Chapter 7

Passwords and Encryption

• Obtaining passwords
• Encryption basics
• Common encryption practices
• Weaknesses of encryption
• What to do when you find encrypted data

Computer forensics is all about perspective and process. A forensic investigator’s main perspective must be as a neutral party in all activities. Approach each investigation the same way, ensuring that it is repeatable and sound. After evidence is identified and preserved, analyze it to determine its impact on your case. In many situations, forensic investigators don’t have the authority to disclose any evidence except to authorized individuals. It all depends on who owns the computer and who is paying for the investigation. As a forensic investigator, you need to know how to exercise your authority and access protected data properly. The two most common controls that protect data from disclosure are access controls and data encryption. This chapter covers the most common type of access control—the password—and the general topic of encryption.

You will learn basic techniques to obtain passwords to gain access to evidence. You will learn about basic encryption methods and how to recover encrypted evidence.