When the iCloud Backup Is the Only Copy Left
July 31st, 2026 by Oleg Afonin
An iCloud backup is often the only surviving copy of data no longer on the device. Two ordinary situations show why, and neither involves anything clever on the suspect’s part. What could possibly go wrong, and how can you access the data?
Locked In or Locked Out? Unlocking ZIP, RAR, PDF, and Microsoft Office Passwords
July 29th, 2026 by Oleg Afonin
There is a whole industry selling software to protect data: full-disk encryption, rights management, key servers, the works. Almost none of it lives in an ordinary home or a two-person office. At home people protect a file the way the application in front of them allows. They type a password into WinRAR, or into Word, or into a PDF, and move on with the day. Here is the thing: none of those applications is a security product. WinRAR is a compression tool, Word is a word processor, Acrobat is a document viewer. They just happen to carry enough encryption to be used as a lock, and that is exactly why people use them. It is right there, it is free, and it needs no IT department.
How to recover deleted data from your iPhone
July 28th, 2026 by Oleg Afonin
You accidentally deleted an important file from your iPhone, panicked, and hit the web looking for a way to get it back. Instantly, you’re hit with a barrage of search results pushing “iPhone data recovery” software. If you look closely, you’ll notice almost all of these apps are low-quality rebrands or slightly tweaked forks of just a handful of identical tools.
Microsoft Office Passwords: What Comes Off in Seconds, What Takes Longer, and Why
July 27th, 2026 by Oleg Afonin
Microsoft Office has protected documents with passwords since Word 2.0 in 1991, and for most of that history the protection was weaker than stated. The word “password” in Office covers two completely different things. One is encryption, and it can be strong. The other is a flag that tells the application to refuse an edit, and it has never been strong, because it cannot be. Confusing the two is the most common mistake we see, and it is the reason a document someone was sure they had locked often opens in seconds.
Why Digital Forensic Reports Don’t Survive Cross-Examination
July 24th, 2026 by Oleg Afonin
A forensic report is not a summary of finished work. It’s a claim that has to survive someone trying to take it apart, and most reports aren’t built for that. A lot of what gets filed today is automated tool output with a cover letter attached: the examiner runs a parser, exports a spreadsheet, writes three sentences of narrative, and calls it analysis. That holds up fine until an opposing expert asks how the software actually reached its conclusion.
The RAR Mystery: Breaking RAR4 and RAR5 Encryption
July 23rd, 2026 by Oleg Afonin
RAR encryption has an unusual reputation: in more than twenty years there has been no practical attack against the cipher, no implementation flaw worth the name, and none of the shortcuts that collapsed certain other archive formats in minutes. Yet until recently, nobody could say how fast a RAR password could actually be attacked. The answer was always “it depends”, technically true but not something one could put in front of a client or plan a recovery job around.
An AI agent broke into Hugging Face. Five days later, OpenAI said it was theirs
July 22nd, 2026 by Oleg Afonin
On 16 July 2026, Hugging Face disclosed that an autonomous AI agent had been inside part of its production infrastructure. The company was clear about what it did not know: which model was driving the agent, or who was operating it. Five days later, OpenAI answered both questions. The agent was its own, running an internal benchmark with its cyber safety refusals deliberately switched off, and it had gone looking for the answers to a test.
Digital Triage and the Rules of Evidence: What Holds Up, and Where
July 21st, 2026 by Oleg Afonin
The scene is familiar. A couple of desktops, a laptop, two or three phones, maybe a NAS or a bunch of external drives, and a limited amount of time before you decide what you do on the spot and what can wait till the lab. You cannot image everything on the spot, and even if you could, the lab queue would swallow it for weeks. So you triage: you look at what is in front of you and decide what matters, what is urgent, and what can wait.
Cracking Legacy ZIP Encryption: The Known-Plaintext Attack and Why It Still Sometimes Works
July 20th, 2026 by Oleg Afonin
When someone hands you a password-protected ZIP archive, one’s immediate thought is “I need to break the password”. For most modern archives, that is exactly the case, and the password is the whole game. But there is a family of ZIP archives where the password does not matter at all. It can be four characters or forty, random or memorable; if the archive uses the legacy ZIP encryption, the whole thing can be unlocked in minutes without ever guessing the password. This is one of the oldest tricks in our line of work, and it is worth telling the story properly, because it is equal parts computer history and practical forensics.
The Long, Strange History of PDF (In)Security – And the Arrest That Made It Personal
July 17th, 2026 by Oleg Afonin
PDF has a reputation as the boring, dependable file format – the one you reach for when you need a document to look exactly the same on every computer, forever. What gets forgotten is that PDF’s security model has been shaky since version 1.0, and its history includes an FBI arrest, a federal jury trial that helped define how the DMCA actually works, and – twenty years later – a fake GIF that hid a tiny working computer inside an image compression stream. This is that story, roughly in order, including the part where we were personally on the receiving end of it.
