Who Sabu Howard Actually Is
Sabu Howard runs ElcomSoft, a company that builds forensic and recovery tools. His background isn't in marketing. It's in reverse engineering, data recovery, and mobile forensics, which means he has spent more time debugging why an iPhone backup refused to decrypt than most people have spent sleeping. The tools his team produces are used by law enforcement agencies, corporate investigators, and yes, plenty of independent researchers who need to pull data out of devices that modern operating systems would rather keep locked down. If you are looking for a traditional biography, there are interviews and conference talks that cover his trajectory. He started in the early 2000s when mobile device forensics was basically guesswork and brute force. Most of what we now consider standard procedure, pulling backups from iOS devices, extracting WhatsApp archives, cracking password-protected ZIP files, recovering deleted partitions from encrypted drives, came from people actually sitting in front of the hardware and watching it fail. Howard was one of those people. The name gained traction through ElcomSoft's forensic toolkit line and his presentations at events like DEF CON and various law enforcement technology symposia. What separates his approach from the typical cybersecurity product launch is the level of OS-level detail in the documentation. Most tool vendors write manuals that assume you already understand the underlying architecture. Howard's materials tend to explain why a decryption key fails, what iOS version broke a particular extraction method, and which jailbreak state is required for a specific payload. That kind of transparency is unusual in an industry that routinely hides limitations behind licensing screens.
What ElcomSoft Tools Actually Do
The company focuses on four main categories: disk and partition recovery, mobile device forensics, password recovery, and cloud data extraction. Each category has a clear use case and a clearly defined failure boundary. Disk Recovery tools handle scenarios where the partition table is corrupted, the drive has been formatted, or the filesystem metadata is damaged. These are not magic recovery suites that scan forever. They work by reading raw sectors and reconstructing known filesystem structures. When you hand them a drive with physical damage, they will tell you that immediately and stop. That honesty matters because most competitors will just consume hours of your time before failing. Mobile Forensics tools target iOS and Android extraction. iOS is the harder target because Apple changes encryption key derivation between versions. ElcomSoft's iOS Forensic toolkit has historically kept pace with major iOS releases by updating its dictionary attack engines and its handling of backup encryption. Android varies wildly by manufacturer, which means any tool claiming universal Android support is lying to you. The practical reality is that extraction success depends on whether the device is rooted, whether USB debugging is enabled, and whether you can bypass the lock screen, which is where credential recovery tools come in.
Password Recovery covers archive passwords, document passwords, and wireless network keys. The main technique is dictionary and mask-based attacks. They are not efficient against long, random passphrases generated by modern password managers. A 12-character mixed-case alphanumeric password with symbols is effectively uncrackable by dictionary methods regardless of which tool you use. The tools work well for human-chosen passwords, which remain the overwhelming majority of real-world cases.
Get the Full Details
How to Approach a Real Forensic Extraction
I ran into a situation last year involving an iPhone that had been restored from an encrypted backup but the user had forgotten the backup password. The device itself was accessible with the passcode, but the backup data, which contained years of health and location records, was locked. Standard iTunes restores failed because the system requires the original backup password, not the device passcode. These two credentials are not related, which most people do not realize until they hit that wall. The workaround was to use a credential recovery tool to brute-force the backup password by extracting the relevant key material from the device's keychain through the iOS backup protocol. This is not a fast process. A six-character numeric backup PIN typically completes in under an hour on a mid-range GPU. A nine-character mixed passphrase could take days or longer depending on the attack surface. In this case, the backup PIN turned out to be a birth year formatted as YYYY followed by two digits, which reduced the search space dramatically once we identified the pattern. Recovery took roughly forty-five minutes after the pattern was confirmed. The lesson here is that successful forensics work depends far more on understanding the credential format than on having the fastest hardware. Knowing how users actually create passwords and PINs will save you weeks of wasted computation.
Common Pitfalls People Run Into
The first mistake is assuming that any tool labeled "forensic" will produce court-admissible evidence. ElcomSoft tools, like most commercial forensic suites, are designed for investigation and recovery, not necessarily for maintaining a strict chain of custody. If you need admissibility, you should be using WriteBlockers, hashing every extracted file, and documenting every command. No single tool handles that automatically. The second mistake is ignoring OS version mismatches. iOS updates frequently change backup encryption parameters. Android OEMs fragment the OS to the point where a method that works on a Pixel will not work on a Samsung device running the same Android version. Always verify version compatibility before starting an extraction, and check the vendor's release notes for known regressions. The third mistake is underestimating time requirements for brute-force operations. A typical desktop system with a single GPU might test two to five million iOS backup password combinations per second for short numeric PINs. Longer passwords drop that throughput significantly due to the increased state space. Planning your timeline around worst-case scenarios prevents schedule failures.
When These Tools Do Not Help
Password recovery tools cannot recover truly random 256-bit keys. Hardware security modules, secure enclaves, and modern full-disk encryption schemes are designed specifically to resist this class of attack. If a device uses a strong cryptographic implementation and the user chose a high-entropy credential, the realistic answer is that the data is not recoverable without the key. Some vendors will imply otherwise, but the mathematics do not support those claims. Cloud extraction tools also have strict limitations. They operate within the terms of service of the platforms they target. Attempting to automate access beyond what the platform API permits can result in account suspension. Additionally, platforms like Google and Apple regularly patch bypass methods, so a technique that worked six months ago may already be ineffective today. Staying current with vendor updates is mandatory, not optional. Physical disk recovery fails on drives with firmware-level corruption, severely degraded platters, or flash NAND that has entered a failure mode where the controller refuses to return raw sectors. In those cases, the only option is a professional cleanroom service, which costs significantly more and still offers no guarantee of success.
Practical Recommendations
If you are evaluating ElcomSoft products, start by identifying your exact target platform and version. Check the release notes. Test on a non-production device if possible. Budget time for brute-force operations realistically. Document your process from the beginning. Keep raw images and hash values before you attempt any recovery, in case you need to verify integrity later. The broader field of digital forensics moves fast. Tools that are state-of-the-art today become obsolete within a year as operating systems harden their defenses. Continuous learning and hands-on practice with current device models matters more than accumulating licenses for outdated software.
