Windows Encrypted Disk Detector

Encrypted Disk Detector is  a free command-line utility which checks mounted logical volumes to determine if they are encrypted. At the moment it only checks for TrueCrypt, PGP, and BitLocker encrypted volumes.

It can be used to validate if the drive is encrypted and if it can be accessed after system restart. The app is included as part of Microsoft COFEE. So what’s the use of this app? According to the developer,

EDD is useful during incident response to quickly and non-intrusively check for encrypted volumes on a computer system. The decision can then be made to investigate further and determine whether a live acquisition needs to be made in order to secure and preserve the evidence that would otherwise be lost if the plug was pulled.


As you can see from the screenshot below, one of my drive is encrypted using BitLocker. If no disk encryption signatures are found then it will display the OEM ID and the volume label for partitions(where applicable), checking for Bitlocker volumes.

Encrypted Disk Detector

Download Encrypted Disk Detector

It is a portable tool that works on Windows XP, Windows Vista, Windows 2008 Server, and Windows 7.

Advertisement
  • http://twitter.com/ltGuillaume Willem Nuijen

    Is it able to detect hidden TrueCrypt partitions?

    • Nakodari

      You can check it out yourself. I am using Bitlocker so cannot say anything about TrueCrypt.