If you have the key, EnCase Forensic with the Encryption Decryption Suite (part of EnCase 7) - should function.
Loading the image or previewed drive into entries, EnCase should prompt you for the PGP credentials. From here on in you will be able to examine the device in a decrypted state. Used it recently, was given the PGP pass-pharse and was able to extract files of relevance - via a writeblocker - without even imaging it!
If you do not wish to remove the drive from the machine - EnCase Portable has similar functionality.
↧