Computer Forensics:
Software and Technologies: Password Cracking andEncrypted Data Access, Mobile Forensics, Cloud Forensics
1© ElcomSoft Ltd. www.elcomsoft.com

ElcomSoft
Who we are§ Privately held company, established in 1990
§ 100% in-house research and development§ Offices in Moscow and Prague§ Over 300 partners and resellers on all continents§ Events and trainings in multiple countries§ Six US patens (including GPU acceleration)§ Corporate, government, military and forensic customers§ Over 400,000 installations worldwide
2

Endorsements and Certifications
IT Industry§

Microsoft Partner: Gold Application Development§Intel Premier Elite Partner§

Member of NVIDIA's
CUDA/GPU Computing Registered Developer Program§

Member of several forensic organizations worldwide§

Quotes and references: Microsoft Encyclopedia of Security, The art ofdeception (Kevin Mitnick), IT Auditing (Chris Davis), Hacking exposed(Stuart McClure), Hacking For Dummies (Kevin Beaver), Computer
Network Security: Theory and Practice (We Wang), Investigating
Digital Crime (Robin P Bryant), Security Engineering (Ross J.
Anderson), Network Know-How: An Essential Guide for the Accidental
Admin (John Ross)
3

Our Customers
Government and Law Enforcement

4Our Customers
IT and Commercial

5

Achievements
Timeline§ 2002: US vs ElcomSoft (https://www.cnet.com/news/elcomsoft-verdict-not-guilty/)§ 2007: Found a government backdoor in Quicken(http://www.theregister.co.uk/2007/06/23/quicken_password_backdoor/)§ 2007: Patented GPU acceleration for password cracking (https://www.elcomsoft.com/news/135.html)§ 2008: Guaranteed near-insstant cracking PDF & Word
(http://www.prweb.com/releases/thunder/tables/prweb1324054.htm)§ 2010: iOS encryption cracked, first on the market(http://www.pcworld.com/article/202629/article.html)§ 2011: BlackBerry password recovery, first and only (https://blog.elcomsoft.com/2011/09/recoveringblackberry-device-passwords/)§ 2013: Download iCloud backups, again first (https://www.elcomsoft.com/news/556.html)

6

Achievements
Timeline§ 2014: Decrypt BlackBerry 10 backups, again first (https://blog.elcomsoft.com/2014/05/phonepassword-breaker-3/#bb10)§ 2014: iCloud access without Apple ID and password: (https://www.elcomsoft.com/news/584.html)§ 2015: Download all Google data (http://www.prnewswire.com/news-releases/elcomsoft-cloudexplorer-forensic-acquisition-of-google-accounts-563228681.html)§ 2016: Recover deleted iCloud photos (https://blog.elcomsoft.com/2016/08/icloud-photo-library-allyour-photos-are-belong-to-us/)§ 2016: Instant access to call logs and real-time iCloud data
(https://blog.elcomsoft.com/2016/11/iphone-user-your-calls-go-to-icloud/)§ 2017: Extract passwords and CC data from iCloud§ 2018: Extract & decrypt Apple Health data from iCloud§ 2019: Extract full file system & keychain from iOS 12 devices
7

ElcomSoft Forensic Solutions
DESKTOP FORENSICSGPU Acceleration

MOBILE FORENSICS
Physical Acquisition

Distributed Computing

Logical Acquisition

Rainbow Tables

Cloud Extraction

Breaking Passwords

Real-Time Tracking8Page 9

GPU Acceleration
Hardware-Accelerated Distributed Desktop Forensics§ Break passwords to hundreds formats faster▫ GPU acceleration (~50-200 times faster than CPU), patented▫ Thunder tables (instantly breaks legacy 40-bit encryption: Word, Excel, PDF)
▫ Distributed recovery in LAN, WAN, on Amazon EC2 and Microsoft Azure§ Several ways to break into encrypted volumes (including instant unlock)▫ BitLocker, FileVault 2, PGP, TrueCrypt, VeraCrypt§ Advanced attacks▫ Instant decryption or recovery for many formats▫ Smart attacks using dictionaries, wordlists, mutations and masks

9Page 10GPU Acceleration
Benchmarks

10Page 11

Crypto Containers
Instant Unlock of Encrypted Volumes§ Break into all major crypto containers without brute
forcing the password§ Encrypted volumes and full-disk encryption§ BitLocker, PGP, TrueCrypt, VeraCrypt, FileVault2§ Get encryption/recovery keys from memory,hibernation file, Active Directory, cloud§ Mounts encrypted volumes as drive letters-or§ Decrypts encrypted content11

Page 12Instant Password Extraction
Extract Saved Passwords from User Computers
Some passwords can be recovered instantly or very quickly§ Extract passwords and autocomplete forms from all popularbrowsers§ Microsoft IE & Edge, Google Chrome, Mozilla Firefox,Opera§ POP3/IMAP/SMTP/NNTP passwords in MS Outlook,Outlook Express, Windows Mail and Live Mail, Thunderbird§ Passwords saved for over 80 instant messengers§ View individual passwords or export everything into text file
§ Dozens applications use weak encryption so allowing
ionstant recovery§ Build a custom dictionary and attack strong passwords toother files and documents
12Smartphone usage over the world§ Apple: 1.4 billion active (January 2019)§ theverge.com/2019/1/29/18202736/apple-devices-ios-earnings-q1-2019§ Google: 2.5 billion active Android devices (May 2019)§ 33% of the world population have a smartphone (stats include small children)

DEVICESAppleGoogleUSERS
Have smartphone

33%

39%
61%

Don't have

67%

13

Mobile Forensics
Apple iOS, Google and Microsoft§ Logical, physical and cloud extraction§ File system acquisition of Apple iOS devices§ Advanced logical extraction§ Access locked iOS devices§ Extraction from Google accounts§ Microsoft accounts: web browsing data, Skype§ Complete support for two-factor authentication§ Tools for viewing and analyzing extracted evidence
14

Mobile Forensics
iOS file system acquisition§

Captures iOS devices file system image▫

Downloaded mail and messages▫

Chats, including protected and private▫

Temporary files and cache▫

Private app data, system databases, logs, temp files§

Full access to private application data, system databases, logs, temp files etc§

Comprehensive location data from multiple sources§

Now possible without jailbreaking - for all phones up to iPhone X§

For newer devices, directly through known exploits§

Device secrets (iOS keychain)▫

User passwords▫

Encryption keys, authentication tokens
15

Mobile Forensics
Advanced logical extraction for iOS§

Logical acquisition is more than an iTunes backup§

Extract backups, media files, crash logs and shared files§

Decrypt user passwords (iOS keychain)§Break unknown passwords to iTunes backups§

Shared files accessible via a yet another dedicated mechanism; may contain valuable information, e.g. password
databases (for third-party password managers)§Crash logs may give insight into what was installed on the device (in the past) and build a timeline§

Cannot be password-protected; always accessible if the device can be paired§

Media files (photos and videos) available through a separate mechanism; may include info on deleted media files§

Unlike backups, media cannot be password-protected§

Sometimes possible even for locked devices (using lockdown/pairing records)

16

Advanced logical: backups§ A comprehensive solution to extract everything available
without a jailbreak§ iTunes backups▫ Data for apps allowed to back up, including photos▫ User passwords, but no other secrets▫ Password-protected backups have advantages▫ Unknown passwords are a huge disadvantage▫ Backup password can be reset with passcode▫ We have tools to attack unknown backup passwords▫ Extract and decrypt the keychain: passwords, tokens
and much more17

18

Cloud data: not just smartphones
Googlecloud

Apple iCloudApplesmartphones
and tablets

Desktops withiCloud forWindows

Mac computers

Any smartphonewith Google
Chrome orGoogle Maps

Android devices

Computers with
Google Chromeor Google Drive19

Cloud forensics
Apple iCloud contains a lot of valuable evidence§ iOS device backups: 2 snapshots of each device§ Synchronized data
§ Passwords and tokens§ File/document storage§ Data from all devices connected to the account (iPhones, iPads, Apple TV, AppleWatch, Apple Home accessories, desktops running Windows or macOS)§ Most data updated in real time (over W-Fi or mobile data)§ May contain data already deleted from devices§ Protected with password, second factor and additional security measures20Synced data vs backups§ Real-time synchronization, data appears in the cloud in minutes§ Backups are huge, difficult to access, contain a lot of useless information§ Backups are often disabled; sync is enabled by default§ Deleted data is often available from both sources§ Apple detects backup downloads by third-party apps and may lock accounts§ Some types of synced data not included in iCloud backups if sync is enabled:▫ Photos (if iCloud Photo Library is enabled)▫ Text messages and iMessages (iOS 11.4 and newer, if synced)▫ Health & Home: not in iCloud backups (regardless the settings)
21

iCloud Keychain§ Synchronized over all connected devices§ Requires Two-Factor Authentication and device passcode§ Contains:▫ Apple IDs with passwords▫ Wi-Fi passwords▫ E-Mail account passwords▫ Passwords stored in Safari▫ Credit cards (no CVC/CVV)▫ Authentication tokens (e.g. for social networks)▫ FileVault2 recovery token (may help to unlock desktop)
22

Apple Health and Cloud•

Apple Health stores a plethora of evidence•

Health data such as heartrate measurements, walking and running activities helped solve hundreds of crimes§

Including several murders•

Apple Watch is NOT required for Apple Health to work; steps, floors climbed are counted using iPhone hardware(dedicated low-power co-processor)§

Native Apple Health data is synced with iCloud to all registered devices§

Third-party app data contribute even more data but sometimes do not share some with Apple Health, but use
proprietary cloud sync (Strava, Endomondo)§Apple Health data can be obtained from iCloud§

May contain significantly more information compared to what is available on device§

Technically, Apple Health belongs to “synced data” as opposed to “cloud backups”§

Since iOS 12, Health is additionally encrypted§Apple won’t provide Health data to LE through government requests§

Our software can download and decrypt it23

Apple Screen Time§

Comprehensive usage statistics (incl. Safari history)§Usage restrictions remotely enforceable§Collected from all devices sharing the same Apple ID+ from child accounts§

iCloud sync requires Two-Factor Authentication§Screen Time data is additionally protected§

Passcode or system password required to access Screen Timedata§

Screen Time password is stored in the iCloud, and we can extractit24

Google account forensics§

Google is not equal to Android§

Data is collected and synced across multiple devices and sources:
smartphones (Android and iOS), tablets, desktops (Windows andmacOS)§

Devices backups do not contain valuable information; most data issynced§

Full Google Chrome data is being saved§

Location is almost always tracked and saved forever§

All passwords used in Google Chrome are saved and so accessible§

Complete statistics on device and app usage is collected25

Cloud Forensics: Conclusion§ Apple and Google collects as much data as possible(and increasing)§ Most data synchronized in real-time, sometimes
once a day§ 2FA is used to secure cloud access§ Apple has additional protection (device passcoderequired to access passwords, Health, Screen Time,Messages)§ Always collect passwords and token from desktops
even if you are investigating the smartphone only
§ Cloud data provided by Apple to LE is limited; oursoftware can extract more information§ Cloud acquisition can help access data from multiple
devices (including locked or damaged)§ Cloud credentials can be collected from desktop
computer, another smartphone or tablet

26

27

28

Cloud Forensics: Credentials§ Passwords saved in desktop and mobile browsers§ Passwords re-use (human factor issue)§ An ability to reset password and replace second factor right from passcode-protected
device§ An ability to reset password through email§ Authentication tokens saved on device or desktop (Windows & macOS X)§ Social engineering attacks§ Keyloggers and malware (used by GCHQ and similar agencies)§ Access via IoT devices§ Legal access (for serious crime cases)
29Computer, Mobile & Cloud Forensics(c) Vladimir Katalov
ElcomSoft Co. Ltd.
http://www.elcomsoft.com
http://blog.crackpassword.com
Facebook: ElcomSoft
Twitter: @elcomsoft

30© ElcomSoft Co. Ltd.