Bitlocker
Bitlocker is a full disk encryption standard available on windows operating system from Windows 7 onwards; this tool uses AES256 to encrypt the disk. A disk encrypted by bitlocker is different than a normal NTFS disk. The signature of “-FVE-FS-” can be found at the beginning of bitlocker encrypted volumes. These volumes can also be identified by a GUID: for BitLocker: 4967d63b-2e29-4ad8-8399-f6a339e3d00 for BitLocker ToGo: 4967d63b-2e29-4ad8-8399-f6a339e3d01
DiskCryptor/TrueCrypt/VeraCrypt
DiskCryptor is based on TrueCrypt. For both DiskCryptor and TrueCrypt we can detect their presence with the following criteria: size of file or collection of clusters object is a multiple of 512, minimum size of object is 19KB, although by default is minimum 5MB, contains no specific file signature throughout the entire object, and has a high Shannon entropy or passes Chi-squared distribution test. Note that since there’s no specific signature or header left behind we can’t tell for sure if TrueCrypt (or its siblings) were used, by combination of several methods we can try to make better guess about its presence.
FileVault
Filevault is Bitlocker’s equivalent on Mac and offers full disk encryption. The signature of “encrdsa” or hex value of “65 6E 63 72 63 64 73 61” can be found at the beginning of FileVault encrypted volumes.
Cryptsetup with LUKS Linux Unified Key Setup is a disk encryption specification and can be used in cryptsetup on Linux which is a common tool for storage media volumes encryption. It is optional and users can choose not to use this format but if used we can detect its presence with “LUKS\xba\xbe” signature at the beginning of the volumes.
Check Point Full Disk Encryption At sector offset 90 of the VBR, the product identifier “Protect” can be found. Hex value “50 72 6F 74 65 63 74”
GuardianEdge Encryption Plus/Anywhere/Hard Disk Encryption and Symantec Endpoint Encryption At sector offset 6 MBR, the product identifier “PCGM” can be found. Hex value “50 43 47 4D”
McAfee Safeboot/Endpoint Encryption At sector offset 3 MBR, the product identifier “Safeboot” can be found. Hex value “53 61 66 65 42 6F 6F 74”
Sophos Safeguard Enterprise and Safeguard Easy For Safeguard Enterprise, at sector offset 119 of the MBR, the product identifier “SGM400” can be found. Hex value “53 47 4D 34 30 30 3A”
Symantec PGP Whole disk Encryption At sector offset 3 MBR, the product identifier “ëH|PGPGUARD” can be found. Hex value “EB 48 90 50 47 50 47 55 41 52 44”