Thank you Jamie. Very good information.
We have both Axiom and IEF and will run Axiom at some point. Maybe next.
We have used IEF for several years now and it has been delightful to see the evolution in the product and the growth of the business.
The attorney with the DOJ was very pleased with IEF's "Zoom" artifact recovery. He runs a group of examiners that chase down large "CP Organizations" operating within US jurisdiction. Travels all over the country but lives in a smaller city in Texas. Says he spends most of his life changing planes at DFW.
HFS - all of it.
Keep up the good work,
Mike
Glad to hear it Mike, reach out any time either here or at my email above if you ever have any questions or suggestions.
Jamie
You are welcome Jamie.
This case we are working on continues to produce a large number of encrypted files. We have heard that Passware integration is coming to Axiom. Care to share any dates yet? Need a BETA tester?
Thanks,
Mike
It's actually already in AXIOM (just launched last week). Right now we're supporting decrypting FDE with a known password for Bitlocker, Truecrypt, and PGP with more on the way over the next few versions. You mentioned Truecrypt so we should have that covered if it's the full volume but for encrypted containers in the user space, you may need to copy them out and reprocess as a separate image (it will then prompt for a password and decrypt).
Decrypting FDE with a known password using Passware is freely included in AXIOM but if you want to get Passware to crack passwords, you'll have to buy a Passware forensics license. So it might depend if you have the passwords or not which avenue works for you.
If you're seeing stuff other than Truecrypt let me know and I'll see where it's sitting in our queue. Main asks we're getting are for McAfee, Veracrypt, Dell/Credent, FileVault2.
Great stuff, and if I use it, I just might get more SEX!
Can't lose product for Magnet!
Mike