Hello all,
Is there a basic way to look a target pc up for (activated) encryption? Like with TrueCrypt there are possibilities to hide the task bar icon and make the process invisible in Task Manager. I did found a tool, named CryptHunter (http//
ZeroView
http//
Another method for detecting the use of encryption is visible on pg 115 of "Windows Registry Forensics"…check the MountedDevices key values for access to a TrueCrypt volume. The same holds true for PGP volumes, with the exception that the value data will contain "PGPdiskVolume" in Unicode…
Thanks for these suggestions.