Elcomsoft Forensic Disk Decryptor can automatically decrypt the entire content of the encrypted container, providing investigators with full, unrestricted access to all information stored on encrypted volumes. In the real-time mode, Elcomsoft Forensic Disk Decryptor mounts the encrypted volume as a new drive letter on the investigator’s PC. Elcomsoft Forensic Disk Decryptor offers all available methods for gaining access to information stored in encrypted BitLocker, FileVault 2, PGP, TrueCrypt and VeraCrypt disks and volumes. The toolkit allows using the volume's plain-text password, escrow or recovery keys, as well as the binary keys extracted from the computer's memory image.

Elcomsoft Forensic Disk Decryptor Bitlocker

Elcomsoft Forensic Disk Decryptor offers forensic specialists an easy way to obtain complete real-time access to information stored in popular crypto containers. Supporting desktop and portable versions of BitLocker, FileVault 2, PGP Disk, TrueCrypt and VeraCrypt protection, the tool can decrypt all files and folders stored in crypto containers or mount encrypted volumes as new drive letters. Elcomsoft Forensic Disk Decryptor offers forensic specialists an easy way to obtain complete real-time access to information stored in popular crypto containers. Supporting desktop and portable versions of BitLocker, PGP and TrueCrypt protection, the tool can decrypt all files and folders stored in crypto containers or mount encrypted volumes. #BitLocker #ElcomSoft #EFDDHow to get access to data from volumes and containers with PGP, BitLocker and BitLocker ToGo, TrueCrypt (as well as FileVault, McA.

We updated Elcomsoft Forensic Disk Decryptor 2.17, adding support for BitLocker-encrypted disks in the latest version of Windows 10 (20H2). The new release enables the ability to capture a memory image, identify and use the BitLocker encryption key to to decrypt files and folders stored in encrypted disks or to mount encrypted volumes as new drive letters for instant, real-time access.

Elcomsoft Forensic Disk Decryptor 2.17 receives an update, adding support for BitLocker-encrypted disks in systems running the latest Windows 10 Feature Update (20H2). The new release provides the ability to create forensic RAM images of computers running the latest version of Windows, search for BitLocker encryption keys and decrypt or mount protected disks without the need for lengthy attacks.

Integrated Solution for Accessing Encrypted Volumes

Forensic Disk Decryptor is an all-in-one toolkit offering the ability to mount or decrypt BitLocker volumes using the binary cryptographic keys extracted from the computer’s memory image or hibernation file. Thanks to built-in kernel level memory dumping tool, Elcomsoft Forensic Disk Decryptor can utilize zero-level access to computer’s RAM in order to create the most complete memory image containing the binary encryption keys for encrypted disk volumes. ElcomSoft’s RAM imaging driver works in kernel mode and carries a Microsoft digital signature, making the driver fully compatible with all 32-bit and 64-bit versions of Windows from Windows 7 and up to the latest Windows 10 (20H2).

Using memory images dumped by the extraction tool, Elcomsoft Forensic Disk Decryptor can obtain cryptographic keys for decrypting data stored in a wide range of encrypted containers without running a lengthy attack on the original plain-text password.

Elcomsoft Forensic Disk Decryptor Free Download Windows 10

Elcomsoft Forensic Disk Decryptor 2.17 Release Notes

Elcomsoft Forensic Disk Decryptor Torrent

Added memory imaging support for Windows 10 (20H2)
Minor bug fixes and performance improvements