Write Blockers in Forensics: What Controls How You Use Them?
August 19th, 2026 by Oleg Afonin
In simple terms a write blocker sits between the original drive or device and your forensic workstation and stops any write commands from getting through, while letting you read every bit. Along with checksums, write blockers help maintaining chain of custody, ensuring that the imaging step is repeatable and verifiable. Hardware write blockers are physical devices you plug the source media into, software write blockers are installed on the acquisition system, and the former type is more robust than the latter. The point, however, is not speed or convenience, it is to make a forensic copy without changing the original, so the evidence you work from is the same as the evidence you seized. And here comes the question: which laws or standards mandate using a write blocker?
The History and Evolution of USB Charging Standards
January 26th, 2026 by Oleg Afonin
During the last decade, the evolution of charging standards in consumer electronics has been defined by an attempt to develop a single, unified power delivery interface centered around the USB Type-C connector. Historically, power delivery was characterized by a clear separation between data interfaces and dedicated power connectors. The Universal Serial Bus (USB) was originally introduced in the mid-1990s as a data bus for low-speed peripherals, with power capabilities capped at levels intended to support mice and keyboards rather than charge batteries – never intended to power demanding hardware.
Web Browser Forensics in Digital Triage
January 14th, 2026 by Oleg Afonin
In modern investigations, the web browser is no longer just an application – it is a comprehensive journal of a suspect’s life, intentions, and habits. While end-to-end encrypted clouds and locked smartphones often hit a dead end, the desktop web browser remains one of the most significant grounds for digital evidence, often serving as the silent witness that helps solve a case.
Browser Forensics in 2026: App-Bound Encryption and Live Triage
January 13th, 2026 by Oleg Afonin
Since the introduction of DPAPI in Windows 2000, the forensic workflow for recovering browser credentials was straightforward: isolate the computer, image the drive, and extract the browser profile. In that era, having the user’s Windows password was enough to decrypt everything offline. Today, that assumption is outdated. With the shift to App-Bound Encryption, Google and Microsoft effectively broke the “dead box” workflow for their browsers. While stored passwords remain critical evidence, accessing them now requires investigators to act before they pull the plug.
The Cloud Gap: Forensic Triage vs. Disk Imaging in the Age of On-Demand Sync
January 8th, 2026 by Oleg Afonin
For decades, the forensic “gold standard” was straightforward: isolate the computer, pull the plug, and image the drive. In that era, what you saw on the screen was physically present on the magnetic platters, waiting to be extracted bit by bit. Today, that assumption is not just outdated; it is plain wrong. The rapid adoption of cloud storage services, partial on-demand synchronization, and full-disk encryption has fundamentally broken the traditional dead-box workflow, turning the simple act of powering down a suspect’s computer into a potential destroyer of evidence.
The Shift from Disk Imaging to Digital Triage
January 5th, 2026 by Oleg Afonin
Modern digital forensic labs are facing a crisis of scale. When a search warrant results in the seizure of a dozen laptops, several servers, and a mountain of external drives, the traditional forensic workflow – bit-for-bit imaging followed by exhaustive analysis – becomes a liability rather than an asset. This is precisely where our new tool, Elcomsoft Quick Triage, enters the picture. Designed as a solution for rapid, in-field data acquisition, EQT allows investigators to bypass the “imaging bottleneck” and identify the “smoking gun” in minutes rather than months.
Introducing Elcomsoft Quick Triage
December 30th, 2025 by Oleg Afonin
We’re expanding our product line with a new tool: Elcomsoft Quick Triage. With this release, we are expanding into an area we had not previously covered – digital forensic triage. EQT is designed to address a very specific need that arises at the earliest stages of an investigation, when time is limited and quick decisions matter. The new tool is not intended to replace full-featured forensic platforms or in-depth analysis. Instead, it focuses on a different phase of the workflow: fast identification, collection, and review of the most relevant evidence before committing resources to a complete examination.
Eighteen Years of GPU Acceleration
November 27th, 2025 by Oleg Afonin
Eighteen years ago, before “GPU acceleration” and “AI data center” became household terms, a small hi-tech company changed the rules of cryptography. In 2007, we unveiled a radical idea – using the untapped power of graphics processors to recover passwords, which coincided with the release of video cards capable of performing fixed-point calculations. What began as an experiment would soon redefine performance computing across nearly every field.
Leveraging User Profiles for Smarter Password Attacks
November 24th, 2025 by Oleg Afonin
Most real-world passwords aren’t random – they follow the owner’s habits, preferences, and personal history. Names, birthdays, pets, team loyalties, and even old usernames affect how people build their “secret” strings. By turning this everyday information into structured, prioritized password candidates, analysts can reach higher success rates than with generic dictionaries or blind brute force. This article explains how to transform user data into a focused attack strategy.
Password Managers: Security, Risks, and Forensic Implications
November 18th, 2025 by Oleg Afonin
Password managers have become a common part of everyday digital life, helping users handle hundreds of online accounts. They simplify authentication and reduce the need to remember complex credentials, yet the same centralization that makes them convenient also concentrates risk. Modern platforms from Apple, Google and Microsoft all ship with built-in password managers, and many users rely on third-party apps for the same purpose.
Breaking Barriers: First Full File System Extraction from Apple TV 4K Running tvOS 26
November 17th, 2025 by Vladimir Katalov
Big news is coming – and this time, it’s from the living room. Our team has successfully extracted a complete file system image from an Apple TV 4K running tvOS 26. This marks the first-ever low-level extraction of Apple’s 26th-generation operating systems, including iOS 26, iPadOS 26, and tvOS 26. No one – not even the major forensic players! – has been able to achieve this before.
