Authors: Eoghan Casey, Ph.D. (Yale University)
DFRWS USA 2002
Abstract
As more criminals use encryption to conceal incriminating evidence, forensic examiners require practical methods for recovering some or all of the encrypted data. This paper presents lessons learned from investigations involving encryption in various contexts. By presenting successful and unsuccessful case examples, this paper gives forensic examiners a clearer understanding of the feasibility and limitations of various approaches to dealing with encryption. Additionally, by demonstrating how encryption has been successfully dealt with in past investigations, this paper provides examiners with techniques that we can apply in our work and encourages us to aggressively confront encryption.