In the real-time mode, Elcomsoft Forensic Disk Decryptor mounts the encrypted volume as a new drive letter on the investigator's PC. Real-Time Access to Encrypted Information Both operations can be done with volumes as attached disks (physical or logical) or raw images for FileVault 2, PGP and BitLocker, decryption and mounting can be performed using recovery key (if available).Įlcomsoft Forensic Disk Decryptor can automatically decrypt the entire content of the encrypted container, providing investigators with full, unrestricted access to all information stored on encrypted volumes Elcomsoft Forensic Disk Decryptor will automatically search for, identify and display encrypted volumes and details of their corresponding encryption settings.Īccess is provided by either decrypting the entire content of an encrypted volume or by mounting the volume as a drive letter in unlocked, unencrypted mode. With fully automatic detection of encrypted volumes and encryption settings, experts will only need to provide path to the encrypted container or disk image.
If neither the encryption key nor the recovery key can be extracted, EFDD can extract meta data from the encrypted container to let Elcomsoft Distributed Password Recovery do its job. FileVault 2 recovery keys can be extracted from iCloud with Elcomsoft Phone Breaker, while BitLocker recovery keys are available in Active Directory or in the user's Microsoft Account. The toolkit allows using the volume's plain-text password, escrow or recovery keys, as well as the binary keys extracted from the computer's memory image or hibernation file. Elcomsoft Forensic Disk Decryptor 2.19.999 | 46.9 MbĮlcomsoft Forensic Disk Decryptor offers all available methods for gaining access to information stored in encrypted BitLocker, FileVault 2, PGP, TrueCrypt and VeraCrypt disks and volumes.
0 kommentar(er)
