cid f04a6bb93349709618141825a6199e1712efbf7779d82beea7e3bf5131a6e674 · original · open access · via openalex
Title: Techniques and methods for obtaining access to data protected by linux-based encryption – A reference guide for practitioners Authors: Ben Findlay Venue: Forensic Science International Digital Investigation Year: 2023 Canonical: doi:10.1016/j.fsidi.2023.301662 URL: https://doi.org/10.1016/j.fsidi.2023.301662 Collector: openalex OA: true ABSTRACT This research presents an overview of the typical disc and folder-level encryption that a digital forensic investigator may encounter when investigating a Linux operating system. Based on prior first-hand experience and significant follow-up testing and research, this work examines the operation of such encryption from the user's perspective, discusses how the encryption operates “under the hood”; and explores methods and techniques that can be used to access and retrieve data from such encrypted devices, both during at-scene/live forensic investigation and also post-scene. Worked examples are presented, to aid the reader's understanding. This research also presents considerations, approaches and steps that can be used by an investigator, in order to maximise the potential for data acquisition, and most crucially discusses lessons learnt to facilitate getting the best evidence in such cases. A breakdown of the binary structure of the key files associated with fscrypt is also presented, for reference. Current limitations and gaps in knowledge are also discussed.