Does anyone know, which forensic tools will take a decrypted image of devices that are encrypted with Pointsec Protector.
Regards
Dean
deanbarnes,
Could you please be more specific. Are you talking about obtaining an image of a decrypted device?
I need to take a decrypted image of a usb device that has been encrypted with Pointsec Protector. We currently use Encase, which does not support Pointsec in its decryption module. Therefore I am looking to see if there are other tools available that will provide this functionality. I have the encryption password, but still cannot read the encrypted file from within encase.
I don't have any experience with Pointsec Protector but my guess is that you should be able to acquire a logical drive. Most likely the software uses transparent on the fly encryption/decryption. You will need Pointsec Protector software installed on the computer and have a password.
If Operating System can see the decrypted content, put Helix cd in and get dd image or use FTK light to get the image of a logical drive.
PM me if any questions