Elcomsoft Forensic Disk Decryptor 2.20.1011

Elcomsoft Forensic Disk Decryptor provides all the methods available to have access to the information stored in the drive and the drive is BitLocker, FileVault 2, PGP, TrueCrypt and VeraCrypt. The tool allows to use password simple text, key escrow or key recovery, as well as the key binary be extracted from image memory, or the file hibernation of the computer. FileVault 2 keys recovery can be extracted from iCloud with Elcomsoft Phone Breaker, while the lock BitLocker recovery are available in Active Directory or in Microsoft account of the user.

Elcomsoft Forensic Disk Decryptor - analyze the drive and give access

With the detector fully automatic volume encryption and encoding settings, the specialist will just provide the path to the container or disk image is encrypted. Elcomsoft Forensic Disk Decryptor will automatically search for, identify and display the volume of coding and details about encoding settings their respective.

Elcomsoft Forensic Disk Decryptor can automatically decrypt the entire content of the container is encrypted, give the investigators full access, not limited to all information stored on the encrypted volume. In real-time mode, Elcomsoft Forensic Disk Decryptor mounts the encrypted volume as a new drive letter on your PC investigator. In this mode, the forensic expert is entitled to access, real-time to information is protected. Information read from the disk and the volume is mounted be decoded quickly in real time.

Features of Elcomsoft Forensic Disk Decryptor

Elcomsoft decoder disk forensic need the encryption key to access protected information stored in the container contains electronic money. The encryption key can be extracted from the files, or hibernation files, memory dump obtained while the volume encoder is mounted. There are three ways to get the encryption key original:

By analyzing the file, hibernation (if the PC being analyzed is turned off);

By analyzing a file memory. Can be obtained memory dump of the PC running tool image integrated memory.

By performing an attack FireWire (PC being analyzed must be running with the encrypted volume is mounted). Need to have a free tool on your PC investigator to perform attacks FireWire (for example: Inception).

By taking a memory dump with tool image RAM integrated

FileVault 2 volume, PGP and BitLocker can be decoded or mounted by using key escrow (Key recovery).