Forensic Access to Encrypted Files

Hi all, a lot of people rely on encrypting data on the hard drive in order to keep the files that they want private, well private. There is a new tool in the arsenal of those that would want to prevent you from keeping those files secret using TrueCrypt or BitLocker or similar. The tools creator claims some big items such as “Extracts all the keys from a memory dump at once” and “Zero-footprint operation leaves no trace”.

If even half of what they are claiming is true that would be an amazing and scary tool to have out in the wild. It does say that it recovers the keys from memory dumps so making those secure couldn’t hurt.

Tool: http://www.elcomsoft.com/efdd.html

Until next time,
TechStop (JW)