Apple Ecosystem: Overlooked Devices

June 18th, 2025 by Oleg Afonin

When it comes to digital evidence, most investigators naturally focus on smartphones – and occasionally tablets. But the rest of the Apple ecosystem often goes unnoticed: Apple Watch, Apple TV, HomePod, even older iPod Touch models. These supplementary devices might seem irrelevant, but they can contain valuable digital artifacts: activity logs, Wi‑Fi credentials, leftover bits and pieces of information, system logs, and even synced photos.

Read the rest of this entry »

Sanderson SQLite Forensic Toolkit on a Mac OS X using CrossOver

March 5th, 2015 by Shafik Punja

 

  • Now that you have at least one application installed within a bottle you can install the other Sanderson tools you have into the same Sanderson SQL Tools bottle by selecting the bottle you are going to add another application to in the CO interface and right clicking and choosing ‘Install Software into “…..”. This will install another application within the same bottle. I decided to use a bottle for the Sanderson SQL Tools so that all three Sanderson SQLite Forensic Tools are contained with the same bottle. When an update is released to any of these applications I will use the ‘Install Software into’ option to update the software.

    a. But if you are going to install more than application into the same bottle, be mindful of the recommendation by CO, that it is recommended that each application be in its own bottle in order to avoid any conflict between programs.   Please be aware that there is more than one method by which to install applications. Essentially you can have each in its own bottle or group them into bottles of a common theme (being aware of the recommendation not to do this).
  • Uninstalling/Deleting an application: Select the bottle you are going to remove by right clicking in the CO interface and chose ‘Delete “name of bottle”.
  • You can also choose to uninstall an application but keep the bottle by using the Uninstaller for that application if one is present, although, based on my testing this may leave behind trace folders and files in the drive_c path location.
  • Considerations/Thoughts

    Read the rest of this entry »

    Elcomsoft Distributed Password Recovery Video Tutorial

    February 26th, 2015 by Olga Koksharova

    Anyone considering the possibility to purchase Elcomsoft Distributed Password Recovery has a wonderful opportunity to explore the program together with Sethioz and get a clearer understanding of how the program works and what requires your special attention when you are using EDPR. This video assumes you are already familiar with basics of password cracking and suggests more information for your convenient work with the tool.

    Read the rest of this entry »

    Cracking Wi-Fi Passwords with Sethioz

    February 18th, 2015 by Olga Koksharova

    If you care about password cracking, hardware acceleration or Wi-Fi protection this interview with our friend Sethioz is certainly for you. Being currently a freelance security tester Sethioz kindly shared his experience in cracking passwords using video cards, which in its turn derived from his gaming interest in cards. His personal experience may be very helpful to those whose concern about password cracking is not trivial.

    Read the rest of this entry »

    How Secure Is Your Password? A Friendly Advice from a Company That Breaks Passwords

    February 1st, 2015 by Vladimir Katalov

    How many passwords does an average Joe or Jane has to remember? Obviously, it’s not just one or two. Security requirements vary among online services, accounts and applications, allowing (or disallowing) certain passwords. Seven years ago, Microsoft determined in a study that an average user  had 6.5 Web passwords, each of which is shared across about four different websites. They’ve also determined that, back then, each user had about 25 accounts that required passwords, and typed an average of 8 passwords per day.

    Read the rest of this entry »

    Breaking Into iCloud: No Password Required

    June 17th, 2014 by Vladimir Katalov

    With little news on physical acquisition of the newer iPhones, we made every effort to explore the alternatives. One of the alternatives to physical acquisition is over-the-air acquisition from Apple iCloud, allowing investigators accessing cloud backups stored in the cloud. While this is old news (we learned to download data from iCloud more than two years ago), this time we have something completely different: access to iCloud backups without a password! The latest release of Phone Password Breaker is all about password-free acquisition of iCloud backups.

    Read the rest of this entry »