Elcomsoft Forensic Disk Decryptor v2.17.916 | 38 MB | Language: English
Instantly access data stored in encrypted BitLocker, FileVault 2, PGP, TrueCrypt and VeraCrypt containers. The tool extracts cryptographic keys from RAM captures, hibernation and page files or uses plain-text password or escrow keys to decrypt files and folders stored in crypto containers or mount encrypted volumes as new drive letters for instant, real-time access.
New features:
Built-In Memory Imaging Tool
A forensic-grade memory imaging tool is included with Elcomsoft Forensic Disk Decryptor. The tool uses zero-level access to computers volatile memory in order to create the most complete memory image. The supplied RAM imaging tool operates through a custom kernel-level driver. The driver is digitally signed with a Microsoft signature, making it fully compatible with all 32-bit and 64-bit versions of Windows from
Windows 7 and up to the latest Windows 10 update.
EnCase .E01 Support and Portable Version
Elcomsoft Forensic Disk Decryptor 2.0 now fully supports EnCase images in the industry-standard .EO1 format, as well as encrypted DMG images. In addition, Elcomsoft Forensic Disk Decryptor can be used to create a portable installation on a user-provided USB flash drive. The portable installation can be used to image computers volatile memory and/or decrypt encrypted volumes.
A Fully Integrated Solution for Accessing Encrypted Volumes
Elcomsoft Forensic Disk Decryptor offers all available methods for gaining access to information stored in encrypted BitLocker, FileVault 2, PGP, TrueCrypt and VeraCrypt disks and volumes. The toolkit allows using the volume’s plain-text password, escrow or recovery keys, as well as the binary keys extracted from the computers memory image or hibernation file. FileVault 2 recovery keys can be extracted from iCloud with Elcomsoft Phone Breaker, while BitLocker recovery keys are available in Active Directory or in the users Microsoft Account.
If neither the encryption key nor the recovery key can be extracted, EFDD can extract meta data from the encrypted container to let Elcomsoft Distributed Password Recovery do its job.
Full Decryption, Instant Mount or Attack
With fully automatic detection of encrypted volumes and encryption settings, experts will only need to provide path to the encrypted container or disk image. Elcomsoft Forensic Disk Decryptor will automatically search for, identify and display encrypted volumes and details of their corresponding encryption settings.
Access is provided by either decrypting the entire content of an encrypted volume or by mounting the volume as a drive letter in unlocked, unencrypted mode. Both operations can be done with volumes as attached disks (physical or logical) or raw images; for FileVault 2, PGP and BitLocker, decryption and mounting can be performed using recovery key (if available).
Full Decryption
Elcomsoft Forensic Disk Decryptor can automatically decrypt the entire content of the encrypted container, providing investigators with full, unrestricted access to all information stored on encrypted volumes
Real-Time Access to Encrypted Information
In the real-time mode, Elcomsoft Forensic Disk Decryptor mounts the encrypted volume as a new drive letter on the investigators PC. In this mode, forensic specialists enjoy fast, real-time access to protected information. Information read from mounted disks and volumes is decrypted on-the-fly in real time.
No Decryption Key and No Recovery Key?
If neither the decryption key nor the recovery key is available, Elcomsoft Forensic Disk Decryptor will extract metadata necessary to brute-force the password with Elcomsoft Distributed Password Recovery.
Elcomsoft Distributed Password Recovery can attack plain-text passwords protecting the encrypted containers with a range of advanced attacks including dictionary, mask and permutation attacks in addition to brute-force. (Note: VeraCrypt is currently not supported.)
What’s new: https://www.elcomsoft.com/PR/efdd_180131_en.pdf
Homepage: http://elcomsoft.co.uk/
