ElcomSoft blog

Elcomsoft Quick Triage 2.2 adds three things: a Timeline view that merges events from every timestamped artifact into one chronology, a file system snapshot that copies metadata without file contents, and a plugin architecture for artifact parsers. The release also brings MSA password...

In law enforcement use a “consent extraction” means the examiner knows the passcode. It rarely signals owner agreement. That would be a vocabulary issue if the passcode remained the whole key. Since iOS 26.4 it does not. Stolen Device Protection is on by default, and away from familiar locations it requires Face ID or Touch ID before the “Trust This Computer” prompt. The pass...

In simple terms a write blocker sits between the original drive or device and your forensic workstation and stops any write commands from getting through, while letting you read every bit. Along with checksums, write blockers help maintaining chain of custody, ensuring that the imaging step is repeatable and verifiable. Hardware write blockers are physical devices you plug th...