Cracking

Abstract

When working as a forensic examiner, it is not uncommon to encounter encrypted files, entire partitions or even devices that have been encrypted. When that is the case, the encrypted data must be decrypted in order for the forensic expert to be able to examine it. The intent of this chapter is to provide the reader with a practical overview of the steps commonly involved in the process of cracking Cracking encrypted data. While know-how and experience may be the most important skills in successful cracking, everyone needs a good tool for assistance. As such, this chapter also presents and discusses the AccessData tool Password Recovery ToolKit and the open-source Open source alternative Hashcat Hashcat that can both be used for the purpose of password crackingCracking. Thus, this chapter provides the reader with a practical implementation of the theoretical knowledge that was presented in Chap. 5 .