Password breaking

Password breaking

MOBILedit Forensic Express allows you to extract iTunes backups from iOS devices in addition to ADB backups from Android devices. You can even load historical backups that have been created previously for detailed analysis or comparison. It is not uncommon to find backups that are protected with some form of password or a code. In order to analyze such backup, the password must be obtained to gain access. There are multiple tools and methods that are offered in the software that will save a significant amount of time for investigators.

1. Directly entering password

The password can be entered directly if it was obtained during investigation or through other means. There is an unrestricted number of attempts allowed to enter the password, so you cant get permanently locked out. You can also see a history of the previously entered unsuccessful passwords.

You can now choose to include password into the logs and reports!

2. Dictionary attack

Dictionary attacks simply go through a list of supplied strings and try to enter them as the password. An investigator can either use one of our supplied dictionaries or use his or her own dictionary. Our product ships with the following dictionaries:

  1. EN_100k.txt - english dictionary containing 100 thousand words.
  2. EN_200k.txt - english dictionary containing 200 thousand words.
  3. EN_650k.txt - english dictionary containing 650 thousand words.
  4. common_passwords_1M1.txt - file containing 1.1 million of the most commonly used passwords.

In order to add your own dictionary just provide path to a text file after clicking "Add dictionary". All dictionaries must contain words separated by a newline. 

Multiple dictionaries can be used in a single Dictionary attack.

3. PIN attack

PIN attack assumes that password contains digits exclusively. Password length is chosen and some digits can be entered manually if they are known.

    • Related Articles

    • iTunes backup password is required each time I run analysis

      Normally when you extract iTunes backup and a temporary password is set-up by MOBILedit Forensic Express is this password removed after successful extraction. It looks like your first extraction didn't finish successfully and the iTunes Backup ...
    • Cannot see too much information in a report from iPhone

      As for the empty sections in the report, the crucial thing is to enter the proper password so the iTunes backup can be created, from where we get most of the data. If this fails, it is cancelled or you don't know the password, there is not much ...
    • Getting started

      MOBILedit Forensic Express performs mobile phone content extractions and is used by professionals in law enforcement, military as well as the corporate and private sectors. By connecting a phone via USB cable, Wi-Fi or Bluetooth you can perform ...
    • Reveal iTunes backup

      If you previously used iTunes software to back up your iOS device, you can use this feature in order to extract data from the created iTunes backup using MOBILedit Forensic Express. Please follow the steps below: Open MOBILedit Forensic Express  ...
    • Use TWRP to bypass Android lockscreen

      TWRP custom recovery makes it quite easy to remove any kind of lock (except for fingerprint) from your Android device.  You'll find a step-by-step guide below: Reboot your phone into TWRP and click the "Advanced" button In the advanced options, click ...