BitLocker FileVault And Full Disk Encryption

FULL - DISKENCRYPTION · AGUIDEFORUKLAWYERS BitLocker, FileVault and Full-Disk Encryption Recovery Keys, Escrow and What the Encrypted Drive Really Does and Does Not Protect COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ENCRYPTED-DRIVE EXAMINATION RECOVERY-KEY & ESCROW ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: encryption built to be recovered 03 How BitLocker, FileVault and LUKS actually work 04 Where the recovery keys live: directory, console, cloud and escrow 05 Obtaining the key lawfully and imaging the decrypted volume 06 When there is no key: the genuinely inaccessible drive 07 Deployment: the recovery position, disclosure and honest limits 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : FULL - DISKENCRYPTIONISDESIGNEDTOBERECOVERABLE , AND INAMANAGEDENVIRONMENTTHERECOVERYKEYALMOSTALWAYSEXISTSSOMEWHERE THEORGANISATIONCONTROLS : THEEXAMINER ' SFIRSTTASKISTOFINDTHATKEY , NOTTOATTACKTHEENCRYPTION , ANDONLYWHERENOESCROWEDKEYEXISTSISTHE DRIVEGENUINELYBEYONDREACH § 0 2 · FIRSTPRINCIPLES The problem in plain English: encryption built to be recovered § 0 3 · HOWITWORKS How BitLocker, FileVault and LUKS actually work § 0 4 · WHERETHERECOVERYKEYSLIVE Where the recovery keys live: directory, console, cloud and escrow § 0 5 · OBTAININGANDIMAGING Obtaining the key lawfully and imaging the decrypted volume § 0 6 · WHENTHEREISNOKEY When there is no key: the genuinely inaccessible drive § 0 7 · DEPLOYMENT Deployment: the recovery position, disclosure and honest limits § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION COUNTERPART LOCAL- ENCRYPTED RECOVERY- CLOUD SERVER-SIDE DRIVE KEY STORES BACKUP PLATFORMS SYNCED / DELETED / COPIES ONLY § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEBITLOCKERLAPTOPTHATWASOPENALLALONG EXAMPLE2 · THESUPPRESSEDESCROWTHATTOLDITSOWNSTORY EXAMPLE3 · THEPERSONALMACBOOKANDTHEHONESTLIMIT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or the reluctant party) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORANENCRYPTED - DRIVEEXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The encrypted-drive checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The laptop is BitLocker encrypted. Is the data lost? Where exactly do we find a recovery key? Can you break BitLocker or FileVault if there is no key? A managed device's recovery key is missing from the console. What does that mean? The device is personal and the person will not give the key. Now what? Is a decrypted image as good as evidence as an unencrypted one? § 1 4 · REFERENCE Glossary LUKS TPM Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY