ElcomSoft Co. Ltd. updates Elcomsoft Phone Breaker, the company’s forensic extraction tool. Version 9.40 gains the ability to remotely extract Skype conversation histories, attachments and metadata from the user’s Microsoft Account. In addition to existing data, the tool can extract metadata (such as the file names, sizes and user IDs) of deleted chats and attachments including those that have been purged from Microsoft servers more than 30 days ago.
“With passcode protection and end-to-end encryption of today’s mobile devices, cloud-based analysis is often the only way to access evidence”, says Vladimir Katalov, ElcomSoft President and CEO. “We pioneered cloud extraction, and continue to expand the possibilities available to hi-tech forensic specialists. In our updates, we strive to cover the extraction of essential evidence from the widest range of sources.”
Background
Skype is one of the world’s most popular instant messaging apps. Back in 2016, Skype was reported to have more than 300 million active daily users, with as many as 1.33 billion user accounts in total. The estimated 12% year over year growth of the Skype user base allows ElcomSoft to estimate the current number of Skype active daily users to roughly 420 million, while the total number of Skype accounts is estimated to 1.55 billion.
Microsoft synchronizes Skype conversations across devices with a cloud backend. The cloud sync feature is automatic and cannot be disabled. The text chats are stored on Microsoft servers indefinitely unless manually deleted by the user, while attachments are only kept for the maximum period of 30 days. After the 30-day retention period, any files users send or received are automatically deleted from the server. However, Microsoft still retains information about these files (the metadata), allowing experts to find out the name and type of attachments, file sizes, as well as the date and time.
Extracting Skype Chats and Attachments from Microsoft Account
Skype synchronizes chats, text messages and files sent and received with the Microsoft Account backend. Accessing Skype conversation histories by performing a forensic analysis of the user’s Microsoft Account is often the fastest and easiest way to obtain valuable evidence.
Elcomsoft Phone Breaker 9.40 adds support for Skype acquisition, while Elcomsoft Phone Viewer is updated to allow conveniently analyzing the downloaded Skype data. The pair of tools enables experts to download and view conversation histories, messages, media files, contact lists and metadata directly from the user’s Microsoft Account. In addition to existing data, Elcomsoft Phone Breaker can extract metadata for files and conversation histories deleted within the last 30 days. For chats and media files purged from Skype servers, the tool can obtain metadata such as the date and time, size, file name, sender, and chat name. Find more information and get the latest version at https://www.elcomsoft.com/eppb.html .
