{"id":24489,"date":"2024-05-13T03:21:06","date_gmt":"2024-05-13T11:21:06","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2024\/05\/13\/news-18219\/"},"modified":"2024-05-13T03:21:06","modified_gmt":"2024-05-13T11:21:06","slug":"news-18219","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2024\/05\/13\/news-18219\/","title":{"rendered":"Extracting data from encrypted virtual disks: six methods"},"content":{"rendered":"

Credit to Author: Angela Gunn| Date: Mon, 13 May 2024 08:30:24 +0000<\/strong><\/p>\n

\n

This article explains various techniques and readily available tools for extracting data from an encrypted virtual disk. For incident-response situations in which the entire virtual disk has been encrypted, these tools and techniques may \u2013 may<\/u><\/em> \u2013 enable the investigating team to retrieve data from the encrypted system.<\/p>\n

Efforts to extract data from encrypted virtual disks can potentially lead to multiple positive outcomes: recovering customer data that is irretrievable via standard methods, helping rebuild virtualized customer infrastructure that has been compromised, and \/ or enriching an incident investigation timeline. So far, we\u2019ve used these techniques successfully in DFIR investigations involving the LockBit, Faust \/ Phobos, Rhysida, and Akira ransomware groups.<\/p>\n

We\u2019ll say this at the beginning of the article and we\u2019ll say it again at the end: Results are not guaranteed. No data-extraction method in existence is certain to yield full data from an encrypted VM. We will also highlight that while these methods have seen quite a high success rate in extracting forensic data that is valuable for the investigation (such as event logs, registry forensics, and the like), the success rate of retrieving data that can be used as part of the recovery process of production systems, such as databases, is much lower.<\/p>\n

We strongly recommend that any recovery attempts should be conducted on \u201cworking copies\u201d and not the originals, lest the attempts cause unintended further damage to the devices.<\/strong><\/p>\n

In the next section we\u2019ll discuss in which situations retrieval may be possible and to what extent. After that, we\u2019ll list some factors to take into consideration as you select which methods you\u2019ll attempt. Finally, we\u2019ll look at each method, listing the prerequisites (the tools required to attempt the method; all are required) and flagging other considerations. In the discussion of the most labor-intensive method, we\u2019ll walk through the details of the process. In this article, references to \u201cvirtual disks,\u201d \u201cVM\u2019s,\u201d or \u201cdisk images\u201d all refer to the same thing and can be any image of a disk such as VHD, VHDX, VMDK, RAW, and so on. All six techniques apply to Windows; a few also may work on Linux, and we\u2019ll note those in each case.<\/p>\n

What is file \/ disk encryption?<\/strong><\/h3>\n

When ransomware encrypts a virtual disk (or any file), the data has been essentially randomized, rendering the file unreadable by the operating system. The most well-known method of decrypting a file (returning the file to its original, readable state) is via a decryptor, a software tool or program designed to reverse the process of encryption, making encrypted files readable again.<\/p>\n

In ransomware attacks, the decryptor is created and controlled by the threat actor. In those situations, unless the ransom is paid or the decryptor becomes publicly available, other methods of data recovery must be considered.<\/p>\n

Ransomware binaries prioritize speed over thorough encryption. Encrypting entire files would be too time-consuming, so the attackers aim to inflict maximum damage swiftly, minimizing the window for intervention. Consequently, while smaller files like documents are usually fully encrypted, larger ones such as virtual disks may have significant portions left unencrypted. This provides investigators with opportunities to employ diverse techniques for extracting information from these virtual disks.<\/p>\n

Which method to use: Considerations<\/strong><\/h3>\n

There are multiple methods that can be used when looking to extract data from an encrypted Windows VM. (A few of these techniques are applicable to Linux recovery attempts as well, and we\u2019ll indicate those.) In this article we will cover six:<\/p>\n