The Forensic Computing Unit (FCU) can assist with the recovery of passwords when a user has forgotten their own password or more commonly, where password protected files are encountered as part of an investigation. The FCU has a number of methods for retrieving or cracking password, utilising the very latest hardware and software.
When acquiring on site, best practice of the FCU is still to check to see if there are any encrypted volumes mounted on a computer as disk encryption can be much more complex. If encrypted volumes are found to be mounted on a system when on site, a logical forensic image is made in case the volume cannot be decrypted again.