Elcomsoft Adds Windows 10 Support

Initially, Windows 10 changed little when it comes to BitLocker encryption. However, the November update (build 1511) introduced an all-new BitLocker XTS-AES encryption algorithm. This new algorithm is not backward-compatible with prior versions. This new algorithm required a lot of research. Elcomsoft has been able to implement full support for the new XTS-AES encryption in the updated version of Elcomsoft Forensic Disk Decryptor. The tool now fully supports all BitLocker volumes created in Windows 8, 8.1 and Windows 10 including the latest Windows 10 November Update. You can instantly unlock encrypted volumes with on-the-fly decryption. The decryption keys are automatically extracted from memory dumps or hibernation files obtained from systems that had encrypted volumes mounted at the time of acquisition.

Elcomsoft System Recovery is updated to support the new online authentication introduced in Windows 8, the Microsoft Account. The tool can now instantly reset Microsoft Account passwords; however, this is not the point. The point is that you can now run an offline attack to break into one of the major online authentication services, the Microsoft Account. You do that by exporting password hashes with Elcomsoft System Recovery, then running an offline attack to recover the original password with Elcomsoft Distributed Password Recovery. The resulting Microsoft Account password unlocks the door into the world of things available in a wide range of Microsoft cloud services.

Examples? How about accessing all files stored in the user’s OneDrive? We’re talking about those very files that are saved to the cloud by Microsoft Office, and backed up automatically once the user signs in to Windows with their Microsoft Account.

Heard about BitLocker? Microsoft Account has BitLocker Recovery Keys you can use to instantly unlock an encrypted computer or tablet.

Bing search history, places on the map, contacts, calendars, notes, Skype history, device backups and many other things are also stored in Microsoft cloud and authenticated via Microsoft Account.