PHElcomsoft Forensic Disk Decryptor 2.21.1036 | 42 Mb
Elcomsoft Forensic Disk Decryptor is a digital forensics utility designed to help investigators access data stored in encrypted disks, volumes, and disk images. It supports several widely used full-disk encryption technologies and provides multiple methods for unlocking protected storage using available credentials, recovery keys, or extracted encryption keys.
The software automatically detects supported encrypted volumes and identifies their encryption settings, simplifying forensic analysis. Investigators can either decrypt an entire volume for unrestricted access or mount it as an unlocked drive for immediate examination without permanently altering the original evidence.
When decryption keys are unavailable, the application can extract the metadata required for password recovery workflows, allowing compatible recovery tools to perform dictionary, mask, permutation, or brute-force attacks against the encrypted container.
Key Features:
- Access encrypted BitLocker, FileVault 2, PGP, TrueCrypt, and VeraCrypt volumes.
- Automatically detect encrypted disks and identify encryption settings.
- Decrypt entire disks, volumes, or disk images.
- Mount encrypted volumes as unlocked virtual drives for real-time access.
- Support recovery keys, escrow keys, passwords, and extracted binary encryption keys.
- Extract encryption metadata for password recovery when keys are unavailable.
- Analyze memory dumps and hibernation files to obtain encryption keys.
- Includes built-in RAM imaging capabilities for memory acquisition.
- Supports forensic workflows with physical drives and raw disk images.
- Compatible with recovery-key-based access for BitLocker, FileVault 2, and PGP volumes.
System Requirements:
Windows Server 2008
Windows 7 (32 bit)
Windows 7 (64 bit)
Windows 8
Windows 8.1
Windows 10
Windows Server 2012
Windows 2016
Home Page-
Code:
https://www.elcomsoft.com/