At recent TechNet events I’ve demonstrated a tool named DiskScape to show quite how easy it is to programmatically find areas of encrypted data on a hard disk. Specifically I’ve used it to show visually where I’ve applied Windows Vista’s BitLocker disk encryption capabilities. Unfortunately DiskScape remains an in-house demonstration tool and therefore I can’t share it with you. As many people have contacted me to request a copy I figured that the next best thing would be to provide a couple of images for you that you can use.
Here’s one showing an unencrypted partition:
…and here’s one showing an encypted partition:
Scanning a disk that’s not encrypted using sector by sector encryption like Bitlocker is likely to still reveal areas of encrypted data as some applications encrypt their data and administrators may use Encrypting File System (EFS) or third party tools for specific files and folders.