How to use a RAM image to decrypt "encrypted containers"

CopyRight · 2014-02-10T09:50:38Z

Hey Folks,Today something different, an imaginery scenario that might have occured to many of you guys that will definetly be very interesting to discuss.Okay , so we run a "Encrypted disk detecter script or any other piece of code that helps determine whether a live machine "logged on" is indeed encrypted or not. Smashing, so the drive look like its encrypted, We've got two options here, a) take a logical image of the drive, which will then reveal all the files/folders in its original state (not encrypted),b) take the RAM image, then try to find out the password to that encrpytion, and once the password comes to vision, we can shutdown the machine and take a physical image.Alright, so at point b) , lets say we've taken the RAM image of the Windows 7workstation that has the encrypted container, but we don't know what encrpytion software was used (Bitlocker, truecrypt etc…), How do we get the password off the volatile image, run a string search of "passwd" into the image? or push the hibernation/pagefile to a commercial software ..?Lets see where this takes us to..Cheers Folks,

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Belkasoft 11 years ago

12 Posts

6 Users

0 Reactions

2,654 Views

RSS

(@copyright)

Estimable Member

Joined: 13 years ago

Posts: 184

Topic starter 02/03/2014 10:14 am

Hi,

What i have is a memory dump of an encrypted hard drive, however it has been taken while the pc was logged on (so logically unencrypted). This was done for tests purposes.

How do i take a "PGP process including all drivers" image?

ReplyQuote

Belkasoft

(@belkasoft)

Estimable Member

Joined: 17 years ago

Posts: 169

04/03/2014 3:52 pm

I do not quite understand what you mean by a "memory dump of an encrypted hard drive". Was it a small RAM disk located completely in the computer's volatile memory, and you have a dump of that? Or what exactly do you have?

Hi,

What i have is a memory dump of an encrypted hard drive, however it has been taken while the pc was logged on (so logically unencrypted). This was done for tests purposes.

How do i take a "PGP process including all drivers" image?

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
270 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed