Once you open the disk (or disk image), EFDD scans the disk (or image) and identifies all encrypted volumes available on that disk. You begin with launching Elcomsoft Forensic Disk Decryptor 2.0 and opening a physical disk or disk image (did I mention we now support EnCase. But that’s not everything! We completely revamped the way you use the tool by automatically identifying all available encrypted volumes, and providing detailed information about the encryption method used for each volume. E01 and encrypted DMG images are now available. Plain text passwords and recovery keys, a Microsoft-signed kernel-level RAM imaging tool, the highly anticipated portable version and support for the industry-standard EnCase. With today’s release, Elcomsoft Forensic Disk Decryptor gets back on its feets, including everything that was missing in earlier versions. It didn’t come with a memory imaging tool of its own, making its users rely on third-party solutions. It couldn’t use plain text passwords to mount or decrypt encrypted volumes, and it didn’t support escrow (recovery) keys. What Elcomsoft Forensic Disk Decryptor did not do until now was pretty much everything else. We could find and extract that key by analyzing the memory dump or hibernation files. With this tool, one could extract data from an encrypted disk volume (FileVault 2, PGP, BitLocker or TrueCrypt) by utilizing the binary encryption key contained in the computer’s RAM. It’s been a long while since we made an update to one of our most technically advanced tools, Elcomsoft Forensic Disk Decryptor (EFDD).
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |