOS downloads the update, starts installing, runs out of room, and the phone reboots into Recovery mode – the cable-and-computer screen, nothing else. Connect it to a Mac or PC and you get two options: Update, which reinstalls the system and keeps data, or Restore, which wipes it.
Major version jumps fail worse. We’ve seen updates leave a device unable to boot at all, with reports of the passcode being rejected afterward, which points at Secure Enclave state rather than the file system.
Either way, the outcome for an examiner is the same. A phone stuck in Recovery mode won’t yield a file system image.

⏺Case two: the data that was deleted

Deleting something on an iPhone takes two taps, and the safety net is thin. Photos, Notes, Voice Memos and iCloud Drive files go to Recently Deleted and stay about 30 days.
This is where synced data and backups diverge. Synced categories propagate a deletion within seconds of the device going online, so the cloud copy usually mirrors the device by the time anyone checks. Back up overnight, delete the file the next morning, and the file is still in last night’s backup. The older of the two stored backups can predate the deletion by weeks.

😀We covered the user-facing side of this recently: How to recover deleted data from your iPhone.

More information at the link📎

🆕Special macOS Firewall: Safe Sideloading of the EIFT Extraction Agent🆕

Elcomsoft iOS Forensic Toolkit begins low-level extraction by sideloading the extraction agent, and the agent will not run until the phone has completed one or two checks against Apple’s servers.

Network requests, on a phone that is evidence. That single requirement is why we have shipped three different firewalls over the past three years.
💡The newest one, EIFT Firewall, is a free macOS application and a direct replacement for the 2023 script!

Why the phone needs the internet at all?

The phone has to reach a small number of Apple hosts, one of which has a name that resolves to a different address every few minutes, and nothing else. Arranging exactly that is harder than it sounds.

More information at the link📎

#EIFT

The iOS 27 Recovery Menu: What It Means for Forensics 👆

iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad.

Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone 📱

The feature is aimed at owners whose device hangs at the Apple logo or loops after a failed update.

Our interest is different: this is new code that runs on a locked device before the data volume is unlocked, it talks to the network, and it can erase the device. All three matter to us.

More information at the link📎