Towards Enablement Of Efficient Forensics Of Encrypted Storage Devices Such As HDDs and SSDs

Abstract

Today, encryption is considered as a basic security measure to ensure protection of sensitive data contained within storage devices from external physical threats (such as people on-site) as well as network threats (such as malicious users over the internet or intranet). Today, since encryption techniques are freely and commercially available at ease to computer users all over the world, they have far reaching effects when utilized by malicious users to hide their data for the purpose of avoiding to get caught by lawful authorities. This research work essentially takes the case of encrypted disks/volumes that could cause problems in digital forensic investigations, since they provide criminal suspects with a range of opportunities for deceptive anti-forensics and a countermeasure to legislation written to force suspects to reveal decryption keys. This research work also covers techniques using which decryption keys could be found out so that encrypted data could be obtained in decrypted form to uncover artifacts of evidentiary value. This could also help the lawful authorities to bring cyber-criminals to justice and aid digital forensic analysts with a technique in their hands for retrieving data out of encrypted storage devices especially HDDs and SSDs.