Decrypt or mount disk

Top  Previous  Next

First, select the type of the disk you are working with:




Once the disk/encryption is selected, you have to choose the disk source (physical disk or dist partition using Select device option, or the image file in raw/DD format using Select image):




Next, select the source of the encryption keys: it could be memory dump or hibernation file, or the file keys with the keys if you already acquired them (see Find encryption keys). We recommend you to search for encryption keys separately (as the very first step), so the program will not have to perform this lengthy operation every time when you want to mount or decrypt the disk. If proper encryption keys are there, EFDD offers you to decrypt the disk (creating the raw image, that can be further mounted into the other system, or analyzed with 3rd party forensic software), or mount it into the current system. For BitLocker, the program can also reveal the recovery key under certain circumstances. Or if you already have the BitLocker or PGP recovery key, you can decrypt or mount disk with it.




Mounting is implemented using ImDisk virtual disk driver (installed with EFDD); typically, you don't need to change any settings and only press the Mount button:








 Get more information about Elcomsoft Forensic Disk Decryptor
 Get full version of Elcomsoft Forensic Disk Decryptor

 © 2016 ElcomSoft Co.Ltd.