Recovers and stores original encryption keys Zero-footprint operation leaves no traces and requires no modifications to encrypted volume contents Supports both encrypted containers and full disk encryptionĪcquires protection keys from RAM dumps, hibernation filesĮxtracts all the keys from a memory dump at once if there is more than one crypto container in the systemįast acquisition (limited only by disk read speeds) Supports removable media encrypted with BitLocker To Go Mounts encrypted BitLocker, PGP and TrueCrypt volumes Access to encrypted information is provided in real-time.ĭecrypts information stored in three most popular crypto containers Elcomsoft Forensic Disk Decryptor allows decrypting data from encrypted containers or mounting encrypted volumes, providing full forensic access to protected information stored in the three most popular types of crypto containers. Perform the complete forensic analysis of encrypted disks and volumes protected with desktop and portable versions of BitLocker, PGP and TrueCrypt.
