Title: 4. Understanding Whole Disk Encryption
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Understanding Whole Disk Encryption

1. In recent years, there has been more concern about loss of personal identity information (PII) and trade secrets caused by computer theft.  Of particular concern is the theft of laptop computers and other handheld devices.
2. To help prevent loss of information, software vendors now provide whole disk encryption.  Current whole disk encryption tools offer the following features:
  - Preboot authentication
  - Full or partial disk encryption with secure hibernation
  - Advanced encryption algorithms
  - Key management function
  - A Trusted Platform Module (TPM) microchip to generate encryption keys and authenticate logins
  - Whole disk encryption tools encrypt each sector of a drive separately. Many of these tools encrypt the drive’s boot sector to prevent any efforts to bypass the secured drive’s partition.
  - To examine an encrypted drive, you must decrypt it first, which means you must run a vendor-specific program to decrypt the drive.

Examining Microsoft BitLocker

1. Microsoft BitLocker is available only with Vista Enterprise and Ultimate editions.
2. Current hardware and software requirements, including:
  - A computer capable of running Windows Vista
  - The TPM microchip, version 1.2 or newer
  - A computer BIOS compliant with Trusted Computing Group (TCG)
  - Two NTFS partitions
  - The BIOS configured so that the hard drive boots first before checking other bootable peripherals

Examining Third-Party Disk Encryption Tools

1. Some of the available third-party WDE utilities, including:
  - PGP Whole Disk Encryption
  - Voltage SecureDisk
  - Utimaco SafeGuard Easy
  - Jetico BestCrypt Volume Encryption
  - SoftWinter Sentry 2020 for Windows XP
2. Some of the available open-source encryption tools, including:
  - TrueCrypt
  - CrossCrypt
  - FreeOTFE