Page 1 of 1
Encrypted flash drive recovery
Posted: 08.11.17, 21:05
by osity
I have a flash drive coming in that has been encrypted with Cryptomator. The client has the password.
Does anything change in the way we do the chip-off recovery because the flash drive is encrypted ?
Re: Encrypted flash drive recovery
Posted: 09.11.17, 00:36
by DataMedics
The encryption should only be in the logical part of the data, so it shouldn't change the chip off process. It's just that you'll be flying blind if you try analyzing the data at all.
Re: Encrypted flash drive recovery
Posted: 09.11.17, 01:52
by osity
If I’m lucky there may be a global solution.
It’s after that part is where my concern is.
Re: Encrypted flash drive recovery
Posted: 09.11.17, 16:36
by Amarbir[CDR-Labs]
osity wrote:Source of the post If I’m lucky there may be a global solution.
It’s after that part is where my concern is.
Well,
Only a Already Available Solution Should Help But Still You Can Work With FAT Tables Etc If You Want To Reconstruct The Data
Re: Encrypted flash drive recovery
Posted: 10.11.17, 10:01
by Roman_TS
If Flash case contain a software encryption, even FAT tables would be encrypted. All parts of data including FS will be encrypted. So, the only chance is automatic solution and "blind recovery"
Re: Encrypted flash drive recovery
Posted: 10.11.17, 16:37
by Amarbir[CDR-Labs]
Hello Roman ,
If The Controller is Encrypting Then It Might Be True But if a Software Has Done It It Might Have Encrypted FAT Tables Etc Or Not Its 50:50 But i Maybe Wrong