Encountering Encrypted Evidence (potential)

Investigative activities involving computer related cases occasionally encounter files that have been encrypted. Encryption is a valid and legal process that enables anyone to protect the privacy of his or her data and/or communications. If the suspect is cooperative and provides not only the key but also the specific encryption software, investigation is simple. However, without that cooperation, analysis of potential evidence may not be practical or possible. This paper discusses alternatives where the suspect is not cooperative and keys are not provided. The outcome of the investigation may as well depend on what resources are available to the investigator.