I have tried everything to decrypt this bitlocker file given in the link. I don't know the password or recovery key but I have to crack it that's my task. The key may be hidden in the header of the file, I can predict it but every decoding scheme is a failure. Anybody know a way? The link to the file is given below.
https://drive.google.com/file/d/1t2P9mq1I9-TA29b3s30TImOmpD6bNKR5/view?usp=share_link
Help!!!!! Also I tried Access Data FTK Imager, Passware, Elcomsoft Decrypt.
Just for teh lulz 🙂
Â
./bitlocker2john -i secret.vhdx
User Password hash:
$bitlocker$0$16$e5ae936df32f9d27331182491d911be3$1048576$12$30b9318b7dfdd70103000000$60$6b9a0a46e92a97b2f00f1d7718ac71261c719c67c478ddf9336b0c60a3f8a5f39173f84900f9d0b4aa301ff2945bfce649ef4a91a8b15aa4743dde39
Hash type: User Password with MAC verification (slower solution, no false positives)
$bitlocker$1$16$e5ae936df32f9d27331182491d911be3$1048576$12$30b9318b7dfdd70103000000$60$6b9a0a46e92a97b2f00f1d7718ac71261c719c67c478ddf9336b0c60a3f8a5f39173f84900f9d0b4aa301ff2945bfce649ef4a91a8b15aa4743dde39
Hash type: Recovery Password fast attack
$bitlocker$2$16$50a4f0d6c7d9fbe485c8288aec2d5f50$1048576$12$30b9318b7dfdd70106000000$60$cb37b5378715e115ecf57dc29bacba2c9fe42a435afa599c14d74c46c08d6bd5ec0623b4794e4d305622be03dd3f7abad446a9201a8742768212e9a6
Hash type: Recovery Password with MAC verification (slower solution, no false positives)
$bitlocker$3$16$50a4f0d6c7d9fbe485c8288aec2d5f50$1048576$12$30b9318b7dfdd70106000000$60$cb37b5378715e115ecf57dc29bacba2c9fe42a435afa599c14d74c46c08d6bd5ec0623b4794e4d305622be03dd3f7abad446a9201a8742768212e9a6
Â
hashcat -O -m 22100 -a 0 -w 3 hash1.hash ~/wordlists/rockyou.txt -o cracked_password.txt
cat cracked_password.txt:
$bitlocker$1$16$e5ae936df32f9d27331182491d911be3$1048576$12$30b9318b7dfdd70103000000$60$6b9a0a46e92a97b2f00f1d7718ac71261c719c67c478ddf9336b0c60a3f8a5f39173f84900f9d0b4aa301ff2945bfce649ef4a91a8b15aa4743dde39:poohbear
