Has anyone on here had to deal with Full Disk Encryption by McAfee on an Active Directory Network? I am presently trying to figure out a way to recover files and evidence from local HDD that are connected to a Microsoft network with Active Directory and local HDD encryption by McAfee. The Forensic systems are not connected to this network in any way. I can image the HDD but I am unable to open the HDD in any of the forensic tools I presently have. Any information would be great, as I am at a stand still right now. The HDD are removed from the systems and shipped to me.
We've done it. It can be tricky, and you may end up needing a friend who has access to the daily key token. Is this a case that needs to stay local in its location, or could it be sent out for decryption?
Also, I'm assuming that the company running the Endpoint encryption is cooperating. Are they?
The company is cooperating, but as they are not in the near vicinity, it makes it hard to deal with them. The info needs to stay in house, so we can not send it out. We have asked the Sys Admins for the daily keys, but have not had much success.