You use TrueCrypt, PGP or BitLocker to encrypt your disks? You will probably not like the news…
ElcomSoft released a very interesting tool that he calls it Forensic Disk Decryptor and can be used successfully to access information stored on TrueCrypt, PGP, and BitLocker encrypted discs.
Existing solutions such as Elcomsoft Distributed Password Recovery to recover the password can attempt to access encrypted discs by discovering brute-force attack codes.
However, the new application Forensic Disk Decryptor provides a new approach. Analyzes memory dumps as well as computer hibernation files by searching for decryption keys.
The only requirement is that the computer be running with the encrypted disks already unlocked (already mounted). Decryption keys can be found even if the computer is in hibernation mode.
"The main weakness of encryption is the human factor. Users typically use simple passwords on encrypted volumes to gain on-the-fly access to encrypted data. "No one likes to type large, complex passwords every time they have to read or write a file," says Vladimir Katalov, CEO of ElcomSoft.
The application Forensic Disk Decryptor is immediately available, but costs about $ 300 (233 euros). The program runs on most Windows operating systems and supports TrueCrypt, BitLocker To Go, BitLocker, and PGP disk encryption.