Forensic research

Based on our reverse-engineering we show how DPAPI, the Windows API for safe data storage on disk work. Our analysis reveals that it is possible to recover all previous passwords used by any user on a system. We have implemented DPAPI data decryption and previous password extraction in a free and open-source tool called DPAPIck.

We present Kartograph our memory analyzer designed to perform live memory attacks against various games. We demonstrate how to use Kartograph to create undetectable map-hacks against various populars RTS such as Civ 4, Warcraft 3 and Supreme commander 2 in a matter of minutes.

OWADE is the first open source tool dedicated to cloud forensics.