I have a Windows 10 System with my last 3 years of work on it. Sadly it starts since 2 weeks the boot-repair after Bitlocker PreBoot Screen Authentication.
Protectors are TPM+Pin+Key(.bek) which secure the system-partition . My tokens and TPM seem to still work and the automatic system repair leads to the menu for RE based recovery. Sadly I removed all possible boot-options to boot into Secure Mode to have at least a console shell with open system drive. In the RE-Environment the Bitlocker System-Drive seems to be (re)closed. My Questions now: Is the still working Bitlocker authentication a garantuee that the Masterkey might be recoverable by memory dumps ? If there is a possiblity: When to make the Warm-Boot Dump in this case (Manual shows only an example with normal Login-Screen) ?
Is there any way to get onto a system console at boottime before RE is started through using a boot-debugger ?
(I am just a super-poor Java Developer. I write since 24 years normaly only programs that run on the Java Virtual Machine. I have no plan of Forensics and almost no plan of real Hardware)
Is there someone in Germany that already solved the Problem and offers a cheap Forensic-Service ?Â
Thank you in advance for your time and replies.
Greetings
Marco Scherzer
Hello,
if the concerns relate to the 3 years of work, aren't you able to take out the disk and connect it to another computer through a dock? Then recover the volume using a saved Recovery Key (if you have one)?
Or did I possibly miss something? Sometimes I do 😉
Regard,
Johan