The impact of full disk encryption on digital forensics

  title={The impact of full disk encryption on digital forensics},
  author={E. Casey and Gerasimos Stellatos},
  journal={Operating Systems Review},
The integration of strong encryption into operating systems is creating challenges for forensic examiners, potentially preventing us from recovering any digital evidence from a computer. Because strong encryption cannot be circumvented without a key or passphrase, forensic examiners may not be able to access data after a computer is shut down, and must decide whether to perform a live forensic acquisition. In addition, with encryption becoming integrated into the operating system, in some cases… Expand
The growing impact of full disk encryption on digital forensics
Privacy Impacts of Data Encryption on the Efficiency of Digital Forensics Technology
A forensic analysis framework for recovering encryption keys and BB10 backup decryption
A Systematic Assessment of the Security of Full Disk Encryption
Capturing encryption keys for digital analysis
  • Stefan Balogh, M. Pondelik
  • Computer Science
  • Proceedings of the 6th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems
  • 2011
Forensic Artifacts Left by Virtual Disk Encryption Tools
Live digital forensics in a virtual machine


United States District Court for the District of Vermont
  • Case No. 2:06-mj-91,
  • 2007