> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc.
At the firm I worked for, preservation was priority #1 any time we were walking in to a case with high trial-risk. In order to discover that the system was encrypted, I would have to use the computer. Using the computer means changing it. Protocol was really straight forward: If it's running, shut it down and get it to the lab.
Because we were working in the US Trustee system, we were dealing with business owners who were either in bankruptcy where a trustee had been appointed, or receiverships, which almost always involves a trustee (or like appointee). This means we weren't chasing kiddie porn, we were looking for the movement of money. Were we to encounter end-to-end encryption, the password is just a "motion to compel" order away. Failure to comply means you sit in a jail cell until you cough up the password.
Having said that, I don't recall ever having to go that far. Neither did we encounter any seriously hardened systems. Anyone smart enough to encrypt a system end-to-end at a company was usually on our side by the time we got there. In large businesses where this type of encryption is common, there is an IT person who can get past it. Bad business people have a tendency to make enemies out of their employees, and the trustee knew who to take care of.
In instances where we didn't have access to employees with the required knowledge to get in to systems, we relied on industry tools. We were mostly trying to crack in to things like QuickBooks files, Outlook PSTs, and protected documents, so not what you'd normally expect from a geek perspective (john, l0pht, etc). A lot of the stuff was proprietary, and at the end of the day, brute force and dictionary attacks were usually very effective.
We rarely encountered disk-level encryption on the systems we examined. App and document level passwords were the norm. I used to run the disk images through STRINGS(1) to extract every bit of text on the drive. Then, I'd break whitespace to newlines and use that as my dictionary. When you have three or four computers worth of strings, coupled with relatively unsophisticated users, you don't often strike out. We had a 100% success rate using standard crackers and the technique outlined above. It seems that users can't resist typing their password in plain text at some point in the life of their computer.
> Did you ever come across any exotic filesystems that EnCase can't read, like XFS?
I don't think I ever examined a computer that wasn't Windows XP. These were strictly business cases, so anything that wasn't Windows was a server, and that was a very rare case. Most of the time, we got approval to simply run the server systems in question to get the data we needed. The rules of engagement with servers were a little different. Servers involve a lot of multi-user access, so the chain of evidence requirements were a little different. We had to be the most careful with the personal workstations of the owners and accountants. I'd find emails requesting off-shore accounts, shell companies, etc. These had to be bulletproof in order to pin down the business owner.
I can't stress enough that I operated in a non-criminal, largely unsophisticated environment. Our rules for preservation were mostly precautionary. There was very little trial risk in our organization. It was mostly a matter of trying to identify assets and dig up any evidence that the owner was acting in a way that would put them in hot water. The trustee would use these items to squeeze the debtor in an effort to repay lenders.