Join Us!

BlackBag 2018 Relea...
 
Notifications
Clear all

BlackBag 2018 Release 3.1 - BitLocker Compatible?  

  RSS
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Colleagues,

I ingested a DD forensic image file of a Windows 7 machine using BlackBag 2018 3.1

The main partition of the DD image is BitLocker encrypted and I have the Bitlocker key.

However, I see no mention of BitLocker compatibility in the BlackBag help guide or anywhere online at BlackBag's webiste.

There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am D .

Does anyone know if BlackLight 3.1 is compatible with Bitlocker encrypted images?

If "yes", please advise as the steps to enter the BL key while using BlackBag.

Many thanks!

Quote
Posted : 05/12/2018 5:56 pm
badgerau
(@badgerau)
Member

I have never unlocked a Bitlocker image in Blacklight but have always found their support to be good.

https://www.blackbagtech.com/support.html

ReplyQuote
Posted : 05/12/2018 10:31 pm
randomaccess
(@randomaccess)
Active Member

There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am D .

support@blackbagtech.com generally works for me

Regarding bitlocker
i'd mount the image, enter the key, and then take an image of the decrypted state since blacklight most probably doesnt ingest bitlocker drives natively

ReplyQuote
Posted : 06/12/2018 9:39 am
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Thanks for the responses - yes my next step is to mount the encrypted image and then create a new unencrypted image.

Actually I am now ingesting the image in OSForensics which automatically prompts for the BL key.

My love for BlackLight is not diminished but it seems like a reasonable feature to have, IMO.

ReplyQuote
Posted : 06/12/2018 1:48 pm
dandaman_24
(@dandaman_24)
Active Member

A new version of BL is coming soon, hopefully with the bitlocker decryption feature.

ReplyQuote
Posted : 06/12/2018 10:17 pm
Share: