This resource is no longer available
Clues that point a digital forensics investigator to TrueCrypt data encryption
By Andrew Davies and Allan Tomlinson
Criminals are increasingly using data encryption software to cover their tracks. Even detecting the use of encryption software can be a challenge for a digital forensics investigator. This article looks at the evidential material that can be found when TrueCrypt data encryption software has been used.
Although encrypted data might not initially be detected, TrueCrypt does leave a trail of evidence that could be examined. This supporting evidence could then be used in conjunction with the relevant laws to seek access to the encrypted material in an unencrypted form
Royal Holloway Information Security Thesis Series