Practical Cryptographic Key Recovery - Jesse Kornblum

ePAPER READ

DOWNLOAD ePAPER

jessekornblum.com

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

START NOW

Forensics Tool Marks• Requires as much elbow grease as source code analysis– Often more– Doesn't require the source code• May require updating for each version– TrueCrypt• May be your only option for previously unseen tools

Google Earth Cache Forensics - Jesse Kornblum

Applying the Science of Similarity to Computer ... - Jesse Kornblum

Windows Memory Forensics and Direct Kernel ... - Jesse Kornblum

Windows Memory Analysis - Jesse Kornblum

Windows Memory Forensics and DKOM - Jesse Kornblum

Performance• Brute Force– O(nm)• <strong>Key</strong> Schedule Search– O(nm)• Source Code– X* + O(n), where X* may be infinite• Toolmarks– X + O(n)

Page 4 and 5: Current Methods• Brute Force- Try
Page 6 and 7: Current Methods• Source code anal
Page 8: TPAM6
Page 12 and 13: BitLocker Drive Encryption• I am
Page 14 and 15: BitLocker Drive Encryption• Brute
Page 16 and 17: BitLocker Tool Marks• AES key sch
Page 18 and 19: AlgorithmPool TagAES key in schedul
Page 20 and 21: BitLocker Tool Marks• Not perfect
Page 24 and 25: Questions?• Introduction• Targe
Page 26 and 27: References• BitLocker Drive Encry

Practical Cryptographic Key Recovery - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?