ADF's Quick-Saved Credentials profile is a powerful profile that extracts the usernames and passwords from Web Browsers and is built so it will not trigger antivirus applications when attempting to collect web credentials. This makes the investigator's job easier on-scene, requires less interaction with the device, and allows for more records to be parsed thereby giving the computer forensic investigator the ability to quickly collect critical information for their investigation.
Learn how to use the ADF Quick Saved Credentials Profile to uncover Web credentials in this short 2-minute video tutorial. Collecting saved credentials quickly gives access to accounts that may have been previously unknown and allows investigators to do preservation orders and search warrants.
Quick - Saved Credentials Search Profile
The ADF Quick - Saved Credentials Search Profile is a powerful profile that extracts the usernames and passwords from Web Browsers. It can be run independently in its own profile or selected on any computer forensic Search Profile that is going to run on a Live Windows OS. It can also be selected as a capture when your Collection Key is prepared without Search Profiles.
Saving credentials in a web browser has become commonplace as credentials and passwords are required to be more difficult and updated on a regular cycle. Users have found they need a way to manage the credentials that are easy to use and do not require any amount of added time. Criminals can have a trait in which they want instant access to their contraband without it being difficult or have a risk level where the contraband can be lost instantly.
Once an investigator has collected web credentials, they can filter the results on a specific URL and see how many different accounts were accessed on this device. Is the user letting others use the computer or does the user have multiple accounts? I have had several Cybertips where the user has multiple accounts on one platform.
