Elcomsoft

Volume Encryption in Synology DSM 7.2: LUKS with Questionable Key Management

Synology DSM 7.2 introduced a highly anticipated feature: volume-level encryption. This data protection mechanism works faster and has less limitations than shared folder encryption, which was the only encryption option supported in prior DSM releases. However, upon investigation, we determined that the implementation of the encryption key management mechanism for full-volume encryption fails to meet the expected standards of security for encrypted data for many users.

In this article, we will explore the current implementation of encrypted volumes in DSM 7.2 and shed light on the challenges posed by the existing key vault design.

👉 https://blog.elcomsoft.com/2023/06/volume-encryption-in-synology-dsm-7-2-luks-with-questionable-key-management/

#diskencryption #LUKS #NAS #Synology

Breaking Wi-Fi Passwords with Intel Arc Graphics Cards

Intel has unveiled its latest lineup of dedicated graphics cards, driven by the powerful Intel Xe architecture. The Intel Arc series showcases impressive performance, rivaling mid-range offerings from competing brands, while maintaining an exceptional price-performance ratio that outperforms NVIDIA’s counterparts. In this article, we explore the potential of Intel Arc GPUs for forensic password recovery and delve into their performance capabilities, comparing them with both Intel’s built-in graphics and mid-range NVIDIA RTX boards.

👉 https://blog.elcomsoft.com/2023/05/breaking-wi-fi-passwords-with-intel-arc-graphics-cards/

#EWSA #IntelArc #Nvidia #wifi #password

Elcomsoft Wireless Security Auditor adds support for Intel Arc graphics cards

We updated Elcomsoft Wireless Security Auditor with support for Intel Arc family of graphics cards, Intel’s cost-efficient entry to discrete GPU market.

👉 https://www.elcomsoft.com/news/836.html

#EWSA #password #IntelArc #gpu #dfir

NVIDIA RTX 40 Series Graphics Cards: The Faster and More Efficient Password Recovery Accelerators

Every three years, NVIDIA releases a new architecture used in their GeForce series graphics cards. Powered by Ada Lovelace, the new generation of GPUs delivers 80% better performance in password recovery compared to Ampere. While the new generation of NVIDIA graphics is faster and more efficient than Ampere, it also received a price hike. Is the update worth it for the forensic experts? Let’s try to find out.

👉 https://blog.elcomsoft.com/2023/05/nvidia-rtx-40-series-graphics-cards-the-faster-and-more-efficient-password-recovery-accelerators/

#EDPR #GPU #Nvidia #password #AdaLovelace

Elcomsoft Distributed Password Recovery 80% faster with NVIDIA GeForce RTX 40 Series graphics cards

Elcomsoft Distributed Password Recovery 80% faster with NVIDIA GeForce RTX 40 Series graphics cards We updated Elcomsoft Distributed Password Recovery with support for NVIDIA GeForce RTX 40 Series graphics cards, the company’s latest and greatest GPU series. In addition, Elcomsoft Distributed Password Recovery can now break NetNTLM v1/v2 and IKE PSK MD5 hashes.

👉 https://www.elcomsoft.com/news/835.html

#EDPR #Nvidia #password #GPU #AdaLovelace #RTX

iOS Forensic Toolkit and Open Source

As a provider of mobile forensic tools, we at Elcomsoft strongly believe in giving back to the community. Our iOS Forensic Toolkit (EIFT) is a highly complex and powerful mobile acquisition tool, consisting of almost eighty sub-projects, many of which are open source. While we have benefited from the contributions of the community, we also believe that it’s time to contribute back to the open source community by publishing our changes to those projects as required by their permissive license.

👉 https://blog.elcomsoft.com/2023/05/ios-forensic-toolkit-and-open-source/

#EIFT #opensource #toolkit

Low-level Extraction for iOS 15

Last month, we introduced a new low-level mechanism, which enabled access to parts of the file system from many Apple devices. The partial extraction process relies on a weak exploit that did not allow full sandbox escape. Today, the limitations are gone, and we are proud to offer the full file system extraction and keychain decryption for the entire iOS 15 range up to and including iOS/iPadOS 15.7.2.

👉 https://blog.elcomsoft.com/2023/05/low-level-extraction-for-ios-15/

#iOS #EIFT #agentextractor #dfir #mobileforensics

Full low-level extraction for the entire iOS 15 range

Elcomsoft iOS Forensic Toolkit 8.22 and 7.81 expand low-level extraction support, now covering the entire iOS/iPadOS 15 range. The newly supported OS versions include 15.6 through 15.7.2. The new method enables the extraction of the full file system including keychain, and supports devices built with the A12 and newer chips, effectively covering the iPhone 8/X through iPhone 13 range, and many iPads including those based on Apple M1 chips.

👉https://www.elcomsoft.com/news/834.html

#EIFT #ios #dfir #mobileforensics

Automating Scrolling Screenshots with Raspberry Pi Pico

The recent update to iOS Forensic Toolkit brought two automations based on the Raspberry Pi Pico board. One of the new automations makes it possible to make long, scrollable screen shots in a semi-automatic fashion. In this article we will show how to build, program, and use a Raspberry Pi Pico board to automate scrolling screenshots.

👉 https://blog.elcomsoft.com/2023/04/automating-scrolling-screenshots-with-raspberry-pi-pico/

#EIFT #iOS #logicalacquisition #Raspberry #raspberrypipico #screenshot #screenshot #dfir

Automating DFU Mode with Raspberry Pi Pico

The latest update to iOS Forensic Toolkit brings two new features, both requiring the use of a Raspberry Pi Pico board. The first feature automates the switching of iPhone 8, iPhone 8 Plus, and iPhone X devices into DFU, while the second feature adds the ability to make long, scrollable screen shots in a semi-automatic fashion. In this article we will show how to build, program, and use a Raspberry Pi Pico board to automate DFU mode.

👉 https://blog.elcomsoft.com/2023/04/automating-dfu-mode-with-raspberry-pi-pico/

#DFU #EIFT #iOS #Raspberry #raspberrypipico #DFIR

Elcomsoft iOS Forensic Toolkit 8.21 add auto-DFU and automated screen shot capture

Elcomsoft iOS Forensic Toolkit 8.21 adds support for automated DFU mode and automated screen shot capturing using a pre-programmed Raspberry Pi Pico board. In addition, the new release adds checkm8 extraction support for compatible devices running iOS 15.7.3-15.7.5.

👉 https://www.elcomsoft.com/news/833.html

#checkm8 #EIFT #DFU #mobileforensics #iOS #iPhone #DFIR

Perfect Acquisition Part 4: The Practical Part

Welcome to Part 4 of the Perfect Acquisition series! In case you missed the other parts (1, 2, and 3), please check them out for more background information, or dive straight in and learn how to perform Perfect HFS Acquisition yourself. This section contains a comprehensive guide on how to perform the Perfect HFS Acquisition procedure.

👉 https://blog.elcomsoft.com/2023/04/perfect-acquisition-part-4-the-practical-part/

#ios #lowlevelextraction #eift #dfir #keychain

Perfect Acquisition Part 3: Perfect HFS Acquisition

Welcome to Part 3 of the Perfect Acquisition series! If you haven’t read Part 1 and Part 2 yet, be sure to check them out before proceeding with this article. In this section, we will introduce our newly developed Perfect HFS Acquisition method, which enables the extraction of data from legacy iOS devices that do not have SEP and utilize the HFS file system.

👉 https://blog.elcomsoft.com/2023/04/perfect-acquisition-part-3-perfect-hfs-acquisition/

#iOS #lowlevelextraction #dfir #mobileforensics

Elcomsoft tools gain support for NVIDIA Ada Lovelace boards, nearly double password recovery speeds

Elcomsoft Advanced Office Password Recovery 7.20, Wireless Security Auditor 7.50, and Advanced PDF Password Recovery 5.20 gain support for NVIDIA’s latest-generation GeForce RTX 40 boards. The resulting performance increase nearly doubles the password recovery speeds of respective formats.

👉 https://www.elcomsoft.com/news/832.html

#NVIDIA #AOPR #password #EWSA #APDFPR #passwordrecovery #GeForceRTX40

Obtaining Serial Number, MAC, MEID and IMEI of a locked iPhone

Obtaining information from a locked iPhone can be challenging, particularly when the device is passcode-protected. However, four critical pieces of information that can aid forensic analysis are the device’s International Mobile Equipment Identity (IMEI), Mobile Equipment IDentifier (MEID), MAC address of the device’s Wi-Fi adapter, and its serial number. These unique identifiers can provide valuable insights into a device’s history, including its manufacture date, hardware specifications, and carrier information.

👉 https://blog.elcomsoft.com/2023/03/obtaining-serial-number-mac-meid-and-imei-of-a-locked-iphone/

#EIFT #iPhone #iOS #DFIR #mobileforensics

iOS Forensic Toolkit 8.20 and 7.80 add partial file system extraction for iOS 16.1.2 and older

Elcomsoft iOS Forensic Toolkit 8.20 and 7.80 add low-level extraction support for a range of iOS versions, pulling parts of the file system. The newly supported iOS versions go all the way up to iOS 16.1.2. The new method supports devices built with the A11 through A16 Bionic chips, effectively covering the iPhone 8/X through iPhone 14 range, and supports many iPads including those based on Apple M1 and M2 chips.

👉 https://www.elcomsoft.com/news/831.html

#EIFT #iOS #agent #toolkit #dfir #mobileforensics

Perfect Acquisition Part 2: iOS Background

Welcome to part 2 of the Perfect Acquisition series! In case you missed part 1, make sure to check it out before continuing with this article. In this section, we will dive deeper into iOS data protection and understand the obstacles we need to overcome in order to access the data, which in turn will help us accomplish a Perfect Acquisition when certain conditions are met.

🧑‍💻 https://blog.elcomsoft.com/2023/03/perfect-acquisition-part-2-ios-background/

#iOS #lowlevelextraction #dfir #mobileforensics

Perfect Acquisition Part 1: Introduction

Forensic acquisition has undergone significant changes in recent years. In the past, acquisition was relatively easy, with storage media easily separable and disk encryption not yet widespread. However, with the rise of mobile devices and their built-in encryption capabilities, acquiring data has become increasingly challenging. Traditional approaches like disk dumps are no longer feasible, and software exploitation has become the industry standard. Despite these methods, there are limitations to mobile acquisition, including the need to collaborate with the device, the possibility of hardware defects or deliberate data tampering. As a result, there is a need for continuous innovation in forensic acquisition to address these challenges and ensure accurate and reliable data collection.

🧑‍💻 https://blog.elcomsoft.com/2023/03/perfect-acquisition-part-1-introduction/

#ios #legacy #lowlevelextraction

HomePod Forensics II: checkm8 and Data Extraction

The first-generation HomePod is a smart speaker developed by Apple that offers high-quality audio and a range of features, including Siri integration and smart home controls. However, as with any electronic device, it can store valuable information that may be of interest in forensic investigations. In this article, we will explore how to use the forensically sound checkm8 extraction to access data stored in the HomePod, including the keychain and file system image. We will also outline the specific tools and steps required to extract this information and provide a cheat sheet for those looking to extract data from a HomePod. By the end of this article, you’ll have have a better understanding of how to extract data from the first-generation HomePod and the potential limitations of this extraction method.

🧑‍💻 https://blog.elcomsoft.com/2023/03/homepod-forensics-ii-checkm8-and-data-extraction/

#iOS #checkm8 #HomePod #EIFT #DFIR #mobileforensics

Elcomsoft iOS Forensic Toolkit 8.13 adds checkm8 extraction for first-generation HomePod

Elcomsoft iOS Forensic Toolkit 8.13 adds forensically sound checkm8 extraction support for first-generation HomePod devices, and brings multiple improvements to the handling of legacy iPhone models.

🧑‍💻 https://www.elcomsoft.com/news/830.html

#HomePod #iOS #EIFT #mobileforensics #dfir #checkm8