Archive for the ‘Software’ Category

Video Tutorial on Decryption of Windows EFS-encrypted Data

Monday, July 6th, 2015

Although we’ve already embraced the EFS-encryption/decryption in some of our white papers and case studies, now we’d like to share a video tutorial because seeing once is better than hearing reading twice. So, in this video you will see how to decrypt EFS-encrypted data with help of Advanced EFS Data Recovery and how to recover Windows user account password with Proactive System Password Recovery (because it’s still obligatory for this type of encryption).

Advanced EFS Data Recovery (AEFSDR) is wholly dedicated to decryption of Windows EFS-encrypted files, however in order to decrypt the data the program still requires the user account password. Yeah, you might think at first that anyone can decrypt the data having user account password at hand, but no. You can’t. EFS encryption uses more than just logon password, nonetheless it’s the core ingredient in data decryption and so it must be provided.

If you forgot the logon password or didn’t know it at all Proactive System Password Recovery (PSPR) in its turn can help you acquire all system passwords once you can log into the system with administrator privileges. Exactly this example has been illustrated in our video (provide by Sethioz), here it is:

Another situation (not captured in this video) is when you are researching an offline system, for instance a drive attached to your main computer. In this case, you should, first, obtain password hash(es) using “Manual decryption” option  (check “Manual decryption” box in “Recovered hashes” tab) and then try to recover the logon password using brute-force or dictionary attacks.

20150624-ivxs-43kb

And if you are fortunate to own more than one computer (or a whole network) of course you will want to crack the password hash quicker using all these recourses, which is also possible with Elcomsoft Distributed Password Recovery (EDPR) allowing you to benefit from consolidating the power of all computers in network and do the job much faster. You just need to export the hashes found by PSPR and feed them to EDPR, the tool will do its job then.

The choice is yours what to use, but of course it depends on a particular situation. Your questions and concerns are always appreciated, just add them in comments below and we’ll get back to you with answers and perhaps more helpful videos. :)

Why Do We Need Physical Acquisition?

Thursday, June 25th, 2015

With all the trouble of jailbreaking iOS 8 devices and the lack of support for 64-bit hardware, does iOS physical acquisition still present meaningful benefits to the investigator? Is it still worth your time and effort attempting to acquire that iPhone via a Lightning cord?

Granted, jailbroken iOS devices are rare as hen’s teeth. You are very unlikely to see one in the wild. However, we strongly believe that physical acquisition still plays an important role in the lab, and here are the reasons why.

  1. Apple’s current privacy policy explicitly denies government information requests if the device in question is running iOS 8. This means that handing over the device to Apple will no longer result in receiving its full image if the device is running iOS 8.x (source: https://www.apple.com/privacy/government-information-requests/)
  2. In many countries (Mexico, Brazil, Russia, East Europe etc.) Apple sells more 32-bit phones than 64-bit ones. Old iPhones traded in the US are refurbished and sold to consumers in other countries (BrightStar coordinates these operations for Apple in the US). As an example, new and refurbished iPhone 4S and 5 units accounted for some 46% of all iPhones sold through retail channels in Russia in Q1 2015.
  3. Physical extraction returns significantly more information compared to any other acquisition method including logical or over-the-air acquisition. In particular, we’re talking about downloaded mail and full application data including logs and cache files (especially those related to Internet activities). A lot of this information never makes it into backups.
  4. Full keychain extraction is only available with physical acquisition. Physical is the only way to fully decrypting the keychain including those records encrypted with device-specific keys. Those keychain items can be extracted from a backup file, but cannot be decrypted without a device-specific key. In addition, the keychain often contains the user’s Apple ID password.
  5. With physical acquisition, you can extract the ‘securityd’ (0x835) from the device. This key can be used to completely decrypt all keychain items from iCloud backups.
  6. Physical acquisition produces a standard DMG disk image with HFS+ file system. You can mount the image into the system and use a wider range of mobile forensic tools to analyze compared to iTunes or iCloud backup files.

At this time, Elcomsoft iOS Forensic Toolkit remains the only third-party forensic tool to perform physical acquisition of iPhone 4S, 5 and 5C.

Limitations of Physical Acquisition

Apple makes their platform increasingly secure with each generation of hardware and every version of iOS. Apple devices equipped with 64-bit hardware are not susceptible to physical acquisition. Since the overwhelming majority of iOS devices sold in the US through retail channels are already equipped with 64-bit hardware, the number of handsets equipped with 32-bit chips is rapidly declining. The opposite is true for many developing markets where old-generation devices oversell latest hardware.

When it comes to iOS 8, physical acquisition is only available to jailbroken devices. At this time, jailbreak is available for all current versions of iOS 8 up to and including iOS 8.3.

eift128_ios83

As a result, physical acquisition has the following limitations:

  1. Only 32-bit hardware is supported *
  2. iOS 8 devices must be jailbroken in order to perform physical acquisition.
  3. Jailbreaking is not as reliable and straightforward as we’d like it to be.
  4. You can’t jailbreak a locked device if you don’t know the passcode.
  5. Find My Phone must be disabled before installing jailbreak. If Find My Phone is on, you must enter the user’s Apple ID password to turn it off.
  6. In order to perform physical acquisition of a jailbroken device, you’ll need to manually install OpenSSH from Cydia.
  7. At this time, only TaiG jailbreak is supported for the purpose of physical acquisition (http://www.taig.com/en/)

* 64-bit devices are still not supported regardless of iOS version or jailbreak status. For the purpose of physical acquisition, the following compatibility matrix applies.

Supported:

  • iPhone 4S, 5, 5C
  • iPod Touch (5th gen)
  • iPad 2 through 4
  • iPad mini (original)

NOT supported:

  • iPhone 5S, 6, 6 Plus
  • iPad Air
  • iPad mini Retina, iPad mini 3

Conclusion

Even with all limitations of physical acquisition, the method still remains viable in many situations. Some countries still see more 32-bit Apple devices than 64-bit ones, with Apple refurbished devices (trade-ins from the US) pushed by the company as a cheap entry into the ecosystem. Since Apple no longer serves government information requests for devices running iOS 8, physical acquisition remains the only method to extract the full file system from the device, returning more information than any other acquisition method.

Elcomsoft Forensic Disk Decryptor Video Tutorial

Monday, June 8th, 2015

Quite often our new customers ask us for advice about what they should start with in order to use the program effectively. In fact, there are various situations when the tool can come in handy by decrypting data securely protected with TrueCrypt, BitLocker (To-Go), or PGP and we’d need a super long video to describe all the cases. But we’d love to demonstrate one typical situation when disk is protected with TrueCrypt when entire system drive encryption option is on.

In this video, kindly provided by Sethioz, we suggest you to decrypt TrueCrypt whole system drive encryption using our Elcomsoft Forensic Disk Decryptor thoroughly going through all the stages starting from the very first one when you just got the encrypted hard drive on hands.

With encrypted hard drive in one hand and its memory dump in the other one (taken when encrypted disk was still mounted) we plug HDD into our “invesgitator’s” computer, start Elcomsoft Forensic Disk Decryptor and easily, in one slow motion, extract the encryption keys from the memory dump file and decrypt the protected HDD, either by mounting it into the “investigator’s” system (to be able to work with it on-the-fly) or by decoding the contents into a specified folder.

We hope you’ll enjoy this video and next time you have the necessity to decrypt something encrypted you’ll feel more confident about it. We also invite you to take a moment and share your experience here in comments or leave your question if you still have any after this pretty detailed video. :)

Elcomsoft Phone Viewer: Faster and Easier

Tuesday, May 19th, 2015

ElcomsoftPhoneViewer_SnapshotAs you may already know, we have just updated our recently released forensic tool, Elcomsoft Phone Viewer. The update received a major performance boost and numerous usability enhancements.

So what’s the point of having a “yet another” mobile forensic tool? Aren’t there enough already? In fact, we considered making this tool for a long time, and were hesitant to make the move exactly because there are so many great forensic packages already. However, our customers kept asking for a lighter, smaller, faster and easier alternative to complement our existing tools. They cited how bulky those all-in-one forensic packages were, and mentioned training courses they had to take just to begin using those tools. Call it minimalism, but we made a tool that doesn’t require training sessions to use, and employs the same familiar user interface as other ElcomSoft tools. (more…)

Elcomsoft Wireless Security Auditor Video Tutorial

Thursday, April 30th, 2015

I know most computer gurus and pros never read through program manuals or help files and prefer to learn everything using proverbial method of trial and error. Does this sound like you? Of course. Exceptions are very seldom. So, here’s something nice that will save your time and help your experience with Elcomsoft Wireless Security Auditor (EWSA).

In order to provide a quick but sufficient understanding how to effectively work with EWSA, our friend Sethios has prepared a nice 20-minute video tutorial that includes all steps of work with the program starting with acquiring handshakes and moving on through all following steps.

This video is packed with useful information, so go ahead and watch it now:

Was it helpful for your work? You are the judge. But we are always happy to hear from you. Your feedback is the reason we work harder on our software!

Supporting Apple iCloud Drive and Decrypting Keychains from iCloud

Thursday, March 12th, 2015

As you may already know from our official announcement, we’ve recently updated Elcomsoft Phone Breaker to support Apple accounts upgraded to iCloud Drive and decrypting keychains from iCloud. Considering that one can access files stored in iCloud Drive without any third-party tools, is the update really worth the buzz? Read along to find out!

Before getting to the updated technology, let’s have a look at what Apple iCloud Drive is, and how it’s different from “classic” iCloud. (more…)

Elcomsoft Distributed Password Recovery Video Tutorial

Thursday, February 26th, 2015

Anyone considering the possibility to purchase Elcomsoft Distributed Password Recovery has a wonderful opportunity to explore the program together with Sethioz and get a clearer understanding of how the program works and what requires your special attention when you are using EDPR. This video assumes you are already familiar with basics of password cracking and suggests more information for your convenient work with the tool.

This is a very detailed tutorial showing how to prepare EDPR for work, which includes setting up connection between server and agents via local host or Internet, selecting the right IP address, paying attention to the fact that server’s and agent’s versions should be the same (users often neglect this fact), choosing a task, choosing the right attack options (they are all sufficiently explained), using side monitoring tools, checking your GPU temperature and utilization percentage on all connected computers and so on. So, let’s watch it now.

If you had any questions watching this video or would like to share your own experience using EDPR you are welcome to continue the topic here in comments.

Distributed Password Recovery: Faster, Smarter and Cost-Effective

Tuesday, February 3rd, 2015

We have just released a long-awaited update to one of our flagship products, Elcomsoft Distributed Password Recovery. While you can learn more about what’s been added and changed from our official announcement, in this post we’d like to share some insight about the path we took to design this update. (more…)

Elcomsoft Phone Breaker Update: Improved iCloud Acquisition, Two-Factor Authentication and Stronger Brute Force

Wednesday, December 17th, 2014

We are excited to announce an update to one of our oldest mobile forensic tools, Elcomsoft Phone Breaker. In this release we mostly targeted iCloud acquisition, although we’ve made some changes to the password recovery algorithm targeting iOS offline backups. All in all, the new tool can be used under a wider range of circumstances, squeezes more juice of your existing acceleration hardware and adds support for newest and greatest AMD and NVIDIA boards.

(more…)

ElcomSoft Open Letter on Latest Developments in iCloud Security

Wednesday, December 17th, 2014

In light of recent security outbreaks, Apple introduced a number of changes to its security policies. As one of the leading security companies and a major supplier of forensic software for iOS devices, ElcomSoft is being constantly approached by IT security specialists, journalists and forensic experts. The most common question is: how will the new security measures affect iOS forensics? (more…)