Live System Analysis: Discovering Encrypted Disk Volumes
The wide spread of full-disk encryption makes live system analysis during incident response a challenge, but also an opportunity. A timely detection of full-disk encryption or a mounted crypto container allows experts take extra steps to secure access to encrypted evidence before pulling the plug. What steps are required and how to tell if the system is using full-disk encryption? “We have a tool for that”.
👉 https://blog.elcomsoft.com/2020/07/live-system-analysis-discovering-encrypted-disk-volumes/
#fde #encrypteddisks #cryptocontainer #bitlocker #truecrypt #pgp #luks #filevault #forensictool
The wide spread of full-disk encryption makes live system analysis during incident response a challenge, but also an opportunity. A timely detection of full-disk encryption or a mounted crypto container allows experts take extra steps to secure access to encrypted evidence before pulling the plug. What steps are required and how to tell if the system is using full-disk encryption? “We have a tool for that”.
👉 https://blog.elcomsoft.com/2020/07/live-system-analysis-discovering-encrypted-disk-volumes/
#fde #encrypteddisks #cryptocontainer #bitlocker #truecrypt #pgp #luks #filevault #forensictool
Elcomsoft System Recovery: a Swiss Army Knife of Desktop Forensics
Accessing a locked system is always a challenge. Encrypted disks and encrypted virtual machines, encrypted files and passwords are just a few things to mention. In this article we are proposing a straightforward workflow for investigating computers in the field.
Note: you may be able to perform live system analysis if the computer being investigated is turned on. Our scenario assumes that the computer is initially powered off, or powered on and locked/inaccessible.
👉 https://blog.elcomsoft.com/2020/11/elcomsoft-system-recovery-a-swiss-army-knife-of-desktop-forensics/
#encrypteddisks #virtualmachines #passwords #livesystemanalysis
Accessing a locked system is always a challenge. Encrypted disks and encrypted virtual machines, encrypted files and passwords are just a few things to mention. In this article we are proposing a straightforward workflow for investigating computers in the field.
Note: you may be able to perform live system analysis if the computer being investigated is turned on. Our scenario assumes that the computer is initially powered off, or powered on and locked/inaccessible.
👉 https://blog.elcomsoft.com/2020/11/elcomsoft-system-recovery-a-swiss-army-knife-of-desktop-forensics/
#encrypteddisks #virtualmachines #passwords #livesystemanalysis