Switch to full style
Anything related to computer forensics (new section!)
Post a reply

Sophos SafeGuard Enterprise v6 64 bits

February 8th, 2016, 13:24

Hello,

Does anyone know a forensic software which support Sophos SafeGuard Enterprise v6 64 bits?
I have EnCase v7 but it only supports v6 64 bits for Easy version.

Regards

Re: Sophos SafeGuard Enterprise v6 64 bits

February 8th, 2016, 13:31

What do you mean by supporting SafeGuard?

If you are talking about the activity logs from SafeGuard or Sophos UTM solutions I think they can only be analyzed trough their clients (at least that's how I do)

Re: Sophos SafeGuard Enterprise v6 64 bits

February 8th, 2016, 14:57

The evidence is an hdd encrypted with Sophos SafeGuard Enterprise v6 64 bits, I have the image of the disc so in which forensic tool can I mount the E01 image, insert the key and perform an analyze?

Regards

Re: Sophos SafeGuard Enterprise v6 64 bits

February 8th, 2016, 15:44

The data is encrypted and centrally managed. I think you'll need their central server to get the key, it's different from the user password which only authorizes the server to provide the actual encryption key to the device.

The fact is it's doing it's job and keeping you out. That's what encryption is designed to do.

Re: Sophos SafeGuard Enterprise v6 64 bits

February 10th, 2016, 21:18

Unless you have the master key you can forget it!

Re: Sophos SafeGuard Enterprise v6 64 bits

February 11th, 2016, 8:46

Hi,

After all EnCase v7 support Sophos SafeGuard Enterprise version 6 64 bits but you need to use EnCase v7 32 bits to be able to inject the key and decipher it.
Post a reply