If you got the memory dump file or hibernation file, you can start the key search easily and at any time.
The encryption key can only be extracted from the hibernation file or memory dump if the container or disk has been mounted by the user. Encryption keys can be acquired by three means: It needs to be noted that local access to the system is required for one of the methods used by the program to work. The company states that it can decrypt the information stored in PGP, Bitlocker and TrueCrypt disks and containers.
While it is important to pick a secure password during setup to prevent third parties from successfully guessing or brute forcing the password, it is important to note that there may be other means to gain access to the data.Įlcomsoft has just released its Forensic Disk Decryptor tool.
