Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??
It's not possible as of my experience, first decrypt it and then you can carry on.
If possible!!! Kindly someone do reply.
Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??
It's possible… but it wouldn't achieve much. 😯
Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??
It's possible… but it wouldn't achieve much. 😯
I must agree, no way to index 'the image'.
I am not sure how you can be in forensics and ask this type of question?
What do people think encryption does?
What do people think encryption does?
It changes letters and words into a sequence of queer looking symbols, doesn't it? ?
At least this is what seemingly happens whenever I open an encrypted file in Notepad. wink
jaclaz
if the disk is used and then bitlocker is enabled with used space only, then there is a possibility that previous existing file data were not encrypted.
in this sense, keyword search will probably be able to find those data on the encrypted drive before decryption took place