The True Meaning of Consent in ‘Consent Extractions’
August 24th, 2026 by Oleg Afonin
In law enforcement use a “consent extraction” means the examiner knows the passcode. It rarely signals owner agreement. That would be a vocabulary issue if the passcode remained the whole key. Since iOS 26.4 it does not. Stolen Device Protection is on by default, and away from familiar locations it requires Face ID or Touch ID before the “Trust This Computer” prompt. The passcode still unlocks the device and confirms Trust. SDP adds a second requirement on top. An extraction that once needed one credential now needs two, and legal systems treat the two credentials as different kinds of thing.
Write Blockers in Forensics: What Controls How You Use Them?
August 19th, 2026 by Oleg Afonin
In simple terms a write blocker sits between the original drive or device and your forensic workstation and stops any write commands from getting through, while letting you read every bit. Along with checksums, write blockers help maintaining chain of custody, ensuring that the imaging step is repeatable and verifiable. Hardware write blockers are physical devices you plug the source media into, software write blockers are installed on the acquisition system, and the former type is more robust than the latter. The point, however, is not speed or convenience, it is to make a forensic copy without changing the original, so the evidence you work from is the same as the evidence you seized. And here comes the question: which laws or standards mandate using a write blocker?
The iOS 27 Recovery Menu: What It Means for Forensics
August 5th, 2026 by Oleg Afonin
iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad. Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone.
Special macOS Firewall: Safe Sideloading of the EIFT Extraction Agent
August 3rd, 2026 by Oleg Afonin
Elcomsoft iOS Forensic Toolkit begins low-level extraction by sideloading the extraction agent, and the agent will not run until the phone has completed one or two checks against Apple’s servers. Network requests, on a phone that is evidence. That single requirement is why we have shipped three different firewalls over the past three years. The newest one, EIFT Firewall, is a free macOS application and a direct replacement for the 2023 script.
When the iCloud Backup Is the Only Copy Left
July 31st, 2026 by Oleg Afonin
An iCloud backup is often the only surviving copy of data no longer on the device. Two ordinary situations show why, and neither involves anything clever on the suspect’s part. What could possibly go wrong, and how can you access the data?
Locked In or Locked Out? Unlocking ZIP, RAR, PDF, and Microsoft Office Passwords
July 29th, 2026 by Oleg Afonin
There is a whole industry selling software to protect data: full-disk encryption, rights management, key servers, the works. Almost none of it lives in an ordinary home or a two-person office. At home people protect a file the way the application in front of them allows. They type a password into WinRAR, or into Word, or into a PDF, and move on with the day. Here is the thing: none of those applications is a security product. WinRAR is a compression tool, Word is a word processor, Acrobat is a document viewer. They just happen to carry enough encryption to be used as a lock, and that is exactly why people use them. It is right there, it is free, and it needs no IT department.
How to recover deleted data from your iPhone
July 28th, 2026 by Oleg Afonin
You accidentally deleted an important file from your iPhone, panicked, and hit the web looking for a way to get it back. Instantly, you’re hit with a barrage of search results pushing “iPhone data recovery” software. If you look closely, you’ll notice almost all of these apps are low-quality rebrands or slightly tweaked forks of just a handful of identical tools.
Microsoft Office Passwords: What Comes Off in Seconds, What Takes Longer, and Why
July 27th, 2026 by Oleg Afonin
Microsoft Office has protected documents with passwords since Word 2.0 in 1991, and for most of that history the protection was weaker than stated. The word “password” in Office covers two completely different things. One is encryption, and it can be strong. The other is a flag that tells the application to refuse an edit, and it has never been strong, because it cannot be. Confusing the two is the most common mistake we see, and it is the reason a document someone was sure they had locked often opens in seconds.
Why Digital Forensic Reports Don’t Survive Cross-Examination
July 24th, 2026 by Oleg Afonin
A forensic report is not a summary of finished work. It’s a claim that has to survive someone trying to take it apart, and most reports aren’t built for that. A lot of what gets filed today is automated tool output with a cover letter attached: the examiner runs a parser, exports a spreadsheet, writes three sentences of narrative, and calls it analysis. That holds up fine until an opposing expert asks how the software actually reached its conclusion.
The RAR Mystery: Breaking RAR4 and RAR5 Encryption
July 23rd, 2026 by Oleg Afonin
RAR encryption has an unusual reputation: in more than twenty years there has been no practical attack against the cipher, no implementation flaw worth the name, and none of the shortcuts that collapsed certain other archive formats in minutes. Yet until recently, nobody could say how fast a RAR password could actually be attacked. The answer was always “it depends”, technically true but not something one could put in front of a client or plan a recovery job around.
