All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Sophos SafeGuard Enterprise v6 64 bits
PostPosted: February 8th, 2016, 13:24 
Offline

Joined: October 20th, 2015, 9:51
Posts: 5
Location: Paris
Hello,

Does anyone know a forensic software which support Sophos SafeGuard Enterprise v6 64 bits?
I have EnCase v7 but it only supports v6 64 bits for Easy version.

Regards


Top
 Profile  
 
 Post subject: Re: Sophos SafeGuard Enterprise v6 64 bits
PostPosted: February 8th, 2016, 13:31 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 176
Location: Portugal
What do you mean by supporting SafeGuard?

If you are talking about the activity logs from SafeGuard or Sophos UTM solutions I think they can only be analyzed trough their clients (at least that's how I do)

_________________
BTC Wallet - 16S1yq41ehJr9Kh8GeA2cgSYLt397XKU4Q


Top
 Profile  
 
 Post subject: Re: Sophos SafeGuard Enterprise v6 64 bits
PostPosted: February 8th, 2016, 14:57 
Offline

Joined: October 20th, 2015, 9:51
Posts: 5
Location: Paris
The evidence is an hdd encrypted with Sophos SafeGuard Enterprise v6 64 bits, I have the image of the disc so in which forensic tool can I mount the E01 image, insert the key and perform an analyze?

Regards


Top
 Profile  
 
 Post subject: Re: Sophos SafeGuard Enterprise v6 64 bits
PostPosted: February 8th, 2016, 15:44 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1615
Location: Providence, RI
The data is encrypted and centrally managed. I think you'll need their central server to get the key, it's different from the user password which only authorizes the server to provide the actual encryption key to the device.

The fact is it's doing it's job and keeping you out. That's what encryption is designed to do.

_________________
Hard Drive & RAID Data Recovery Services
https://www.data-medics.com/raid-data-recovery/


Top
 Profile  
 
 Post subject: Re: Sophos SafeGuard Enterprise v6 64 bits
PostPosted: February 10th, 2016, 21:18 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 176
Location: Portugal
Unless you have the master key you can forget it!

_________________
BTC Wallet - 16S1yq41ehJr9Kh8GeA2cgSYLt397XKU4Q


Top
 Profile  
 
 Post subject: Re: Sophos SafeGuard Enterprise v6 64 bits
PostPosted: February 11th, 2016, 8:46 
Offline

Joined: October 20th, 2015, 9:51
Posts: 5
Location: Paris
Hi,

After all EnCase v7 support Sophos SafeGuard Enterprise version 6 64 bits but you need to use EnCase v7 32 bits to be able to inject the key and decipher it.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group