School of Computer and Information Science, Edith Cowan University, Perth, Western Australia
Microsoft’s upcoming operating system release, Windows Vista, contains the option to encrypt all information on a hard drive. Previous versions of Windows have used the encrypting file system (EFS), allowing users to selectively encrypt files and folders on a drive. The technology is called BitLocker, and poses a problem for forensic investigators, as all information on the drive will be encrypted, and therefore unreadable. The technology has some limitations, such as only 2 versions out of the 5 available contain this technology and it also requires a trusted platform module (TPM) in order to operate. Other inherent limitations, along with possible interjection by security agencies, suggest that while this may create problems in some cases, it is unlikely that there will be widespread adoption of this technology. The likely result is that digital forensics will not end with the release of Windows Vista.