Introduction

Elcomsoft Forensic Disk Decryptor (EFDD) offers forensic specialists an easy way to obtain complete real-time access to information stored in popular crypto containers. Supporting desktop and portable versions of most popular disk encryption software, the tool can decrypt all files and folders stored in crypto containers or mount encrypted volumes as new drive letters for instant access. Decryption keys can be acquired by analyzing hibernation files or memory dumps (memory dumping feature is built-in into the product) or obtained via a FireWire attack. The program can also decrypt or mount disks if the password is known, or recovery key is available.

The tool provides near-instant acquisition with two options to access the content of encrypted volumes. With full decryption, the entire content of the protected disk is decrypted, providing investigators with full, unrestricted access to all information stored on encrypted volumes. For fast, real-time access to protected information, the encrypted volume can be mounted as a new drive letter. In this mode, the files will be decrypted on the fly.

Elcomsoft Forensic Disk Decryptor supports three ways to acquire decryption keys used to access the content of encrypted containers. Depending on whether the PC is running or turned off, locked or unlocked, the keys can be obtained by analyzing a memory dump or hibernation file, or by performing an attack via the FireWire protocol in order to obtain a live memory dump. In order to obtain the decryption keys, the encrypted volume must be mounted on the target PC.

Elcomsoft Forensic Disk Decryptor supports flash drives and removable media encrypted with BitLocker-to-Go, and recognizes encrypted volumes and full disk encryption of all supported types. Raw (DD) and EnCase (.E01) disk images are also supported.

Supported crypto containers:

•BitLocker

•PGP (volume and full-disk encryption)

•TrueCrypt

•VeraCrypt

•LUKS (password hash extraction only)

•BestCrypt (password hash extraction only)

The program that is licensed to you is absolutely legal and you can use it provided that you are the legal owner of all files or data you are going to recover through the use of our software or have permission from the legitimate owner to perform these acts. Any illegal use of our software will be solely your responsibility. Accordingly, you affirm that you have the legal right to access all data, information and files that have been hidden.

You further attest that the recovered data, passwords and/or files will not be used for any illegal purpose. Be aware password recovery and the subsequencial data decryption of unauthorized or otherwise illegally obtained files may constitute theft or another wrongful action and may result in your civil and (or) criminal prosecution.