Australian Digital Forensics Conference
Document Type
Conference Proceeding
Publisher
School of Computer and Information Science, Edith Cowan University, Perth, Western Australia
Abstract
Microsoft’s upcoming operating system release, Windows Vista, contains the option to encrypt all information on a hard drive. Previous versions of Windows have used the encrypting file system (EFS), allowing users to selectively encrypt files and folders on a drive. The technology is called BitLocker, and poses a problem for forensic investigators, as all information on the drive will be encrypted, and therefore unreadable. The technology has some limitations, such as only 2 versions out of the 5 available contain this technology and it also requires a trusted platform module (TPM) in order to operate. Other inherent limitations, along with possible interjection by security agencies, suggest that while this may create problems in some cases, it is unlikely that there will be widespread adoption of this technology. The likely result is that digital forensics will not end with the release of Windows Vista.
DOI
10.4225/75/57b265fc40cb3
Comments
4th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia, December 4th 2006.