Indexing, Searching, and Cracking

Abstract

When working as a forensic examiner, it is not uncommon to encounter encrypted files or entire partitions. When that is the case, the encrypted data must be decrypted in order for the forensic expert to be able to examine it. A tool that can be used to launch attacks against encrypted data is AccessData Password Recovery ToolKit (PRTK). This chapter provides a practical guide on how to use PRTK to decrypt encrypted data. Further, this chapter discusses two different ways of searching, live search and index search. A live search is just a search over the entire device you are examining for a keyword or pattern. An index search on the other hand is based on a pre-created index containing all strings on the device. The strings are mapped to their location. An index search can be much faster than a live search but depends and is limited by the way the index was generated. For that reason, this chapter also includes a description of different index settings in AccessData FTK.