As you know there are different software that allow to encrypt users area.
Our developers proceed to research a ways for decrypt drives encrypted by software methods.
PC-3000 version 6.2.x allow to work with such encrypted drives and decrypt by special option in Data Extractor tool.
How to do it? – Welcome to this article!
In this video you can see the process of unlocking encrypted drive by BitLocker, but procedure is the same for all other supported encryption methods:
Please note that we are not break an encryption by something brute-force methods and not hack the encryption. Utility simulate a decryption process like it performed in original utility.
That’s why need to know an original key or have a key-file that encryption utilities create when user switch on the encryption option in the software.
At this time (PC-3000 version 6.2.x) we can work with partitions are encrypted by Windows Bitlocker, Apple FileVault and TrueCrypt.
When this option can be usefull?
For example drive can’t be recognized by OS because have damaged/problem head, then you can decrypt all available users data (via alive heads) without heads swap procedure.
Drive have a problem with the files allocation tables and as result impossible to open the Root and files structure in OS, then you can use decrypt option in Data Extractor and analyse the partition – use a Scan INDX + MFT option or RAW recovery.
The procedure is following:
Create a new task in Data extractor software and build a map of encrypted partition.
Add a Virtual drive. Use “Add virtual drive (Encrypted)” option.
You will see the pop-up window that require to enter a password. Also you can use a Recovery key or load a password from file. These two option allow to decrypt a partition by special file that is also created when encryption option is launched in encryption tool.
As result in Data Extractor will be created new virtual partition with decrypted users area.
As you can see all data are decrypted and available.
If you have something problems with this procededure – please contact us!