Bitlocker Recovery ...
 
Notifications
Clear all

Bitlocker Recovery Unlock

14 Posts
6 Users
0 Reactions
5,528 Views
AmNe5iA
(@amne5ia)
Estimable Member
Joined: 9 years ago
Posts: 175
 

What version of windows is encrypted with bitlocker and what version are you running encase on and trying to decrypt it with?

MS bought out a new encryption scheme XTS-AES with one of the updates to Windows 10 [version 1511]. Any version of windows previous to this will not be able to decrypt.

So, as an example, if he is running Anniversary or a Creators update of windows 10 when he encrypted the drive and you are running encase on windows 7 (which is still what guidance software recommends) then you won't be able to decrypt even with the correct recovery key.


   
ReplyQuote
(@olifer)
Trusted Member
Joined: 17 years ago
Posts: 63
Topic starter  

You're a Rock Star Amne5ia! I moved the case over to a laptop that is running Windows 10 and EnCase 8.04, used the PDE to mount the volume and the credentials are now recognized.

I can't thank you enough for helping me step back from the forest to see the trees.


   
ReplyQuote
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
 

AmNe5iA,

Your advice just allowed me to decrypt seven laptop images to my great relief.

Please PM me with your physical mailing address as I would like to send you a small gift as thanks.

I understand your advice was given here without any expectation of remuneration, but it was extremely valuable to me and my practice.


   
ReplyQuote
passcodeunlock
(@passcodeunlock)
Prominent Member
Joined: 9 years ago
Posts: 792
 

The newest version of dislocker has support for this as well, I'm quoting these from their GitHub site

Windows Vista, 7, 8, 8.1 and 10 encrypted partitions - that's AES-CBC, AES-XTS, 128 or 256 bits, with or without the Elephant diffuser, encrypted partitions;

BitLocker-To-Go encrypted partitions - that's USB/FAT32 partitions.


   
ReplyQuote
Page 2 / 2
Share: