Researchers "Elie Bursztein" from Stanford University in California have managed to bypass the encryption on a PC's hard drive to find out what websites a user has visited and whether they have any data stored in the cloud. "Commercial forensic software concentrates on extracting files from a disc, but that's not super-helpful in understanding online activity," says Elie Bursztein, whose team developed the software. "We've built a tool that can reconstruct where the user has been online, and what identity they used." The open-source software, Offline Windows Analysis and Data Extraction (OWADE), was launched at the Black Hat 2011 security conference and works with PCs running on the Windows operating system.
OWADE is in alpha version and is only available by checking out the code directly as we update it very frequently. Note that the current version has only been tested on ubuntu 10.10 against Windows XP drives. When we reach a stable version we will release a tgz.
Download Offline Windows Analysis and Data Extraction (OWADE)