Computer Forensics JumpStart, Second Edition

Common Encryption Practices

In general, encryption provides:

Confidentiality Assurance that only authorized users can view messages

Integrity Assurance that only authorized users can change messages

Authentication Assurance that users are who they claim to be

Nonrepudiation Assurance that a message originated from the stated source

To a forensic investigator, the most common exposure to encryption occurs when confronted with encrypted files. Encryption is becoming more common for hiding file contents. Though there are other valuable uses for cryptography, such as securing communication transmissions and authenticating the originator of a message, they are beyond the scope of this discussion.

As a forensic investigator, you must understand cryptography ...