Elcomsoft Extracts Skype Histories from Microsoft Account

ElcomSoft Co. Ltd. updates Elcomsoft Phone Breaker, the company’s forensic extraction tool. Version 9.40 gains the ability to remotely extract Skype conversation histories, attachments and metadata from the user’s Microsoft Account. In addition to existing data, the tool can extract metadata (such as the file names, sizes and user IDs) of deleted chats and attachments including those that have been purged from Microsoft servers more than 30 days ago.

“With passcode protection and end-to-end encryption of today’s mobile devices, cloud-based analysis is often the only way to access evidence”, says Vladimir Katalov, ElcomSoft President and CEO. “We pioneered cloud extraction, and continue to expand the possibilities available to hi-tech forensic specialists. In our updates, we strive to cover the extraction of essential evidence from the widest range of sources.”

Background

Skype is one of the world’s most popular instant messaging apps. Back in 2016, Skype was reported to have more than 300 million active daily users, with as many as 1.33 billion user accounts in total. The estimated 12% year over year growth of the Skype user base allows ElcomSoft to estimate the current number of Skype active daily users to roughly 420 million, while the total number of Skype accounts is estimated to 1.55 billion.

Microsoft synchronizes Skype conversations across devices with a cloud backend. The cloud sync feature is automatic and cannot be disabled. The text chats are stored on Microsoft servers indefinitely unless manually deleted by the user, while attachments are only kept for the maximum period of 30 days. After the 30-day retention period, any files users send or received are automatically deleted from the server. However, Microsoft still retains information about these files (the metadata), allowing experts to find out the name and type of attachments, file sizes, as well as the date and time.

Extracting Skype Chats and Attachments from Microsoft Account

Skype synchronizes chats, text messages and files sent and received with the Microsoft Account backend. Accessing Skype conversation histories by performing a forensic analysis of the user’s Microsoft Account is often the fastest and easiest way to obtain valuable evidence.

Elcomsoft Phone Breaker 9.40 adds support for Skype acquisition, while Elcomsoft Phone Viewer is updated to allow conveniently analyzing the downloaded Skype data. The pair of tools enables experts to download and view conversation histories, messages, media files, contact lists and metadata directly from the user’s Microsoft Account. In addition to existing data, Elcomsoft Phone Breaker can extract metadata for files and conversation histories deleted within the last 30 days. For chats and media files purged from Skype servers, the tool can obtain metadata such as the date and time, size, file name, sender, and chat name.

About Elcomsoft Phone Breaker

Elcomsoft Phone Breaker is an all-in-one mobile acquisition tool to extract information from a wide range of sources. Supporting offline and cloud backups created by a wide range of mobile devices, the tool can extract and decrypt user data including cached passwords and synced authentication credentials from local backups.

Pricing and Availability

Elcomsoft Phone Breaker 9.40 is immediately available for Windows and macOS. This update is free to existing users with currently valid licenses. Screen Time support is exclusively available in the $799 Forensic edition. The affordable Professional edition is available to individual and business customers for $199 with support for a limited set of data categories. Local pricing may vary. Support for Two-Factor Authentication is available in all editions.

System Requirements

Elcomsoft Phone Breaker supports Windows 7, 8, 8.1, and Windows 10 as well as Windows 2008, 2012 and 2016 Server. The Mac version supports macOS X 10.8 and newer. Elcomsoft Phone Breaker operates without Apple iTunes or BlackBerry Link being installed. In order to access iCloud Keychain, Health and Messages, Windows users must have iCloud for Windows installed, while Mac users must run macOS 10.12 or newer.

About ElcomSoft Co. Ltd.

Founded in 1990, ElcomSoft Co. Ltd. develops state-of-the-art computer forensics tools, provides computer forensics training and computer evidence consulting services. Since 1997, ElcomSoft has been providing support to businesses, law enforcement, military, and intelligence agencies. ElcomSoft tools are used by most of the Fortune 500 corporations, multiple branches of the military all over the world, foreign governments, and all major accounting firms.