Join Us!

keyword search on e...
 
Notifications
Clear all

keyword search on encrypted drive image  

  RSS
aly786
(@aly786)
New Member

Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??

Quote
Posted : 16/05/2019 6:44 am
mrevoluter
(@mrevoluter)
New Member

It's not possible as of my experience, first decrypt it and then you can carry on.
If possible!!! Kindly someone do reply.

ReplyQuote
Posted : 16/05/2019 9:40 am
hectic_forensics
(@hectic_forensics)
Junior Member

Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??

It's possible… but it wouldn't achieve much. 😯

ReplyQuote
Posted : 16/05/2019 2:07 pm
fissa
(@fissa)
Junior Member

Is it possible to perform keyword search on encrypted harddrive image without using the drive decryption key in Encase??

It's possible… but it wouldn't achieve much. 😯

I must agree, no way to index 'the image'.

ReplyQuote
Posted : 21/05/2019 8:52 pm
Passmark
(@passmark)
Active Member

I am not sure how you can be in forensics and ask this type of question?

What do people think encryption does?

ReplyQuote
Posted : 22/05/2019 7:48 am
jaclaz
(@jaclaz)
Community Legend

What do people think encryption does?

It changes letters and words into a sequence of queer looking symbols, doesn't it? ?

At least this is what seemingly happens whenever I open an encrypted file in Notepad. wink

jaclaz

ReplyQuote
Posted : 22/05/2019 11:04 am
mansiu
(@mansiu)
Member

if the disk is used and then bitlocker is enabled with used space only, then there is a possibility that previous existing file data were not encrypted.
in this sense, keyword search will probably be able to find those data on the encrypted drive before decryption took place

ReplyQuote
Posted : 19/06/2019 11:50 am
Share: