Forensic Disk Decryptor 2.12 and System Recovery 7.04 Display File System Data, Expand VeraCrypt Support

Elcomsoft releases two product updates. Forensic Disk Decryptor 2.12 can display file system data and adds VeraCrypt support for GPT partitions, while System Recovery 7.04 can discover plaintext passwords for cached domain credentials and also shows file system data.

Elcomsoft Forensic Disk Decryptor 2.12 is a minor update that adds support for VeraCrypt volumes located on GPT partitions. In addition, the tool can now display information about the file system of discovered volumes when scanning the hard disk. The kernel driver is now automatically unloaded after capturing the memory dump.

System Recovery 7.04 can also display file system data for the disks installed in the system being analyzed. In addition, the tool can discover plaintext passwords for cached domain credentials, giving the chance of near instant access to protected accounts.

VeraCrypt on GPT Partitions

VeraCrypt is the most popular successor of the open-source disk encryption tool TrueCrypt. Compared to the original, VeraCrypt offers a lot more customization options. The GUID Partition Table (GPT) is a standard for the layout of partition tables on modern hard drives. The GPT is used on the majority of modern computers as it no longer has the limitations of the previously used Master Boot Record (MBR) partition tables. In this update, Elcomsoft Forensic Disk Decryptor adds support for VeraCrypt located on GPT partitions.

Displaying the File System

Both Forensic Disk Decryptor and Elcomsoft System Recovery will now automatically detect and display the file system of the discovered partitions. By being able to see which file system the disk volume is using, experts will be able to better plan their actions during the investigation.

Release Notes Forensic Disk Decryptor 2.12