1

Search through existing data for passwords or keys 

When dealing with individual encrypted files, sometimes searching through other data collected from the custodian can yield password lists in .txt or Word files, or saved in Outlook. Even if it is not immediately clear what the file the password is used for, it can be added to a list of known passwords and used in a “Dictionary attack” against encrypted files (more on that later). 

2

Search the physical location from which the data was collected 

This approach relies on the custodian leaving passwords on Post-Its, whiteboards, or in notebooks around their work area. Although this may sound far-fetched, a 2018 security snafu at the Hawaiian Emergency Management Agency proves that looking for passwords stuck on monitors, under keyboards, or in desk drawers is not a lost cause.

3

Ask for passwords or recovery keys 

If full-disk encryption is used in an enterprise setting, the organisation’s IT department may hold recovery keys to unlock this data. Similarly, if you have good relations with data custodians, they may be able to provide you with one or more passwords that can be tried against encrypted files. 

4

Extract decryption keys from computer memory  

If Random Access Memory (RAM) is captured from a running system, forensic tools can be used to try to extract keys from the RAM dump. Although not foolproof, it can be a successful way to deal with an encrypted disk or volume. 

5

Use dictionary attacks 

A dictionary attack takes a list of known or commonly used passwords, and tries them one-by-one against the encrypted data. This technique relies on the fact that people often re-use their passwords, or use very predictable passwords. Depending on the size of the password list, this technique can be quite time-consuming. Tools such as Nuix Workstation or PassWare can be used to conduct dictionary attacks. 

6

Use brute force attacks 

Brute force attacks are a “trial-and-error” approach where every possible combination of characters is used to try and decrypt data. Tools such as PassWare are often used in brute force attacks. Depending on the complexity of the password used and the available computing power, this approach can take hours, days, or even months to succeed.