Live System Analysis: Discovering Encrypted Disk Volumes

The wide spread of full-disk encryption makes live system analysis during incident response a challenge, but also an opportunity. A timely detection of full-disk encryption or a mounted crypto container allows experts take extra steps to secure access to encrypted evidence before pulling the plug. What steps are required and how to tell if the system is using full-disk encryption? “We have a tool for that”.

👉 https://blog.elcomsoft.com/2020/07/live-system-analysis-discovering-encrypted-disk-volumes/

#fde #encrypteddisks #cryptocontainer #bitlocker #truecrypt #pgp #luks #filevault #forensictool