Starting from 2023 v2, in addition to disk images in DD, IMG, BIN, E01, EX01, and AFF4 format, the Windows version of Passware Kit Business, Forensic, and Ultimate supports mounted physical drives for full disk decryption. The option is available for APFS/FileVault, BitLocker, LUKS and LUKS2, McAfee, PGP, Symantec, TrueCrypt, and VeraCrypt.
The drive should be specified as \\.\PhysicalDriveN in the Encrypted volume image field, where N is the disk number. Once you have set the mounted disk, Passware Kit analyzes it and displays its partitions and other details in the Disk Partition field.
Example:
NOTE: Passware Kit for Windows should be launched as Administrator ("Run as Administrator" option).
The disk number can be discovered using the “Disk Management” utility:
Or you can use any third-party tool, e.g. FTK Imager:
Comments
0 comments
Please sign in to leave a comment.