Support for Sophos Safeguard encryption

[fraudit]

I just want to ask whether OS Forensics supports reading disk images encrypted with Sophos Safeguard (5.6 version).

I'm gonna have such disk in my next case and I will be given the necessary user credentials to bypass the encryption. However, I don't know whether I'll be able to read it directly in OS Forensics or I should try to image it without encryption first.

[David (PassMark)]

I don't know much about Sophos Safeguard. But OSF won't decrypt the drive for you. So you'll need to unencrypt it first, either by turning off the encryption entirely, or maybe by mounting it while encrypted using the password / key. I am assuming Safeguard has some method of mounting / accessing the encrypted drive. This means you'll need a copy of the Sophos Safeguard software, but it looks like there is a free trial available.

[fraudit]

Thank you!

Yes, it is possible to recover the access when using Safeguard, though it (as expected) takes time. Taking a little shortcut would be nice