[Windows] Working with 1Password containers

1Password is a popular cross-platform service to keep and synchronize passwords to various accounts between multiple computers and mobile devices. Available for OS X, Windows, Android and iOS, 1Password employs users’ Dropbox or iCloudDrive accounts to keep and sync passwords. In iOS, 1Password password databases are also backed up to offline (iTunes) or iCloud backups.

1Password containers are protected with a user-defined master password. Elcomsoft Phone Breaker for Windows OS can attack master passwords protecting 1Password containers retrieved from the following storages:

▪Unencrypted iTunes backups

▪iTunes backups decrypted with the help of EPB

▪iCloud backups

▪encryptionKeys.js files. They are stored inside the *.agilekeychain bundle that can be found in the following locations:

oIf you use Dropbox to synchronize 1Password data, the *.agilekeychain bundle is located in your Dropbox folder. By default it's C:\Users\<user name>\Documents\Dropbox\…\1Password.agilekeychain.

oIf you don't use Dropbox with 1Password, the keychain is created in C:\Users\<user name>\Documents\1Password\1Password.agilekeychain by default.

▪profile.js files. They are stored inside the *.opvault bundle that can be found in the following locations:

oIf you use Dropbox to synchronize 1Password data, the *.opvault bundle is located in your Dropbox folder. By default it's C:\Users\<user name>\Documents\Dropbox\…\1Password.opvault.

oIf you don't use Dropbox with 1Password, the keychain is created in C:\Users\<user name>\Documents\1Password\1Password.opvault by default.