Skip to main content Link Menu Expand (external link) Document Search Copy Copied

dfir / win / bitlocker

Last update:

The bitlocker Key is 48 digits long.

lin-host-mount 

#? mount bitlocker partition on linux
dislocker -v -V /dev/sdb1 -p123456-123456-123456-123456-123456-123456-123456-123456 -- /mnt/tmp
ls /mnt/tmp/dislocker-file
mount -o loop,ro /mnt/tmp/dislocker-file /mnt/dis
ls /mnt/dis/

win-host-mount

convert-raw-2-vhd

Virtual Hard Disk (VHD) tool is an unmanaged code command-line tool which provides useful VHD manipulation functions including instant creation of large fixed-size VHDs. VHD Tool 2.0 tool can be obtained here.

  1. Download the VhdTool.exe to D:.
  2. Open an elevated command prompt and navigate to D:.
  3. Execute the following command: VhdTool.exe /convert raw_disk_image_filename.ntfs.

mount-vhd

  1. Open Disk Management via Start > Run > diskmgmt.msc.
  2. On the Menu bar, Action > Attach VHD.
  3. Browse to the location of the raw disk image folder. Ensure that All files (.) is selected.

NOTE: Do not checked Read-only else even when the correct recovery key is entered later on, it will alert you that it is incorrect.[2]

  1. Select Type the recovery key when prompted.
  2. Enter the recovery key and click NEXT.

NOTE: Every recovery key has a password ID. Ensure that the recovery key entered is for the password ID shown to you.

unmount-vhd

  1. Right click on the mounted VHD and click on Detach VHD.
  2. On “acme.corp”, right click and choose “Find”
  3. Choose “Computer”, type the computer name, click on “Find Now”. On section “Search Results”, pick the computer.
  4. Go to “BitLocker Recovery” tab to retrieve BitLocker Recovery Password