This thesis compares the impact on disk performance in a GNU/Linux  environmentwith three encryption algorithms: AES,  Serpent and Twofish in three different implementations: DM-crypt, Loop-AES and Truecrypt. For all three algorithms a key length of 256 bits is used.The thesis shows that the least performance impact during data encryption, and thus file writing, is reached by using AES or Twofish encryption implemented in DM-crypt or Truecrypt. The thesis shows that some data operations with a sufficiently low processor utilization barely affects disk performance at all if encrypted using the optimal implementation and algorithm.It is also discovered that the performance impact during data decryption, or file reading, can be minimized by using the most efficient implementation and algorithm. The best results are met with the AES or Twofish cipher, regardless of implementation.An important conclusion that  is  drawn is that it is hard to determine a superior encryption solution for all purposes. However, by reviewing and examining the collected data from all aspects of disk performance the AES implementation in Truecrypt is, with small marginals, determined to be the most optimal..

When the use of encryption amongst the regular computer user grows morewidespread than ever it makes the life of the IT-forensics experts difficult.Hampering the judicial investigations that otherwise could have lead to convictions.In this report we will treat the subject of crypto analysis with a focus on decrypting files and devices encrypted with the software Truecrypt. A solution will be presented that can facilitate the future work involving encryption. The application DFEAT that has been developed during the writings of this report is faster than the corresponding software EFDD, and attacks both partitions and bitwise copies of entire harddrives where PKF fails.DFEAT is a lightweight application that is almost 50 times smaller compared to EFDD and 200 times smaller than PKF's portable version..

In contemporary encryption the vast amount of text subject to cracking has brought about the demand for methods distinguish files more likely to be encrypted. The encryption software Truecrypt can encrypt files that are not possible to identify with a file signature. To solve the detection problem, an algorithm sensitive to the absence of structure in the very code of files was developed. The program was written in the programming language EnScript which is built into the forensic software suite EnCase. The essential part of the algorithm therefore deployes the statistic of a chi-square test for deviance from a uniform distribution to distinguish files with contents that appear to be random.