Magnet Encrypted Disk Detector
Helping decide whether a live acquisition is needed before shutting a system down
Fast command-line triage on Windows systems
Identifying common full-disk encryption products and BitLocker indicators
Preserving decision-making time when encrypted evidence may be lost if the plug is pulled
Field use where a non-intrusive encryption check is needed first
Magnet Encrypted Disk Detector is a free command-line tool designed to quickly and non-intrusively check a Windows system for encrypted volumes. It is built for responders who need to know, fast, whether shutting a machine down could destroy access to evidence.
The tool checks local physical drives for encryption indicators associated with products such as TrueCrypt, VeraCrypt, PGP, SafeBoot, Check Point, and BitLocker. If encryption signatures are not found in the MBR, it can still display OEM ID information and, where applicable, partition volume labels while checking for BitLocker volumes.
Encrypted Disk Detector is strongest when the need is fast triage and live-response decision support. It is not a decryption tool, not an acquisition tool by itself, and not a full forensic suite.