Cracking

Abstract

When working as a forensic examiner, it is not uncommon to encounter encrypted files, entire partitions, or even devices. When that is the case, the encrypted data must be decrypted in order for the forensic expert to be able to examine it. The intent of this chapter is to provide the reader with a practical overview of the steps commonly involved in the process of cracking encrypted data. While know-how and experience may be the most important skills in successful cracking, everyone needs a good tool for assistance. As such, this chapter also presents and discusses the open-source tool Hashcat that can be used for the purpose of password cracking. The chapter will also present tools for creating custom wordlists which can be utilized by Hashcat. Thus, this chapter provides the reader with a practical implementation of the theoretical knowledge that was previously introduced.