Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a Western Digital external drive (my passport essential 500GB), which comes with a little software that allows you to encrypt your data (which I did sometime ago). Unfortunately, this software is windows only... Since I have a new laptop, on which I don't have windows (and don't want it), I can't access my data anymore (wine didn't help in this case).

My question is: is there a way to detect the encryption scheme that was used to encrypt the data, and if so, what can I do to decipher it (fortunately, I still have the password)?

PS: of course, I could try to find a window device somewhere, but I am really curious about this!

share|improve this question

1 Answer

up vote 2 down vote

Probably the best place to start is to find out which software was used to encrypt the data. Without knowing that little bit, the answer could be anything.

As for the drive itself, you could try viewing the start of the data in a hex editor and see if you notice any patterns. Such would be an artifact not of the encryption scheme but rather of the software that was used to put it there. Encryption only leaves noise, but sometimes the software you use to encrypt the data will leave its own fingerprints.

The best way to get your utility to run is probably in virtualization. Install your software in a windows VM and attach your drive to the VM as a raw device.

share|improve this answer
And to make sure that no modification is done to the disk; do a dd if=/dev/_thedisk of=~/some_img.img for backup (if there's space for that). Also, to divide the image into chunks, use split, as editing one 500 GB file may pose a problem. – Henning Klevjer Nov 6 '12 at 6:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.