Elcomsoft Forensic Disk Decryptor is updated, receiving support for all encryption configurations in VeraCrypt, the most popular TrueCrypt successor. In addition, EFDD 2.10 now fully supports TPM enhanced BitLocker configurations including TPM-only and TPM+password modes.

Elcomsoft Forensic Disk Decryptor 2.10 adds support for the many possible encryption algorithms and optional configurations in encrypted containers created with VeraCrypt, the most popular TrueCrypt successor. Beside VeraCrypt, the update adds support for TPM enhanced BitLocker configurations including TPM-only and TPM+password modes. Even if TPM is enabled, EFDD can extract and use the encryption key from the memory dump or hibernation file to mount or decrypt the partition. If neither of those is available, the decryption is possible using the Recovery Key if available.

VeraCrypt Support

VeraCrypt is the most popular successor of the open-source disk encryption tool TrueCrypt. Compared to the original, VeraCrypt offers a lot more customization options. In this update, Elcomsoft Forensic Disk Decryptor adds VeraCrypt support, enabling experts decrypting VeraCrypt containers with a known password or using binary keys extracted from page files or hibernation files.

BitLocker with TPM

In Windows, BitLocker is the default integrated full-disk encryption mechanism. When encrypting system volumes, BitLocker relies on the Trusted Platform Module (TPM) technology to secure the encryption key. If an attack is performed on a stand-alone disk or disk image, there is no password to attack as the encryption key is not derived from the password.

The updated Forensic Disk Decryptor now fully supports TPM enhanced BitLocker configurations including TPM-only and TPM+password modes. Even if TPM is enabled, EFDD can extract and use the encryption key from the memory dump or hibernation file to mount or decrypt the partition. If neither of those is available, the decryption is possible using the Recovery Key if available.