In response, techniques have been developed to detect whether or not an extra 'bad' volume exists within the free space of the 'good' volume. This has led to OTFE software products that provide 'plausible deniability' - one key will decrypt a 'good' volume, and another the 'bad' volume. In the UK suspects can be compelled to give the encryption key or face jail. Other software is faster and supports distributed attacks, but is still infeasible for well chosen passphrases. I built an open source tool( “Luks Volume Cracker”) that can brute force volumes encrypted with methods that FreeOTFE supports, at a rate of about 3 keys / second or 250 000 /day on a typical Dual Core 2 Ghz laptop.

If passphrase-based authentication is used, the investigator can attempt a slow dictionary attack on the volume. There have also been cases of law enforcement using keyloggers and network forensics to steal keys, though this effort and intrusion can only justified in the most extreme of cases. If they are very lucky alternative keys may be stored on backup disks for disaster recovery.

Occasionally keys will be stored on the hard drive in hibernation files, crash dumps and virtual memory. The forensic examiner is then left with less reliable methods. So far, this volatile data has been ignored due to fears of data corruption, as well as a lack of tools and training. This data could include running processes, network addresses, file fragments and time data. When investigators 'pull the plug' on a system they are losing all kinds of volatile information stored in RAM. The decryption filter and associated key will very quickly disappear from the volatile memory. However if OTFE was being used on the system, the investigator has just lost the best chance of recovering the plaintext data.

The investigator typically pulls the plug as soon as possible, then attaches a write blocker and creates a clone or virtual image. Pkcs11 authentication.The traditional approach to forensic acquisition fails when encountering encryption.

Freeotfe key cracker