<div style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;"><div class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;"><div style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;" ><a href="http://clipmarks.com/clip-to-blog/" title="see clips that are hot right now"><img src="http://content.clipmarks.com/blog_embed/6a7d58b9-98b5-45e4-a9f6-3c6d9a2382a6/9B10BA95-69DF-4208-8613-A6283CEBA421/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://grandstreamdreams.blogspot.com/2009/09/smackrel-of-forensics-honey.html" href="http://grandstreamdreams.blogspot.com/2009/09/smackrel-of-forensics-honey.html" style="font-size: 11px;">grandstreamdreams.blogspot.com</a></div><blockquote style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" cite="http://grandstreamdreams.blogspot.com/2009/09/smackrel-of-forensics-honey.html"><li style="margin-left:16px;padding-left: 0px;"><A href="http://blogs.sans.org/computer-forensics/2009/09/11/decrypting-a-pointsec-encrypted-drive-using-live-view-vmware-and-helix/" target="_blank">Decrypting a PointSec Encrypted Drive Using Live View, VMWare, and Helix</A> -- SANS Computer Forensics, Investigation, and Response blog.  It’s a lot of work but it is in process a bit similar to what I have to do using my <A href="http://grandstreamdreams.blogspot.com/2009/02/custom-win-pe-boot-disk-building-step.html" target="_blank">Custom Win PE Boot Disk</A> geared for PGP WDE systems.  You can either decrypt the entire drive (long and time consuming), or you can boot with a PGP driver-injected PE disk, pass off the encryption authentication token/passphrase, and then rip an image (through the PGP driver) of the “unencrypted” physical drive at the sector level.  I’ve done a few and it works like a champ.</LI></blockquote></div><div style="margin: 0px 6px 6px 4px;"><table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%"><tr><td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td><td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/9B10BA95-69DF-4208-8613-A6283CEBA421/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td></tr></table></div></div>

New from the makers of Clipmarks:  Amplify.com - Don't just share the news...Amplify it!