Full-disk encryption is now a standard feature on many computers and on almost all smartphones. That is excellent news for security: a stolen laptop does not expose its owner's data. For digital forensics, however, it means that a bit-for-bit copy of the drive, without the key, contains only unintelligible data. Understanding how encryption works and where keys can legitimately be found has become essential.
How disk encryption works
With full encryption, everything written to the drive first passes through an encryption algorithm, and everything read is decrypted on the fly. The user does not notice: once the system is unlocked, files look normal. The key that encrypts the data is itself protected by one or more "protectors": a password, a PIN, the computer's security chip, a recovery key.
The most common systems are:
| System | Environment | Practical notes |
|---|---|---|
| BitLocker | Windows | Often tied to the TPM chip; has a numeric recovery key |
| FileVault | macOS | Built into the system; recovery key or account-based unlock |
| LUKS | Linux | Widespread standard; supports several passwords per volume |
| VeraCrypt | Cross-platform | Encrypted volumes or containers, including hidden ones |
| Smartphone encryption | iOS and Android | Tied to the unlock passcode and device hardware |
Why "switching off" can be a mistake
When an encrypted computer is on and unlocked, the data is accessible and the key is in memory. Switching it off locks the volume again. If nobody knows the password or recovery key, the data may become permanently inaccessible.
That is why, faced with a running system, the expert considers:
- whether the drive is encrypted, by checking the status of the volumes;
- whether to acquire memory immediately, as it may contain the key;
- whether to perform a logical acquisition of the already unlocked volumes before shutting down.
These operations partly change the system's state, but they are often the only way not to lose the data. They must be justified and documented in detail.
Where keys can legitimately be found
Without any forcing, recovery keys are often found in predictable places:
- the owner's online account: some systems automatically save the recovery key to the account linked to the computer;
- corporate management systems: in organisations, keys are normally stored in a central service managed by IT;
- printouts or files saved by the user when encryption was enabled;
- the holder's password manager.
In a corporate setting, the first question is therefore for the system administrator: in many cases the key is already available and the problem does not exist.
Encrypted volumes and containers
Besides the whole drive, individual containers can be encrypted: files that, opened with the right program and password, mount as a drive. In an analysis they are often recognisable because they are large files with apparently random content and no recognisable format structure. Some programs also allow hidden volumes inside other volumes; their existence cannot be proven with certainty from outside, but traces of the program's use, recent files and shortcuts may suggest it.
Smartphones: the hardest case
On modern phones, encryption is tied both to the user's passcode and to the device hardware. Keys cannot easily be extracted from the chip, and attempts to guess the passcode are limited and slowed down. That is why, as seen for smartphone analysis, keeping a phone on and unlocked from the start can make all the difference.
What is appropriate and what is not
Defensive digital forensics works with legitimate means: keys provided by the holder or the organisation, acquisition of already unlocked systems, recovery from authorised sources. Forcing attempts are reserved for specific contexts, with appropriate authorisations and tools, and even then they can take an extremely long time if the password is strong. Well-configured encryption with a strong password simply protects the data: that is its purpose.
In the report
When encryption limits the analysis, it must be stated clearly: which volumes were encrypted, what legitimate unlock attempts were made, with what result, and which conclusions could not be reached. A report that explains its limits is stronger than one that keeps quiet about them.
In short
- Without the key, a copy of an encrypted drive contains only unintelligible data.
- A running, unlocked system offers opportunities that shutting down erases.
- Recovery keys are often found in online accounts or corporate systems.
- On smartphones encryption is tied to hardware: the initial state is decisive.
- Limits imposed by encryption must be stated openly in the report.