Bruce Nikkel encryption.pdf

• application file encryption - protect PDF, office docs, etc
• individual file containers - GPG, Encrypted Zip
• directories - ecryptfs, ext4 encryption
• volumes - TrueCrypt / Veracrypt
• block devices - Linux LUKS, MS Bitlocker, Apple FileVault
• drive hardware - OPAL/SED (Self Encrypting Drive)

Decrypting requieres:

• password or passphrase
• cryptographic key string or key file
• smartcard or hard token

The forensic challenge is to find the decryption key

• brute foce and dictionary attacks to find simple passwords
• cryptanalysis (mathematical weakness, reduce keyspace)
• finding passwords saved/written/transferred previously
• password reuse across multiple accounts or devices
• legal requierment to produce passwords in court
• cooperative owner or accomplice who provides the password
• key backup/escrow in enterprise environments
• exploit, vulnerability, or backdoor
• social engineering or other tricks (forced biometrics, keyloggers, a very good lelscope)

In the forensics community this is called password/key "recovery" not "cracking" (but its the same)

Brute force is simply trying an exhastive number of passwords/keys until you find the right one - guessing.

Some brute force methods:

• GPU cluster - use graphic cards to brute force
• rainbow tables - precomputed tables of cryptographic hashes

Be careful of "maximum attempts" : e.g. smartcards blocking, smart devices wiping, after X failed attempts.

• Extract keys from memory (PCI-bus DMA attacks)
• man-in-the-middle attacks on network traffic

• John the Ripper (brute force) - very customizable
• HashCat (brute force) - good GPU support
• bulk_extractor - forensic tool creates work list from a disk image
• Inception - PCI based DMA memory dumper

Current research: analysis of electromagnetic radiation and electrical signal variations to reduce keyspace.

Steganography is considered a part of anti-forensics

• It hides data in non-obvious places
• least significant bits of color, sound, etc...
• tries to hide data in different slack areas
• Veracrypt allows hiding volumes inside volumes.

Some tools:

• stegdetect
• stegsnow
• openstego
• busysteg
• gsteg
• photocrypt