Bitlocker - Windows 10

However I thought Microsoft always retained the ability to decrypt Bitlocker.

Well, I would be curious to know where you found any info leading you to think that. ?

If you actually DO NOT give MS your Bitlocker key
https://theintercept.com/2015/12/28/recently-bought-a-windows-computer-microsoft-probably-has-your-encryption-key/
http//arstechnica.com/information-technology/2015/12/microsoft-may-have-your-encryption-key-heres-how-to-take-it-back/

Allow me to doubt that they will be cracking it.

jaclaz

BitLocker recovery keys CAN be stored "in the cloud" (on microsoft servers).
You'll find them at the address below but you'll need the owners Microsoft Passport details (email and password) to access

https://onedrive.live.com/recoverykey

Thank you everyone for the input. Your suggestions helped me obtain a solution.

Recap
I have verified E01's where the source machines were newer Windows 10 OS's with Bitlocker enabled. I needed access to the data however EnCase has been unsuccessful in decrypting these volumes.

Solution
Using a company Windows 10 machine with Bitlocker Version 1511 (encryption mode showing as "XTS-AES" - see image below) and Arsenal Image Mounter v2.0.010.0, I mounted the E01 file (When mounting, use the setting of 'Write Temporary'. Without this I ran into permission issues for user folders). All volumes mounted without issue and the encrypted one prompted me for the Bitlocker key. Once input I was able to view the contents of the volume as if it were an external drive.

A point worth noting - I ran a test with the Windows 10 machine encrypting a thumb drive and in the options it states this new disk encryption is not compatible with older versions of windows. The options below that statement allow the user to select either "New encryption mode…" or "Compatible mode…". This may explain why some people are able decrypt Windows 10 Bitlocker machines and other are not.

Thanks again.

Thanks a lot to you, Rapid015.

I recently had to work on the same case Imaging of a Surface Pro, Windows 10 with bitlocker.
While I never had any issue previously with other Windows 10 imaging, trying to mount this new image in Encase was impossible.

It seems like the bitlocker version used was the one mentioned by Rapid015 (XTS-AES) and we've finally been able to access the content of the image using the tool "Arsenal Image Mounter".

It's still amazing that Encase doesn't communicate on this issue, I sincerely hope it'll soon be implemented in a new version of the software.