Elcomsoft Forensic Disk Decryptor 2 Torrent
Elcomsoft Forensic Disk Decryptor + Crack
Elcomsoft Forensic Disk Decryptor offers all available methods to access information stored on encrypted media and volumes of BitLocker, FileVault 2, PGP, TrueCrypt and VeraCrypt. The toolkit allows you to use the clear text password, trust keys or volume reset and binary keys that are removed from your computer’s memory dump or hibernation. FileVault 2 recovery keys can be extracted from iCloud with Elcomsoft Phone Breaker, while BitLocker recovery keys are available in Active Directory or in a Microsoft user account.
If neither the encryption key nor the recovery key can be extracted, EFDD can extract the metadata from the encrypted container so that Elcomsoft Distributed Password Recovery can do its job.
Complete decryption, immediate distribution or attack
With fully automatic detection of encrypted volumes and encryption settings, experts only need to specify the path to the encrypted container or disk image. Elcomsoft Forensic Disk Decryptor automatically searches, identifies and displays encrypted volumes and details of the corresponding encryption settings.
Access is by decrypting the entire contents of an encrypted volume or by mounting the volume as a drive letter in unlocked and unencrypted mode. Both operations can be performed with volumes as connected disks (physical or logical) or raw images. For FileVault 2, PGP and BitLocker, decryption and provisioning can be performed with the Reset key (if available).
Complete decryption
Elcomsoft Forensic Disk Decryptor can automatically decrypt all content in the encrypted container and offer investigators unlimited access to all information stored in encrypted volumes
Real-time access to encrypted information
In real-time mode, Elcomsoft Forensic Disk Decryptor makes the encrypted volume available as a new device letter on the investigator’s PC. In this mode, forensic specialists can access protected information quickly and in real time. The information read on the hard drives and mounted volumes is decrypted in real time during the operation.
No decryption keys and no recovery keys?
If neither the decryption key nor the recovery key is available, Elcomsoft Forensic Disk Decryptor extracts the necessary metadata to brutally force the password with Elcomsoft Distributed Password Recovery.
Elcomsoft Distributed Password Recovery can attack plain text passwords that protect encrypted containers with several advanced attacks, including glossary, mask and permutation attacks, in addition to brute force.
Encryption key sources
Elcomsoft Forensic Disk Decryptor needs the original encryption keys to access protected information stored in encryption containers. Encryption keys can be extracted from hibernation or dump files captured during the mounting of the encrypted volume. There are three ways to obtain the original encryption keys:
Analyzing the hibernation file (when the computerto be analyzed is turned off);
Analyzing a dump file. A memory dump for a running computer can be recorded with the built-in memory imaging tool.
When performing a FireWire attack (the computer to be scanned must be run with encrypted volumes mounted). The FireWire (Home) attack requires a free attack on tools launched on the investigator’s PC.
When capturing a dump with the built-in RAM imaging tool
The FileVault 2, PGP and BitLocker volumes can be decrypted or mounted using the arrow key (reset key).
New features:
VeraCrypt Encryption
VeraCrypt is the most popular successor to TrueCrypt’s open source hard disk encryption tool. VeraCrypt offers a wider selection of encryption methods and hashing algorithms compared to the original ones. In this update, Elcomsoft Forensic Disk Decryptor fully supports VeraCrypt volumes, so experts can extract hash data from VeraCrypt containers to launch brute force or smart dictionary attacks with distributed password recovery.
What’s new:
Added support for APFS partitions with FileVault2
Added support for VeraCrypt (generate files for more password recovery)
Added support for GUID partitions
Enhanced support for encrypted HFS + partitions
improved user interface; Plates are now available
enhanced PGP WDE support
29a07
25 Peers 
37
Health
