Colleagues,
I ingested a DD forensic image file of a Windows 7 machine using BlackBag 2018 3.1
The main partition of the DD image is BitLocker encrypted and I have the Bitlocker key.
However, I see no mention of BitLocker compatibility in the BlackBag help guide or anywhere online at BlackBag's webiste.
There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am D .
Does anyone know if BlackLight 3.1 is compatible with Bitlocker encrypted images?
If "yes", please advise as the steps to enter the BL key while using BlackBag.
Many thanks!
I have never unlocked a Bitlocker image in Blacklight but have always found their support to be good.
https://
There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am D .
support@blackbagtech.com generally works for me
Regarding bitlocker
i'd mount the image, enter the key, and then take an image of the decrypted state since blacklight most probably doesnt ingest bitlocker drives natively
Thanks for the responses - yes my next step is to mount the encrypted image and then create a new unencrypted image.
Actually I am now ingesting the image in OSForensics which automatically prompts for the BL key.
My love for BlackLight is not diminished but it seems like a reasonable feature to have, IMO.
A new version of BL is coming soon, hopefully with the bitlocker decryption feature.