keyword search on e...
 
Notifications
Clear all

keyword search on encrypted drive image

7 Posts
7 Users
0 Likes
743 Views
(@aly786)
Posts: 5
Active Member
Topic starter
 

Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??

 
Posted : 16/05/2019 5:44 am
(@mrevoluter)
Posts: 14
Active Member
 

It's not possible as of my experience, first decrypt it and then you can carry on.
If possible!!! Kindly someone do reply.

 
Posted : 16/05/2019 8:40 am
hectic_forensics
(@hectic_forensics)
Posts: 40
Eminent Member
 

Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??

It's possible… but it wouldn't achieve much. 😯

 
Posted : 16/05/2019 1:07 pm
(@fissa)
Posts: 27
Eminent Member
 

Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??

It's possible… but it wouldn't achieve much. 😯

I must agree, no way to index 'the image'.

 
Posted : 21/05/2019 7:52 pm
Passmark
(@passmark)
Posts: 376
Reputable Member
 

I am not sure how you can be in forensics and ask this type of question?

What do people think encryption does?

 
Posted : 22/05/2019 6:48 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

What do people think encryption does?

It changes letters and words into a sequence of queer looking symbols, doesn't it? ?

At least this is what seemingly happens whenever I open an encrypted file in Notepad. wink

jaclaz

 
Posted : 22/05/2019 10:04 am
(@mansiu)
Posts: 83
Trusted Member
 

if the disk is used and then bitlocker is enabled with used space only, then there is a possibility that previous existing file data were not encrypted.
in this sense, keyword search will probably be able to find those data on the encrypted drive before decryption took place

 
Posted : 19/06/2019 10:50 am
Share: