Notifications

Clear all

BitLocker experience

Cults14 · 2015-04-20T15:30:56Z

Thought I'd share a recent experience. I'm an internal corporate resource in a team of one (i.e. me). We had to get images of a number of Win7 Enterprise machines, some from "close by" and some from another continent. Corporate Policy protects Laptops with BitLocker but not Desktops.I did the "close by" ones (mix of Laptop and Desktop). Due to time constraints I used WinFE to boot all machines, then got the Bitlocker ID using manage-bde and finally called our internal service desk who supplied the Recovery Password which is stored in MBAM. Then I created Logical images in FTK Imager Lite which is part of my WinFE config by mounting the BitLocker drive in read-only mode.We used a vendor for the one in another continent, they did Physical acquisition in compressed E01 format and sent all the images to me on one 2TB drive.The only way I know how to access a physical image taken from a BitLocker'd drive is to create a VHD and attach the VHD in Disk Management, so I* Added the E01 image to FTK Imager* Exported to DD format* Converted from DD to VHD (VirtualBox "vboxmanage convertfromraw" command line)* Attached the VHD in Disk Management which gives BitLocker ID* Contact internal service desk to get the Recovery Password which is stored in MBAMAlong the way I discovered that the sector size on the 4TB drive I used to store the VHD files isn't supported by the "Attach VHD" operation so I copied them onto lower capacity capacity drives which worked just fine thereafter.And finally I decided to make a logical image in DD format on the 4TB drive of the VHD so that I would finally have everything in one place and not need BitLocker passwords!All in all a LOT of lapsed time was involved - I'd be interested in any ideas on doing this quicker (other than briefing external vendors to do either Logical acquisitions of BitLocker'd drives or to use DD format if they insist on E01 format (can't think why they would though)I use FTK Imager (and Lite) on a Dell Precision and sometimes on an older Dell Latitude E6500, and occasionally use Tableau Image Manager, I have no duplicators.Cheers

Page 3 / 3 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Cults14 10 years ago

23 Posts

8 Users

0 Reactions

4,286 Views

RSS

Adam10541

(@adam10541)

Honorable Member

Joined: 13 years ago

Posts: 550

04/06/2015 9:24 am

Success!!

Thanks to jaclaz for the lead and Mark Spencer @ Arsenal for the pointer to the updated dlls

To sum up, the aim of being able to mount a split E01 image of a Win 7 Enterprise SP1 physical disk protected by BitLocker was achieved

Thank you very much guys )

Peter

Cults by this can we assume that it was Arsenal Disk Mounter that you successfully used?

ReplyQuote

Cults14

(@cults14)

Reputable Member

Joined: 17 years ago

Posts: 367

Topic starter 04/06/2015 1:59 pm

It sure was )

ReplyQuote

Cults14

(@cults14)

Reputable Member

Joined: 17 years ago

Posts: 367

Topic starter 05/06/2015 6:54 pm

FYI I just re-created the scenario

* created physical-disk single-segment DD image from off-line Bitlocker-protected Win7 Enterprise SP1 32-bit system (booted system from WinFE USB stick and used FTK Imager Lite to create the image)

* also created physical-disk single-segment compressed E01 image from off-line Bitlocker-protected Win7 Enterprise SP1 32-bit system (booted system from WinFE USB stick and used FTK Imager Lite to create the image)

* Mounted both in Arsenal Image Mounter using the DLLs discussed earlier - in both cases I am prompted for the BitLocker Recovery Key to match the given BitLocker ID

* Both images mounted.

Have yet to test the same with 64-bit Win7 Enterprise SP1 system

HTH

ReplyQuote

Page 3 / 3 Prev

8 Forums
15.7 K Topics
92.3 K Posts
209 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed