Cracking Passwords in Forensic Investigations - Scholarly ...

in the fields. The various fields in Modular Crypt Format and their purposes are
shown in table 2.1.
Table 2.1: The Modular Crypt Format (Garfinkel, Spafford, & Schwartz, 2003, p.
88)
Field Purpose Notes
#1 Specifies encryption 1 specifies MD5, 2 specifies
algorithm
Blowfish.
#2 Salt Limited to 16 characters.
#3 Encrypted password hash Hash value without salt.
2.1.3 Password Recovery Options
In forensic investigations, investigators may come across many items of interest
which may be password protected. Therefore, investigators need to overcome
password protection to gain information of evidentiary value. Many types of items
may be password-protected, and many different methods can be used for
obtaining the password. The method to be used depends on the circumstance. For
example, if a law enforcement agency has online access to the criminal‘s
computer, they may make use of a key logger to obtain the relevant password.
Likewise, if the law enforcement agency has seized the computer, the password
can be cracked by using various password cracking techniques. Thus, different
password-protected items require different methods for password recovery. Some
of the types of password-protected items along with their potential methods for
recovery are discussed in this section.
The various options for password recovery are as follows:
i) Jumping/pulling the battery: Computers may contain CMOS or
BIOS passwords at startup. If so, recovering the CMOS password
is necessary in order to boot the computer. Many methods may be
used to bypass the CMOS password lock or recover the password.
These methods include, but are not limited to: removing the
CMOS battery, manipulating the BIOS jumper settings, short-
circuiting the chip, interrogating the suspect, or trying out the
default BIOS passwords (Britz, 2009, p. 331).
ii) Cracking: Some documents, software and compressed files may
contain passwords. These passwords also serve the purpose of
11