Decrypting The Drive Without A Falcon; Which Decryption Software To Use; Decrypting Using Veracrypt - Logicube F-FALCON-SA User Manual

8.3 Decrypting the drive without a Falcon

In order to mount and read an encrypted Destination drive in Windows, without using a Forensic
Falcon, Logicube recommends one of three third-party utilities called VeraCrypt, TrueCrypt or
FreeOTFE. Other utilities may work, but are not supported or tested by Logicube.
VeraCrypt can be downloaded from:
https://veracrypt.codeplex.com/
TrueCrypt can be downloaded from (for decryption purposes only):
http://truecrypt.sourceforge.net/
FreeOTFE can be downloaded from:
http://sourceforge.net/projects/freeotfe.mirror/files/latest/download
To install FreeOTFE the verification of signed drivers must be disabled. Here is a
link that might help:
http://en.kioskea.net/faq/3914-windows-7-disable-signature-verification-of-
drivers
There are other ways of installing unsigned drivers. Several different ways can be
found by searching the Internet for "install unsigned drivers".

8.3.1 Which decryption software to use?

The decryption software to use (VeraCrypt, TrueCrypt or FreeOTFE) depends on
how the Destination drive was encrypted.




8.3.2 Decrypting using VeraCrypt

Requirements:

VeraCrypt installed.

A drive encrypted by the Falcon using the VCRYPT cipher mode connected
to the computer with VeraCrypt.
Logicube Forensic Falcon™ User's Manual
VeraCrypt – Use this software if the Destination drive was encrypted
with the VCRYPT cipher mode.
TrueCrypt – Use this software if the Destination drive was encrypted
with the TC-XTS cipher mode.
FreeOTFE – Use this software if the Destination drive was encrypted
with the CBC cipher mode.
If the ECB cipher mode was used to encrypt the Destination
drive, the Falcon must be used to decrypt the drive.
DRIVE ENCRYPTION & DECRYPTION
112