Acquires decryption keys from RAM dumps, hibernation files.Extracts encryption metadata from TrueCrypt, VeraCrypt, BitLocker, FileVault (HFS+/APFS), PGP Disk, BestCrypt and LUKS/LUKS2 encrypted disks, Jetico BestCrypt 9 containers.Can decrypt and mount FileVault 2, PGP Disk and BitLocker volumes using escrow keys (Recovery Key).Works with physical disks, logical partitions and RAW/DD/EnCase.Supports encrypted containers and full disk encryption.BitLocker: supports XTS-AES encryption, TPM and TPM+password configurations.Supports removable media encrypted with BitLocker To Go.Instantly mounts or completely decrypts BitLocker (including portable and TPM configurations), FileVault 2, PGP Disk, VeraCrypt and TrueCrypt volumes.True zero-footprint operation, leaving no traces and making no changes to the contents of encrypted volumes.Decrypts information stored in popular crypto containers.If neither the encryption key nor the recovery key can be extracted, EFDD can extract meta data from the encrypted container to let Elcomsoft Distributed Password Recovery do its job. FileVault 2 recovery keys can be extracted from iCloud with Elcomsoft Phone Breaker, while BitLocker recovery keys are available in Active Directory or in the user’s Microsoft Account. The toolkit allows using the volume's plain-text password, escrow or recovery keys, as well as the binary keys extracted from the computer’s memory image or hibernation file. A Fully Integrated Solution for Accessing Encrypted VolumesĮlcomsoft Forensic Disk Decryptor offers a range of methods for gaining access to information stored in encrypted BitLocker, FileVault 2, LUKS, LUKS2, PGP Disk, TrueCrypt and VeraCrypt disks and volumes, and Jetico BestCrypt 9 containers.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |