Practical Approaches to Recovering Encrypted Digital Evidence

As more criminals use encryption to conceal incriminating evidence, forensic examiners require practical methods for recovering some or all of the encrypted data. This paper presents lessons learned from investigations involving encryption in various contexts. By presenting successful and unsuccessful case examples, this paper gives forensic examiners a clearer understanding of the feasibility and limitations of various approaches to dealing with encryption. Additionally, by demonstrating how encryption has been successfully dealt with in past investigations, this paper provides examiners with techniques that we can apply in our work and encourages us to aggressively confront encryption. 1.0 Introduction As criminals become more aware of the capabilities of forensic examiners to recover digital evidence they are making more use of encryption technology to conceal incriminating data. Organized criminals use readily available encryption software (United States v. Scarfo) and online child pornographers encrypt their communications and the files they exchange (McAuliffe, 2001). Terrorist groups such as Al Qaeda are making use