cancel
Showing results for 
Search instead for 
Did you mean: 
tonny
Level 7

How do i test encrypted drive if data can be accessed when laptop is stolen or lost

how do i test an encrypted drive to see if data cannot be accessed when a laptop has been stolen.

are there any test scripts?

This is for laptops installed with mcafee endpoint encryption.

0 Kudos
2 Replies
SafeBoot
Level 21

Re: How do i test encrypted drive if data can be accessed when laptop is stolen or lost

use a forensic tool like Encase or F2K and poke around - they both will search for text for you.

0 Kudos
DLarson
Level 12

Re: How do i test encrypted drive if data can be accessed when laptop is stolen or lost

When people steal a laptop, they usually do the following to try and get data from it:

  1. Just power it on and see if it goes directly to the desktop
  2. If a password screen is presented, use one of these common Windows password cracking/bypass mechanisms http://www.makeuseof.com/tag/3-ways-to-reset-the-forgotten-windows-administrator-password/
  3. None of those will work because the disk is encrypted, so at that point a real hacker would go to more advanced tools
  4. You could try adding some "custom" tools to a portable linux distribution like Knoppix http://www.knoppix.net/

Another common tactic is to have your internal forensic expert try to get data off the disk. They have all sorts of tools like EnCase and the Forensic Tool Kit. They, of course, will also see nothing because all the data is encrypted.

100% of what was asked has been achieved after all….
0 Kudos