±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 34850
New Yesterday: 8 Visitors: 194

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

BlackBag 2018 Release 3.1 - BitLocker Compatible?

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

BlackBag 2018 Release 3.1 - BitLocker Compatible?

Post Posted: Wed Dec 05, 2018 11:56 am

Colleagues,

I ingested a DD forensic image file of a Windows 7 machine using BlackBag 2018 3.1

The main partition of the DD image is BitLocker encrypted and I have the Bitlocker key.

However, I see no mention of BitLocker compatibility in the BlackBag help guide or anywhere online at BlackBag's webiste.

There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am Very Happy .

Does anyone know if BlackLight 3.1 is compatible with Bitlocker encrypted images?:

If "yes", please advise as the steps to enter the BL key while using BlackBag.

Many thanks!  

UnallocatedClusters
Senior Member
 
 
  

Re: BlackBag 2018 Release 3.1 - BitLocker Compatible?

Post Posted: Wed Dec 05, 2018 4:31 pm

I have never unlocked a Bitlocker image in Blacklight but have always found their support to be good.

www.blackbagtech.com/support.html  

badgerau
Senior Member
 
 
  

Re: BlackBag 2018 Release 3.1 - BitLocker Compatible?

Post Posted: Thu Dec 06, 2018 3:39 am

- UnallocatedClusters

There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am Very Happy .


support @ blackbagtech.com generally works for me

Regarding bitlocker
i'd mount the image, enter the key, and then take an image of the decrypted state since blacklight most probably doesnt ingest bitlocker drives natively  

randomaccess
Senior Member
 
 
  

Re: BlackBag 2018 Release 3.1 - BitLocker Compatible?

Post Posted: Thu Dec 06, 2018 7:48 am

Thanks for the responses - yes my next step is to mount the encrypted image and then create a new unencrypted image.

Actually I am now ingesting the image in OSForensics which automatically prompts for the BL key.

My love for BlackLight is not diminished but it seems like a reasonable feature to have, IMO.  

UnallocatedClusters
Senior Member
 
 
  

Re: BlackBag 2018 Release 3.1 - BitLocker Compatible?

Post Posted: Thu Dec 06, 2018 4:17 pm

A new version of BL is coming soon, hopefully with the bitlocker decryption feature.  

dandaman_24
Senior Member
 
 

Page 1 of 1