Cloning a HDD with FDE

[nitrobass24]

Am working on developing some procedures on forensic recovery of HDDs, networks, etc. for our forensic investigations group as they want to bring the IT piece in-house and I am having a hard time with this piece. I understand the purpose for Full Disk Encryption is to prevent someone from just copying the data off to another HDD, but this cannot be impossible as investigators both government and non-govt can do this.

The problem i keep running into is that the MBR is always corrupted in the process and the clone cannot be used. In some cases we may be able to get IT to just decrypt the disks using their Admin codes, but in some cases where the company has gone bankrupt or the employees left due to fraud that is not always possible.

Was looking at purchasing EnCase as it appears that it has the ability to decrypt on the fly without knowledge of admin codes/keys. However, it is quite pricey especially when considering that i would need 20+ licenses. Is there not a cheaper/free/opensource alternative that has decryption capabilities?

Honestly if it just did Safeboot and EFS that would cover 90% of our engagements with this issue.

 

[Drudenhaus]

When I took my 3 computer forensic classes a few years back, the two big names in forensic disk analysis software were Encase and FTK (Forensic Toolkit). We didn't cover anything related to encrypted disks, but FTK may be worth checking out as well, though it's definitely not really any cheaper.

 

[nitrobass24]

Yea i was afraid this might be the case, maybe someone else will know of some other tools that are not really expensive.

 

[Drudenhaus]

A new class was "released" (for lack of better term) at my local community college that is all linux based forensic analysis. Maybe I can dig up some info on what tools they're using (perhaps they're OSS/free of some sort).

 

[nitrobass24]

That would be great if you dont mind.