Detection and Identification of Software Encryption Solutions in NT-based Microsoft Windows Operating Systems

As encrypted information is very difficult or impossible to reconstruct, there are many situations in which it is critical to detect the presence of encryption software before a computer is shut down. Currently there is no solution that reliably identifies installed encryption software.;For this investigation, thirty encryption software products for Microsoft Windows based on the NT-kernel have been identified and investigated. Operating system dependent factors such as registry, file attributes, operating system attributes, process list analysis and independent factors such as file headers, keyword search, Master Boot Record analysis as well as hashing of software components were investigated and allow the identification of these programs. The most reliable detection rate is achieved through a combination of the aforementioned factors.

Name thesis:degree_name

MS

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Lane Department of Computer Science and Electrical Engineering

Year dc:date.available

2013

Author dc:creator

• Breyer, Julian

Contributors dc:contributor

• Roy Nutter
• Katerina Goseva-Popstojanova
• James Mooney

• Computer science

Identifier

https://researchrepository.wvu.edu/etd/337

OAI identifier oai:identifier

oai:researchrepository.wvu.edu:etd-1340