We updated Elcomsoft Forensic Disk Decryptor 2.17, adding support for BitLocker-encrypted disks in the latest version of Windows 10 (20H2). The new release enables the ability to capture a memory image, identify and use the BitLocker encryption key to to decrypt files and folders stored in encrypted disks or to mount encrypted volumes as new drive letters for instant, real-time access.

Elcomsoft Forensic Disk Decryptor 2.17 receives an update, adding support for BitLocker-encrypted disks in systems running the latest Windows 10 Feature Update (20H2). The new release provides the ability to create forensic RAM images of computers running the latest version of Windows, search for BitLocker encryption keys and decrypt or mount protected disks without the need for lengthy attacks.

Integrated Solution for Accessing Encrypted Volumes

Forensic Disk Decryptor is an all-in-one toolkit offering the ability to mount or decrypt BitLocker volumes using the binary cryptographic keys extracted from the computer’s memory image or hibernation file. Thanks to built-in kernel level memory dumping tool, Elcomsoft Forensic Disk Decryptor can utilize zero-level access to computer’s RAM in order to create the most complete memory image containing the binary encryption keys for encrypted disk volumes. ElcomSoft’s RAM imaging driver works in kernel mode and carries a Microsoft digital signature, making the driver fully compatible with all 32-bit and 64-bit versions of Windows from Windows 7 and up to the latest Windows 10 (20H2).

Using memory images dumped by the extraction tool, Elcomsoft Forensic Disk Decryptor can obtain cryptographic keys for decrypting data stored in a wide range of encrypted containers without running a lengthy attack on the original plain-text password.

Elcomsoft Forensic Disk Decryptor 2.17 Release Notes

• Added memory imaging support for Windows 10 (20H2)
• Minor bug fixes and performance improvements