Because the tool is portable, you can initiate a decryption job and physically disconnect the USB drive. The decryption process runs independently on the target drive (if you are performing an offline attack or image conversion) or on your workstation. This allows one investigator to service multiple drives simultaneously.
Ensure the USB contains the efdd.exe (GUI) or efdd.com (Command line) and the supporting DLLs. elcomsoft forensic disk decryptor portable
However, there are functional differences between the standard and portable versions: Execution: The portable version runs directly via from external media. Decryption only: Because the tool is portable, you can initiate