Forensic Recovery of Fully Encrypted Volume
In this paper, the authors aimed at analyzing the efficiency of decrypting the bit locked volumes in PIN only mode. Based on the findings this paper considers the issue of decrypting the bit locked volumes in PIN only mode. The main drawback of the full volume encryption application is that it leaves several copies of the key used for encrypting the drive in the physical memory. This paper deals with the recovery of encryption key from the physical memory in case of live system.
Subscribe to the Cybersecurity Insider Newsletter
Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays