<http://schema.org/articleBody>
"Russian firm ElcomSoft on Thursday announced the release of  Elcomsoft Forensic Disk Decryptor (EFDD), a new forensic tool that can reportedly access information stored in disks and volumes encrypted with desktop and portable versions of BitLocker, PGP, and TrueCrypt. EFDD runs on all 32-bit and 64-bit editions of Windows XP, Windows Vista, and Windows 7, as well as Windows 2003 and Windows Server 2008. The price tag isn't outrageous, but EFDD will still set you back a solid $299.\r\n\r\nEFDD offers access to encrypted information either by completely decrypting everything or by doing so for individual files in real time. You can choose to either decrypt all files and folders stored in the cryptographic container (full, unrestricted forensic access to all stored information) or mount the encrypted volume as new drive letter for instant access (information is decrypted on-the-fly).\r\n\r\n\r\n\r\nLast but not least, the tool offers zero-footprint operation with no alterations or modifications to original content. If you want to get in and out without making a mess, this is particularly crucial whether you're an investigator or a spy.\r\n\r\nSo, how does it work? Elcomsoft Forensic Disk Decryptor acquires the necessary decryption keys by analyzing memory dumps and/or hibernation files obtained from the target PC. You'll thus need to get a memory dump from a running PC (locked or unlocked) with encrypted volumes mounted, via a standard forensic product or via a FireWire attack. Alternatively, decryption keys can also be derived from hibernation files if a target PC is turned off.\r\n\r\n&amp;quot;The new product includes algorithms allowing us to analyze dumps of computers' volatile memory, locating areas that contain the decryption keys,&amp;quot;  ElcomSoft CEO Vladimir Katalov said in a statement. &amp;quot;Sometimes the keys are discovered by analyzing byte sequences, and sometimes by examining crypto containers\u2019 internal structures. When searching for PGP keys, the user can significantly speed up the process if the exact encryption algorithm is known.&amp;quot;\r\n\r\nThe full feature list for EFDD is as follows:\r\n\r\nDecrypts information stored in three most popular crypto containers.\r\nMounts encrypted BitLocker, PGP and TrueCrypt volumes.\r\nSupports removable media encrypted with BitLocker To Go.\r\nSupports both encrypted containers and full disk encryption.\r\nAcquires protection keys from RAM dumps, hibernation files.\r\nExtracts all the keys from a memory dump at once if there is more than one crypto container in the system.\r\nFast acquisition (limited only by disk read speeds).\r\nZero-footprint operation leaves no traces and requires no modifications to encrypted volume contents.\r\nRecovers and stores original encryption keys.\r\nSupports all 32-bit and 64-bit versions of Windows.\r\n\r\n\r\nUpdate: The title of this article previously said &amp;quot;cracking&amp;quot; but has been changed to &amp;quot;decrypting&amp;quot; to more accurately describe the tool.\r\n\r\nImage credit: doctor-a"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/insider/2012/12/20/this-299-tool-is-reportedly-capable-of-cracking-bitlocker-pgp-and-truecrypt-disks-in-real-time/>