A forensic analysis framework for recovering encryption keys and BB10 backup decryption
Source of Publication
2014 12th Annual Conference on Privacy, Security and Trust, PST 2014
© 2014 IEEE. Memory forensics has become an important part of digital forensic investigation. Its importance has increased due to the type of information resides within memory that can be extracted using appropriate tools. This information includes open processes, open dynamically linked libraries (DLLs), encryption keys, function parameters passed at runtime, and login information. In this paper, we propose a forensic analysis framework that uses common disk encryption methods to encrypt a hard disk and then employs forensic analysis tools to extract encryption keys from the memory dump. We use the recovered keys to successfully decrypt content of an original encrypted disk. In addition, we successfully recover the content of an encrypted BlackBerry10 backup file (.bbb), which is encrypted by default, by employing email login information extracted from the memory image.
Institute of Electrical and Electronics Engineers Inc.
Bitlocker, BlackBerry10 Backup, decryption, encrypted password, Mac Disk Utility, Memory acquisition, Memoryze, PGP Desktop, TrueCrypt
Al Shehhi, Halima; Abu Hamdi, Dua'A; Asad, Izzeddin; and Iqbal, Farkhund, "A forensic analysis framework for recovering encryption keys and BB10 backup decryption" (2014). All Works. 100.
Indexed in Scopus