Alternative to Encase to view Bitlocked E01

Magnet Forensics Axiom has a free, fully functional trial

You can use the SIFT workstation VM pretty easily
Rob Lee shows how to mount images in it and there's a python script called ImageMounter that lets you mount bitlocker stuff

You can then navigate to the shares (\\SIFTWORKSTATION) and they share out the MNT directory, which should have your mounted drives.

https://arsenalrecon.com/weapons/image-mounter/

OSFMount should be able to mount it right in Windows, and then you should have no problem handling the BitLocker from there. Or, it can convert it to a raw binary image for you.

OSFMount should be able to mount it right in Windows, and then you should have no problem handling the BitLocker from there. Or, it can convert it to a raw binary image for you.

Have you actually tried it? ?

OFS mount is a derivative of IMDISK, and as such it mountss the volume, not the disk.

The Arsenal Image Mounter (UNlike IMDSK, but by the same Author) mounts a "whole disk" image as if it was a hardware disk.

Afaik Bitlocker is a whole disk encryption and needs also the "hidden sectors" to be decoded. ?

Anyway, AIM has been tested successfully
https://www.forensicfocus.com/Forums/viewtopic/t=12904/

jaclaz

If you want open source…

https://github.com/libyal/libbde

If you want open source…

https://github.com/libyal/libbde

Well, just for the record both Imdisk and AIM are open source anyway.

OFSmount most probably should, but it isn't. cry

jaclaz

I've used this with linux with success too

https://github.com/Aorimn/dislocker

If you want open source…

https://github.com/libyal/libbde

Well, just for the record both Imdisk and AIM are open source anyway.

OFSmount most probably should, but it isn't. cry

jaclaz

I've been waiting for over a year for EnCase to get off it's a*s and support XTS-AES. I'm 90% done getting libbde incorporated as an X-Ways X-Tension… i just need some more of that stuff people call free time.