ElcomSoft Co. Ltd. has updated its Elcomsoft Forensic Disk Decryptor, a forensic tool for extracting information from encrypted volumes, the company said.
The toolkit becomes an integrated solution for accessing encrypted FileVault 2, PGP, BitLocker and TrueCrypt. The update can mount or decrypt encrypted volumes using plain text passwords, escrow keys, or cryptographic keys extracted from the computer´s memory image. A Microsoft-signed kernel-level memory dumping tool is now available, allowing experts imaging Windows computers´ RAM.
In previous versions, the toolkit was limited to accessing volumes with binary cryptographic keys extracted from the computer´s memory image or hibernation file. The ability to use plain-text passwords or escrow keys for accessing data stored in the encrypted containers was sorely missing.
Elcomsoft Forensic Disk Decryptor 2.0 adds the ability to access encrypted volumes with plain-text passwords, escrow or recovery keys. FileVault 2 recovery keys can be extracted from iCloud with Elcomsoft Phone Breaker, while BitLocker recovery keys are available in Active Directory or in the user´s Microsoft Account.
Founded in 1990, ElcomSoft Co.Ltd. develops computer forensics tools, provides computer forensics training and computer evidence consulting services. ElcomSoft has been providing support to businesses, law enforcement, military, and intelligence agencies. ElcomSoft tools are used by Fortune 500 corporations, governments, and major accounting firms.