From blog.elcomsoft.com
Accessing a locked system is always a challenge. Encrypted disks and encrypted virtual machines, encrypted files and passwords are just a few things to mention. In this article we are proposing a straightforward workflow for investigating computers in the field.
Note: you may be able to perform live system analysis if the computer being investigated is turned on. Our scenario assumes that the computer is initially powered off, or powered on and locked/inaccessible.
Pre-requisites
The computer you are about to analyze is powered off. At least one available USB port. You must be able to access the computer’s BIOS/UEFI setup to enable booting from USB media.