ElcomSoft blog

In simple terms a write blocker sits between the original drive or device and your forensic workstation and stops any write commands from getting through, while letting you read every bit. Along with checksums, write blockers help maintaining chain of custody, ensuring that the imaging step is repeatable and verifiable. Hardware write blockers are physical devices you plug th...

iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad. Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone.

The feature...

Elcomsoft iOS Forensic Toolkit begins low-level extraction by sideloading the extraction agent, and the agent will not run until the phone has completed one or two checks against Apple’s servers. Network requests, on a phone that is evidence. That single requirement is why we have sh...

An iCloud backup is often the only surviving copy of data no longer on the device. Two ordinary situations show why, and neither involves anything clever on the suspect’s part. What could possibly go wrong, and how can you access the data?

Updates fail, usually for a boring reason: not enough free space. iOS downloads the update, st...

There is a whole industry selling software to protect data: full-disk encryption, rights management, key servers, the works. Almost none of it lives in an ordinary home or a two-person office. At home people protect a file the way the application in front of them allows. They type a password into WinRAR, or into Word, or into a PDF, and move on with the day. Here is the thing...