Elcomsoft Forensic Disk Decryptor is a tool designed to provide instant access to data stored in encrypted BitLocker, FileVault 2, PGP Disk, TrueCrypt, and VeraCrypt disks and containers. It extracts cryptographic keys from RAM captures, hibernation files, and page files, or uses plain-text passwords or escrow keys to decrypt files and folders in crypto containers or mount encrypted volumes as new drive letters for real-time access. Elcomsoft Forensic Disk Decryptor supports various encryption methods including BitLocker (including TPM configurations), FileVault 2 (including APFS volumes), LUKS, LUKS2, PGP Disk, TrueCrypt, VeraCrypt, and Jetico BestCrypt.
