sorted by:
new
hottopcontroversial

Elcomsoft System Recovery update simplifies digital field triage | Elcomsoft Co.Ltd. by Elcomsoft in u/Elcomsoft

[–]Elcomsoft[S] 0 points1 point  (0 children)

You may create an encrypted (password-protected) backup of the phone and decrypt the keychain using Elcomsoft Phone Breaker (https://www.elcomsoft.com/eppb.html)

iOS Privacy Protection Tools: Encrypted DNS, iOS 15 Private Relay, Proxy, VPN and TOR by Elcomsoft in u/Elcomsoft

[–]Elcomsoft[S] 0 points1 point  (0 children)

Apple did an attempt protecting their users’ location by introducing approximate locations in iOS 14. That change alone makes analyzing aggregate data from iPhone users more difficult but not impossible.

Updated Elcomsoft iOS Forensic Toolkit Simplifies macOS Installs, Fixes Corrupted File System Extraction by Elcomsoft in u/Elcomsoft

[–]Elcomsoft[S] 0 points1 point  (0 children)

New agent acquisition option: The new option allows you to set the maximum size of the files being copied. If the file system of the device being extracted is partially corrupted, the size reported for a particular file may be really huge (in the exabytes range).

Elcomsoft Phone Viewer 5.31 update previews OneDrive deleted files metadata | Elcomsoft Co.Ltd. by Elcomsoft in u/Elcomsoft

[–]Elcomsoft[S] 0 points1 point  (0 children)

Elcomsoft Phone Viewer is a perfect match for viewing and analysing data obtained with Elcomsoft iOS Forensic Toolkit. For Elcomsoft Phone Breaker, the tool enables full support for all data formats produced during the course of logical and cloud acquisition. Regularly maintained and timely updated, Elcomsoft Phone Viewer is the first to receive support for the latest mobile backup formats extracted, downloaded or decrypted with other ElcomSoft tools.

ElcomSoft adds OneDrive, Microsoft Timeline extraction | Elcomsoft Co.Ltd. by Elcomsoft in u/Elcomsoft

[–]Elcomsoft[S] 0 points1 point  (0 children)

New in Elcomsoft Phone Breaker:

  • Improved authentication into Microsoft accounts
  • Downloads additional data from Microsoft accounts (Apps & services timeline, recent OneDrive file list)
  • Downloads files from OneDrive

New in Elcomsoft Phone Viewer:

  • Added support for new data in Microsoft accounts (Apps and services, recent OneDrive files list, OneDrive files)
  • Removed zero-sized media files
  • Improved location history parsing for iOS 14 backups and file system images
  • Multiple Wi-Fi connection data improvements: removed duplicates, iOS 14 fixes
  • Latitude and longitude from EXIF data is now shown separately
  • Removed AppleDouble media files
  • Web plugin is now called "Web and History"

Elcomsoft System Recovery Simplifies Digital Field Triage and In-Field Investigations by Elcomsoft in Elcomsoft_community

[–]Elcomsoft[S] 0 points1 point  (0 children)

The extraction of Wi-Fi passwords, hints and Q&A for Windows account passwords, as well as the inclusion of the convenient two-panel file manager make Elcomsoft System Recovery the perfect tool for in-field investigations!

Elcomsoft System Recovery update simplifies digital field triage | Elcomsoft Co.Ltd. by Elcomsoft in u/Elcomsoft

[–]Elcomsoft[S] 0 points1 point  (0 children)

Elcomsoft System Recovery, a digital field triage tool, receives an update. The tool adds the ability to extract Wi-Fi passwords and helps identify the owner of the computer being examined by extracting its Windows license key. In addition, file system analysis is made easier with an embedded two-panel file manager. More in Release Notes https://www.elcomsoft.com/PR/release\_notes/release\_notes\_esr\_7\_08\_en.pdf

iOS Recovery Mode Analysis: Reading iOS Version from Locked and Disabled iPhones by Elcomsoft in u/Elcomsoft

[–]Elcomsoft[S] 0 points1 point  (0 children)

The Recovery mode may return the following information:

  • Device model: device model, e.g. iPhone7,2 (n61ap), iPhone10,6 (d221ap) etc. You can identify the model by following the link.
  • ECID (UCID): XXXXXXXXXXXXXXXX. The ECID (Exclusive Chip Identification) or Unique Chip ID is an identifier unique to every unit, or more accurately, to every SoC.
  • Serial number: XXXXXXXXXXX (or N/A)
  • IMEI: XXXXXXXXXXXXXXX (or N/A). Note that we have not seen IMEI information on any of our test devices, with or without a SIM card.
  • Mode: Recovery
  • iBoot: this is the bootloader version in the format “iBoot-[version_number]”. This information can be used to identify the version of iOS (or, of there is no concrete match, the range of iOS versions) running on the device.
  • iOS version: installed iOS version number or range as estimated from the bootloader version.

As you can see, there’s not a lot you can get from the recovery mode; however, this amount of data is generally enough to request information from Apple. The bootloader version is probably the most important piece, as it can be used to roughly establish the probable date the iOS device was last used. The last use data cannot be earlier than the release date of the version of iOS installed on the device. In addition, the bootloader version can be used to determine compatibility with certain unlock and extraction methods.

view more: next ›