Question

what does it mean when somefiles cannot be open during investigation of a suspect hard drive in digital crime? What actions should be taken by the investigator for such files??

Answer 1

There Might be changes that some encryption algorithm is applied on that. So you cannot open that file as you open any other file directly. When you copy a file in to the hard drive, via some tools you can encrypt the data and keep in to the hard drive. It appears to be user as same name, the way you copied, but when you try to open that file you need same tool with same credentials that you have given at the time of encryption.

There are many ways to do that, either you can use some tools(software), or now a days many hard drive comes with pre install tool available in the external hard drive, For example :-

• Farsler 64GB High-speed
• Integral 32GB Crypto
• StarTech USB 3.0

There are many tools are available to encrypt the file. For example:-

• Veracrytp: it is open source , free and available for windows only.

Now a days it is difficult to break those hard drive encrypt, because technology is evolved so much.

Long time ago, when you try to do hide or lock any file in your computer, so what software perform at back end is, when you copy and file in your system. The software is try to block that address for the other user OR every one, till the time you won’t use the same tool to unblock the address space. To hack those kind of system, just connects to the drive to some there system. You can easily access the same address space. But if you encrypt the file after that you copy, then it is not an easy task to break it. You either need the decrypt key otherwise you need to do Brute force attack.