Logicube Forensic Falcon User Manual

DRIVE ENCRYPTION & DECRYPTION
Logicube Forensic Falcon™ User’s Manual 112
8.3 Decrypting the drive without a Falcon
In order to mount and read an encrypted Destination drive in Windows, without using a Forensic
Falcon, Logicube recommends one of three third-party utilities called VeraCrypt, TrueCrypt or
FreeOTFE. Other utilities may work, but are not supported or tested by Logicube.
VeraCrypt can be downloaded from:
https://veracrypt.codeplex.com/
TrueCrypt can be downloaded from (for decryption purposes only):
http://truecrypt.sourceforge.net/
FreeOTFE can be downloaded from:
http://sourceforge.net/projects/freeotfe.mirror/files/latest/download
To install FreeOTFE the verification of signed drivers must be disabled. Here is a
link that might help:
http://en.kioskea.net/faq/3914-windows-7-disable-signature-verification-of-
drivers
There are other ways of installing unsigned drivers. Several different ways can be
found by searching the Internet for “install unsigned drivers”.
8.3.1 Which decryption software to use?
The decryption software to use (VeraCrypt, TrueCrypt or FreeOTFE) depends on
how the Destination drive was encrypted.
 VeraCrypt – Use this software if the Destination drive was encrypted
with the VCRYPT cipher mode.
 TrueCrypt – Use this software if the Destination drive was encrypted
with the TC-XTS cipher mode.
 FreeOTFE – Use this software if the Destination drive was encrypted
with the CBC cipher mode.
If the ECB cipher mode was used to encrypt the Destination
drive, the Falcon must be used to decrypt the drive.
8.3.2 Decrypting using VeraCrypt
Requirements:
 VeraCrypt installed.
 A drive encrypted by the Falcon using the VCRYPT cipher mode connected
to the computer with VeraCrypt.

Logicube Forensic Falcon Specifications

General

Brand	Logicube
Model	Forensic Falcon
Category	Storage
Language	English