Hi all. I am looking for a tool to deal [forensically examine] with Truecrypt, both encrypted files and full hard drive encryption. I know that EnCase now comes with integrated Passware to address this. There is also Elcomsoft software that can decrypt Truecrypt Volumes etc. Can anyone experienced with both Encase + Passware and Elcomsoft recommend the best solution? We have EnCase Enterprise lic.
Thanks in advance.
I know that EnCase now comes with integrated Passware to address this.
Just to clarify for you, Passware is a separate product that does have integration with EnCase Forensic. You would need to purchase Passware separately. But to answer, this integration is also available with EnCase Enterprise (aka Endpoint Investigator).
… and to further the details, EnCase integration is more of a file interchange between Passware and EnCase. It is not a memory based, application to application exchange.
The support of full volume encryption solutions in EnCase is not Passware dependent.