Happy DPAPI!
Last October, I participated as speaker at the SANS DFIR Summit in Prague . It was a great meeting and I am very happy to have been able to participate. My speech was focused on DPAPI , the Windows Data Protection API , and how it could be used during a post-mortem digital investigation to access protected information: overcoming system's security it's sometimes necessary to access data otherwise not available. I like to call this "process" ODI , Offensive Digital Investigations . I want to be brief, skipping any DPAPI introduction and only providing some links for readers who don't know what DPAPI might be. Consider simply the fact that the technology was introduced with Windows2000(!!) and you and/or your system/applications use it every day... Moreover, if you wonder how wifi passwords are protected, how IE or Chrome treats saved credentials, how Dropbox encrypts its databases, how iCloud protects user credentials, how EFS ( Encrypting File System ) gets