An increasing concern for privacy and widespread availability of encryption products has led to the use of encryption for individual files and even entire devices. Briefly discuss the current state of encryption with respect to forensic investigation.

As investigators, we are limited to the information on the device that we can access. If a hard drive is fully encrypted, we have no easy access to the stored data and our investigative options become limited. The first thing an investigator must do is to determine the level and extent of the encryption. Weak passwords can be cracked, but if the user has implemented a strong password it becomes almost impossible to access via brute force methods. It could be that just a few files are encrypted and there could be unencrypted copies elsewhere on the device. The user could also be a creature of habit and use the same set of passwords. These passwords can be quickly located in easily decipherable formats throughout the system. In all cases, though, I tell investigators that digital evidence is just one piece of the body of evidence in a case. Don't fall into a trap where you spend too much time trying to decrypt a potentially probative item, when valuable unencrypted data may be found by simply continuing your examination