Abstract Views :245 |
PDF Views:3
Authors
Affiliations
1 Department of Information Security and
Computer Forensics, SRM University, Chennai, IN
2 Resource Center for Cyber Forensics, CDAC,
Trivandrum, IN
3 Department of Information Security and Computer Forensics, SRM University, Chennai, IN
Source
Software Engineering, Vol 3, No 7 (2011), Pagination: 317-322
Abstract
Microsoft’s Bit locker tool has made the job of forensic analysts tougher. It’s full disk encryption feature enables users to encrypt their data. When operated in USB key mode, bit locker generates an external key file called .bek file[1]. This file must be needed for an investigator to unlock and decrypt any encrypted drive. If the investigator fails to obtain this .bek file, he cannot unlock the encrypted media and cannot proceed with the further analysis. In this paper we propose a solution to this problem which aims at reconstruction of a .bek file. We observe the metadata sector of the encrypted drive. The metadata sector gives information about the .bek file name. This can be used to reconstruct a file. This reconstructed .bek file can be used to unlock an encrypted media and proceed with further forensic analysis.
Keywords
Bitlocker[4], .bek File[4], Metadata[1], USB Key Mode[4].
