ElcomSoft Updated Distributed Password Recovery Software With Support for Wider Range of Encrypted and Locked Evidence

ElcomSoft Co. Ltd. updates Distributed Password Recovery with support for a wider range of encrypted and locked evidence.

The update enables forensic access to disks protected with VeraCrypt, APFS volumes encrypted with FileVault 2, and recovers Tally Vault passwords.

“The use of full-disk encryption makes the work of forensic experts more difficult than ever,” says Vladimir Katalov, CEO. “FileVault and VeraCrypt are equally important for the law enforcement and corporate IT experts performing internal investigations. While FileVault 2 is actively used on many macOS devices, VeraCrypt is the favorite of those who really have something to hide.“

Click to enlarge

Breaking VeraCrypt containers
VeraCrypt is a third-party full-disk encryption product, a successor to TrueCrypt. Devoid of any major vulnerabilities, it is a secure encrypted containers. Volumes protected with VeraCrypt require a full-scale brute-force attack on the original plain-text password. The company’s Distributed Password Recovery 4.20 adds VeraCrypt support, enabling investigators to unlock the most vigorously protected evidence.

Read more in the article Breaking VeraCrypt containers.

Breaking FileVault 2 encryption on APFS volumes
The APFS (Apple File System) is Apple’s next-gen file system designed to scale from an Apple Watch to a Mac Pro. According to Apple, APFS is optimized for solid-state storage, and engineered with encryption as a primary feature. On Mac computers, APFS implements encryption via FileVault 2, a disk encryption feature that is built into macOS.

In this release, the company’s Distributed Password Recovery adds support for FileVault 2 volumes stored on APFS-formatted disks. In order to quickly initiate password attacks without imaging the whole disk, the updated firm’s System Recovery is recommended.

Click to enlarge

Recovering Tally Vault passwords
Tally ERP 9 is a business planning solution in India. In this update, the firm has added support for Tally Vault passwords, achieving recovery speeds of up to 10 million passwords per second with CPU-only attacks.

Read expert analysis in Tally ERP 9 Vault: How to Not Implement Password Protection.

The company’s Distributed Password Recovery enables accelerated password recovery for more than 500 formats including Microsoft Office and Adobe PDF documents, encrypted volumes and archives, Oracle passwords, Windows and Unix login and domain passwords.

Resources:
Distributed Password Recovery release notes
Blog: Using Microsoft Azure to Break Passwords
Blog: Tally ERP 9 Vault: How to Not Implement Password Protection
Video: How to Break Passwords for Different File Formats

Read also :
Elcomsoft System Recovery V.6.0 Bootable Tool for Unlocking Windows Accounts and Accessing Encrypted Volumes
Introduces workflow for full-disk encryption, allowing to extract information required to launch password recovery attacks on volumes encrypted with BitLocker, PGP and TrueCrypt/VeraCrypt.
May 2, 2019 | Press Release