A forensic analysis framework for recovering encryption keys and BB10 backup decryption

Document Type

Conference Proceeding

Source of Publication

2014 12th Annual Conference on Privacy, Security and Trust, PST 2014

Publication Date

1-1-2014

Abstract

© 2014 IEEE. Memory forensics has become an important part of digital forensic investigation. Its importance has increased due to the type of information resides within memory that can be extracted using appropriate tools. This information includes open processes, open dynamically linked libraries (DLLs), encryption keys, function parameters passed at runtime, and login information. In this paper, we propose a forensic analysis framework that uses common disk encryption methods to encrypt a hard disk and then employs forensic analysis tools to extract encryption keys from the memory dump. We use the recovered keys to successfully decrypt content of an original encrypted disk. In addition, we successfully recover the content of an encrypted BlackBerry10 backup file (.bbb), which is encrypted by default, by employing email login information extracted from the memory image.

ISBN

9781479935031

Publisher

Institute of Electrical and Electronics Engineers Inc.

First Page

172

Last Page

178

Disciplines

Computer Sciences

Keywords

Bitlocker, BlackBerry10 Backup, decryption, encrypted password, Mac Disk Utility, Memory acquisition, Memoryze, PGP Desktop, TrueCrypt

Scopus ID

84910045930

Indexed in Scopus

yes

Open Access

no

Link to Full Text

Share

COinS