Showing posts with label EnCase Evidence File. Show all posts
Showing posts with label EnCase Evidence File. Show all posts

Evidence Encryption in the Post-TrueCrypt Era

Ken Mizota


In the news last week, the anonymous developers of TrueCrypt very publicly announced the discontinuation of TrueCrypt development, and declared TrueCrypt "not secure." The vagaries and abruptness of the announcement have caused a disturbance in the interweb at large. A search on "TrueCrypt" yields no less than 27,000 hits categorized as "News."

TrueCrypt has been a double-edged sword for digital investigators. On one edge, TrueCrypt's wide availability means it has been used to hide data from the eyes of investigators. Full disk, container, and hidden container encryption have created "game over" situations for investigators for years. Attendees of Guidance Software's Training courses learn about common uses of TrueCrypt and practical techniques to deal with them, including use of EnCase with tools like Passware.