Browser Forensics in 2026: App-Bound Encryption and Live Triage
January 13th, 2026 by Oleg Afonin
Since the introduction of DPAPI in Windows 2000, the forensic workflow for recovering browser credentials was straightforward: isolate the computer, image the drive, and extract the browser profile. In that era, having the user’s Windows password was enough to decrypt everything offline. Today, that assumption is outdated. With the shift to App-Bound Encryption, Google and Microsoft effectively broke the “dead box” workflow for their browsers. While stored passwords remain critical evidence, accessing them now requires investigators to act before they pull the plug.
ElcomSoft Discovers Most of Its Customers Want Stricter Security Policies but Won’t Bother Changing Default Passwords
February 22nd, 2012 by Olga Koksharova
We runned yet another Password Usage Bahaviour survey on our Web site and gthered statistically significant data, reflected in the following charts. And the main conclusion was that most people working with sensitive information want stricter security policies but rarely bother changing default passwords.
Newer iOS Forensic Toolkit Acquires iPhones in 20 Minutes, Including iOS 5
November 1st, 2011 by Olga Koksharova
iOS 5 Support
EPPB: Now Recovering BlackBerry Device Passwords
September 29th, 2011 by Andrey Belenko
Less than a month ago, we updated our Elcomsoft Phone Password Breaker tool with the ability to recover master passwords for BlackBerry Password Keeper and BlackBerry Wallet. I have blogged about that and promised the “next big thing” for BlackBerry forensics to be coming soon. The day arrived.
New version of EPPB: Recovering Master Passwords for BlackBerry Password Keeper and BlackBerry Wallet
August 30th, 2011 by Andrey Belenko
Conferences are good. When attending Mobile Forensics Conference this year (and demoing our iOS Forensic Toolkit), we received a lot of requests for tools aimed at BlackBerry forensics. Sorry guys, we can’t offer the solution for physical acquisition of BlackBerries (yet), but there is something new we can offer right now.
Visiting BlackHat and DefCon 2011
August 22nd, 2011 by Olga Koksharova
Yet again, we are back from a couple of conferences organized specially for heavy computer users like us. We are particularly happy that our company was again warmly welcomed by the overseas hacking community – thank you for accepting and visiting our talk – and that FBI didn’t bother us too much during our stay, though they didn’t miss a chance to scare the crap out of Andrey and Vladimir right before their departure back to Moscow. Apart from that little episode with three-letter guys everything went smoothly.
Elcomsoft iOS Forensic Toolkit highlighted in SANS Information Security Reading Room
August 15th, 2011 by Olga Koksharova
SANS Information Security Reading Room has recently publicized a whitepaper about iOS security where they mentioned our software – Elcomsoft iOS Forensic Toolkit – in a section about encryption. Kiel Thomas, the author of the whitepaper, explained one more time the main principles of iOS 4 encryption, which became stronger in comparison with iOS 3.x and how our toolkit can bypass new strong algorithms.
