The iOS 27 Recovery Menu: What It Means for Forensics
August 5th, 2026 by Oleg Afonin
iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad. Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone.
What Google Knows About You, and Why It Matters
December 22nd, 2015 by Vladimir Katalov
In today’s thoroughly connected world, everyone shares at least some of their personal information with, well, strangers. Voluntarily or not, people using personal computers or mobile devices have some of their information transmitted to, processed, stored and used by multiple online service providers.
Elcomsoft Distributed Password Recovery Updated with OS X Keychain Support and Enhanced GPU Acceleration
November 26th, 2015 by Vladimir Katalov
We’ve recently updated Elcomsoft Distributed Password Recovery, adding enhanced GPU-assisted recovery for many supported formats. In a word, the new release adds GPU-accelerated recovery for OS X keychain, triples BitLocker recovery speeds, improves W-Fi password recovery and enhances GPU acceleration support for Internet Key Exchange (IKE).
A New Tool for WhatsApp Acquisition
November 25th, 2015 by Vladimir Katalov
We have recently released a brand new product, Elcomsoft Explorer for WhatsApp. Targeted at home users and forensic experts along, this Windows-based, iOS-centric tool offers a bunch of extraction options for WhatsApp databases. Why the new tool, and how is it different from other extraction options offered by Elsomsoft’s mobile forensic tools? Before we move on to that, let’s have a look at the current state of WhatsApp.
Physical Acquisition for 64-bit Devices, iOS 9 Support
November 18th, 2015 by Vladimir Katalov
Big news! iOS Forensic Toolkit receives its first major update. And it’s a big one. Not only does version 2.0 bring support for iOS 9 handys. We also expanded acquisition support for jailbroken devices, enabling limited data extraction from jailbroken devices locked with an unknown passcode.
Extracting Data from Locked iPhones
November 13th, 2015 by Vladimir Katalov
With hardware-backed full-disk encryption and additional protection of sensitive user data located in the keychain, Apple iOS is the most secure mobile operating system out there. Acquisition approaches that are traditional for Android and Windows Phone devices (namely, JTAG, ISP and chip-off) are completely meaningless for iOS devices running even years-old generations of the system. Bypassing screen lock password (passcode) has also been long considered to be useless due to the fact user data stored in the keychain is additionally encrypted with a secure key based on the passcode.
Elcomsoft Phone Viewer: iOS 9, Media Gallery and Location Tracking
November 11th, 2015 by Vladimir Katalov
We’ve just released the first major update to Elcomsoft Phone Viewer, our lightweight forensic tool for glancing over data extracted from mobile devices. Boosting version number to 2.0, we added quite a lot of things, making it a highly recommended update.
Overcoming iOS 9 Security in Elcomsoft Phone Breaker 5.0
October 29th, 2015 by Vladimir Katalov
If you follow industry news, you already know about the release of iOS 9. You may also know that iOS 9 is the toughest one to break, with no jailbreak available now or in foreseeable future. With no jailbreak and no physical acquisition available for newer devices, what methods can you still use to obtain evidence from passcode-locked devices? Our answer to this is Elcomsoft Phone Breaker 5.0 that adds over-the-air acquisition support for iOS 9.
Digging Mac OS Keychains
September 16th, 2015 by Vladimir Katalov
We have just released a brand new tool, and this time it’s not about mobile forensics. Or is it?
BlackBerry Password Keeper Escrow Key: Have We Just Found a Hidden Backdoor?
August 11th, 2015 by Vladimir Katalov
As you may already know from the official press release, we’ve recently updated Elcomsoft Phone Breaker to version 4.10. From that release, you could learn that the updated version of the tool targets passwords managers, adding the ability to instantly decrypt passwords stored in BlackBerry Password Keeper for BlackBerry 10 and attack 1Password containers.
Video Tutorial on Decryption of Windows EFS-encrypted Data
July 6th, 2015 by Olga Koksharova
Although we’ve already embraced the EFS-encryption/decryption in some of our white papers and case studies, now we’d like to share a video tutorial because seeing once is better than hearing reading twice. So, in this video you will see how to decrypt EFS-encrypted data with help of Advanced EFS Data Recovery and how to recover Windows user account password with Proactive System Password Recovery (because it’s still obligatory for this type of encryption).
