A forensic analysis framework for recovering encryption keys and BB10 backup decryption
Document Type
Conference Proceeding
Source of Publication
2014 12th Annual Conference on Privacy, Security and Trust, PST 2014
Publication Date
1-1-2014
Abstract
© 2014 IEEE. Memory forensics has become an important part of digital forensic investigation. Its importance has increased due to the type of information resides within memory that can be extracted using appropriate tools. This information includes open processes, open dynamically linked libraries (DLLs), encryption keys, function parameters passed at runtime, and login information. In this paper, we propose a forensic analysis framework that uses common disk encryption methods to encrypt a hard disk and then employs forensic analysis tools to extract encryption keys from the memory dump. We use the recovered keys to successfully decrypt content of an original encrypted disk. In addition, we successfully recover the content of an encrypted BlackBerry10 backup file (.bbb), which is encrypted by default, by employing email login information extracted from the memory image.
DOI Link
ISBN
9781479935031
Publisher
Institute of Electrical and Electronics Engineers Inc.
First Page
172
Last Page
178
Disciplines
Computer Sciences
Keywords
Bitlocker, BlackBerry10 Backup, decryption, encrypted password, Mac Disk Utility, Memory acquisition, Memoryze, PGP Desktop, TrueCrypt
Scopus ID
Recommended Citation
Al Shehhi, Halima; Abu Hamdi, Dua'A; Asad, Izzeddin; and Iqbal, Farkhund, "A forensic analysis framework for recovering encryption keys and BB10 backup decryption" (2014). All Works. 100.
https://zuscholars.zu.ac.ae/works/100
Indexed in Scopus
yes
Open Access
no