±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35980
New Yesterday: 5 Visitors: 369

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

keyword search on encrypted drive image

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

aly786
Newbie
 

keyword search on encrypted drive image

Post Posted: May 16, 19 05:44

Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??  
 
  

mrevoluter
Newbie
 

Re: keyword search on encrypted drive image

Post Posted: May 16, 19 08:40

It's not possible as of my experience, first decrypt it and then you can carry on.
If possible!!! Kindly someone do reply.  
 
  

hectic_forensics
Member
 

Re: keyword search on encrypted drive image

Post Posted: May 16, 19 13:07

- aly786
Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??


It's possible... but it wouldn't achieve much. Shocked  
 
  

fissa
Member
 

Re: keyword search on encrypted drive image

Post Posted: May 21, 19 19:52

- hectic_forensics
- aly786
Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??


It's possible... but it wouldn't achieve much. Shocked

I must agree, no way to index 'the image'.  
 
  

Passmark
Senior Member
 

Re: keyword search on encrypted drive image

Post Posted: May 22, 19 06:48

I am not sure how you can be in forensics and ask this type of question?

What do people think encryption does?  
 
  

jaclaz
Senior Member
 

Re: keyword search on encrypted drive image

Post Posted: May 22, 19 10:04

- Passmark

What do people think encryption does?

It changes letters and words into a sequence of queer looking symbols, doesn't it? Confused

At least this is what seemingly happens whenever I open an encrypted file in Notepad. Wink

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

mansiu
Senior Member
 

Re: keyword search on encrypted drive image

Post Posted: Jun 19, 19 10:50

if the disk is used and then bitlocker is enabled with used space only, then there is a possibility that previous existing file data were not encrypted.
in this sense, keyword search will probably be able to find those data on the encrypted drive before decryption took place  
 

Page 1 of 1