(Believe it or not, you need a real floppy disk to do this.

Using the PointSec recovery file, create Recovery Media.

If you don't have that, you are reduced to a manual brute force attack.

(This whole process assumes that you have the administrator ID and password for an administrative install of PointSec.

Acquire the PointSec recovery file from the administrator.

Live View will inform you what version of VMWare you should be running.) (You will have to have the correct versions of VMWare to read the VMDK.

Use Live View to convert the raw image to a VMDK file.

(There is an open source version of Helix you can download for free, or you can purchase Helix Pro in order to have support, if your prefer.)

Use Helix or your other favorite method to acquire a raw image of the drive to be decrypted.

You will need the dcfldd for Windows, Live View application, VMWare Server, and Helix for imaging. This can't be rocket science, right? Let me add an encrypted image to the case, key in a password, and access the data.

That being said, I STILL want PointSec, now called ' End Point Security,' to work with Guidance to create a driver that could be used to directly access the disk image and decrypt it in EnCase. It is more painful because more steps are involved, but it works. Here is a new and 'improved' method that will result in a COMPLETE decrypted image without changing the original. Images have to be converted before VMWare will recognize them. As noted in my last blog on decrypting the original, VMWare no longer recognizes a raw disk as a valid disk image. I even wrote, out of desperation, A Case for Decryption of the Original, because it would save time consuming steps and not change the data relevant to an investigation. Perhaps you remember my previous blog on EnCase and PointSec, which included my plea for Guidance Software and CheckPoint to work together to create a seamless way to decrypt drives without having to go through 20 or 30 steps to get there.

Checkpoint vmware image