iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad. Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone.

Elcomsoft iOS Forensic Toolkit begins low-level extraction by sideloading the extraction agent, and the agent will not run until the phone has completed one or two checks against Apple’s servers. Network requests, on a phone that is evidence. That single requirement is why we have shipped three different firewalls over the past three years. The newest one, EIFT Firewall, is a free macOS application and a direct replacement for the 2023 script.

An iCloud backup is often the only surviving copy of data no longer on the device. Two ordinary situations show why, and neither involves anything clever on the suspect’s part. What could possibly go wrong, and how can you access the data?

There is a whole industry selling software to protect data: full-disk encryption, rights management, key servers, the works. Almost none of it lives in an ordinary home or a two-person office. At home people protect a file the way the application in front of them allows. They type a password into WinRAR, or into Word, or into a PDF, and move on with the day. Here is the thing: none of those applications is a security product. WinRAR is a compression tool, Word is a word processor, Acrobat is a document viewer. They just happen to carry enough encryption to be used as a lock, and that is exactly why people use them. It is right there, it is free, and it needs no IT department.

You accidentally deleted an important file from your iPhone, panicked, and hit the web looking for a way to get it back. Instantly, you’re hit with a barrage of search results pushing “iPhone data recovery” software. If you look closely, you’ll notice almost all of these apps are low-quality rebrands or slightly tweaked forks of just a handful of identical tools.

Microsoft Office has protected documents with passwords since Word 2.0 in 1991, and for most of that history the protection was weaker than stated. The word “password” in Office covers two completely different things. One is encryption, and it can be strong. The other is a flag that tells the application to refuse an edit, and it has never been strong, because it cannot be. Confusing the two is the most common mistake we see, and it is the reason a document someone was sure they had locked often opens in seconds.

A forensic report is not a summary of finished work. It’s a claim that has to survive someone trying to take it apart, and most reports aren’t built for that. A lot of what gets filed today is automated tool output with a cover letter attached: the examiner runs a parser, exports a spreadsheet, writes three sentences of narrative, and calls it analysis. That holds up fine until an opposing expert asks how the software actually reached its conclusion.

RAR encryption has an unusual reputation: in more than twenty years there has been no practical attack against the cipher, no implementation flaw worth the name, and none of the shortcuts that collapsed certain other archive formats in minutes. Yet until recently, nobody could say how fast a RAR password could actually be attacked. The answer was always “it depends”, technically true but not something one could put in front of a client or plan a recovery job around.

On 16 July 2026, Hugging Face disclosed that an autonomous AI agent had been inside part of its production infrastructure. The company was clear about what it did not know: which model was driving the agent, or who was operating it. Five days later, OpenAI answered both questions. The agent was its own, running an internal benchmark with its cyber safety refusals deliberately switched off, and it had gone looking for the answers to a test.

The scene is familiar. A couple of desktops, a laptop, two or three phones, maybe a NAS or a bunch of external drives, and a limited amount of time before you decide what you do on the spot and what can wait till the lab. You cannot image everything on the spot, and even if you could, the lab queue would swallow it for weeks. So you triage: you look at what is in front of you and decide what matters, what is urgent, and what can wait.