Bitlocker issues with Linux forensic tools

Bitstorm · 2013-03-17T20:07:10Z

We've a Win7 platform in our company. In a forensic case we need to extract the partitions, decrypt them to start analyze them.I decided to go ahead with Deftlinux for acquisition and SANS SIFT for analysation.In a forensic case i get BIOS password and bitlocker recovery key from our helpdesk to change bootorder (boot from USB memory) and So I started to do documentation how to do it on my company PC and made a dd of it.There seems to be a different making a dd from a sdaX partition on the suspect PC to extraction from a sda drive dd.I've made a dump with a USB Deftlinux Boot memory to an external USB disk.SIFT comes with dislocker pre installed (v0.2) so tried to do it with that.o Data acqisitiondcfldd if=/dev/sda bs=512 conv=noerror,sync of=/media/Evidence/[Nodename_Drive/Partition_examiner].dd (and the additional stuff to write down sha1 and md5 fingerprints in a fileI use dcfldd to see progress of doing the image in opposite to dd command.o check after image is done in SIFT (looks the same in deftlinux)I had a look on the drive dd layout with mmlssansforensics@SIFT-Workstation/media/Evidence$ mmls XXXXX_sda_hoc.dd DOS Partition TableOffset Sector 0Units are in 512-byte sectors Slot Start End Length Description00 Meta 0000000000 0000000000 0000000001 Primary Table (#0)01 —– 0000000000 0000015119 0000015120 Unallocated02 0000 0000015120 0041957999 0041942880 NTFS (0x07)03 0001 0041958000 0541265759 0499307760 NTFS (0x07)04 0002 0541265760 0625136399 0083870640 NTFS (0x07)05 —– 0625136400 0625142447 0000006048 Unallocatedsansforensics@SIFT-Workstation/media/Evidence$remarkSDA1 is a hidden service partitionSDA2 is drive CSDA3 is drive Do extraction partition from drive dddcfldd if=XXXXX_sda_hoc.dd of=XXXXX_sda3_hoc.dd bs=512 skip=$[541265760-1] count=$[625136399-541265760+1]o dd of partition on the suspect PCdd if=/dev/sda3 of=/encrypted.bitlockero comparing both partitionsroot@SIFT-Workstation/media/Evidence# ls -lntotal 667067280-rw-r–r– 1 0 0 42941767680 2013-03-16 2143 encrypted.bitlocker-rw-r–r– 1 0 0 21474754560 2013-03-14 0808 XXXXX_sda1_hoc.dd-rw-r–r– 1 0 0 255645573120 2013-03-16 1204 XXXXX_sda2_hoc.dd-rw-r–r– 1 0 0 42941767680 2013-03-16 1955 XXXXX_sda3_hoc.dd-rw-r–r– 1 0 0 320072933376 2013-03-14 1132 XXXXX_sda_hoc.dd-rw-r–r– 1 0 0 55 2013-03-14 1305 XXXXX_sda_hoc_sha1.txtencrypted.bitlocker is made with dd on the suspect PCXXXXX_sda3_hoc.dd is made with dd from the drive dd.Both have the same size but looks different in hex editorencrypted.bitlocker starts with EB 58 90 2D 46 56 45 2D 46 53 2D = .X.-FVE-FS-XXXXX_SDA3_hoc.dd starts with EC 5C 42 3B B7 FF B3 EA 91 99 39 with no valid NTFS/ bitlocker header. o dislockerdislocker -v -V encrypted.bitlocker -p – decrypted.ntfsit ask me for the recovery key and saysSun Mar 17 153851 2013 [CRITICAL] Can't initialize keys. Abort.Is there anything i made wrong on the move (wrong adress to extract)?