Hi guys,
I've got a hard drive in that's encrypted using a piece of software I have never heard of before, its called "WinMagic".
Took an image of it and stuck it in EnCase v6 in the hope it would let me put the user details/password in (like it does with computers encrypted with safeguard easy) but to no avil.
So I tried mounting the image using IMP which was grand but VFC was unable to convert it to a VMWare file, no idea why, it just kept to create it.
I have also tried taking a live image but a piece of software called "Sanctuary" is installed and the write protection has been disabled for cd/usb meaning that any image cannot be taken because it is write protected…. I've done some searching to find out if it's possible to disable this, and it is but only on an older version.
Thirdly I tried booting from cd using Helix and the EnCase boot disk in an attempt to try something else, however WinMagic seemed to stop the computer booting from the disk even though the boot order had been changed.
I've now run out of ideas, can anyone suggest something that I haven't tried or point me in the direction of something that could help? Network crossover maybe?
Any help would be greatly appreciated.
Thanks
Make the drive a slave drive, instead of master, and see if that allows it to be read.
That is change the jumpers on the drive if possible, from auto or master to slave.
Just a thought.
I had Winmagic on my old laptop.
Did you try contact he vendor and ask? Sometimes they share some work arounds for law enforcement and private investigators.