Practical Approaches to Recovering Encrypted Digital Evidence

As more criminals use encryption to conceal incriminating evidence, forensic examiners require practical methods for recovering some or all of the encrypted data. This paper presents lessons learned from investigations involving encryption in various contexts. By presenting successful and unsuccessful case examples, this paper gives forensic examiners a clearer understanding of the feasibility and limitations of various approaches to dealing with encryption. Additionally, by demonstrating how encryption has been successfully dealt with in past investigations, this paper provides examiners with techniques that we can apply in our work and encourages us to aggressively confront encryption.

• Type: Journal
• Year: 2002
• Where: IJDE
• Authors: Eoghan Casey
• Keywords: Encryption, Forensic Examiners, IJDE 2002, Paper