Decrypting Bitlocke...
 
Notifications
Clear all

Decrypting Bitlocker (Got Recovery Key)

5 Posts
4 Users
0 Reactions
3,531 Views
(@sahar55)
Active Member
Joined: 9 years ago
Posts: 16
Topic starter  

Hi guys, i got a disk image encrypted with bitlocker,
my client sent me the recovery key file so i should have what i need to decrypt it.
(i do not know the operating system of the encrypted drive)

So far i've tried mounting the img with OSFMount and then i used manage-bde on the mounted drive like so
"manage-bde.exe -unlock G -RecoveryPassword "recovery_key" "but all i got was
ERROR An error occurred (code 0x80070057)
The parameter is incorrect.

i tried to use dislocker but it didn't work out, im not sure if have operated correctly with this tool.

i'd like suggestion on how to solve this issue and decrypt the inage so i can continue the investigation, many thanks,
Sahar.


   
Quote
(@c-r-s)
Estimable Member
Joined: 14 years ago
Posts: 170
 

Hi guys, i got a disk image encrypted with bitlocker,
my client sent me the recovery key file so i should have what i need to decrypt it.
(i do not know the operating system of the encrypted drive)

So far i've tried mounting the img with OSFMount and then i used manage-bde on the mounted drive like so
"manage-bde.exe -unlock G -RecoveryPassword "recovery_key" "

You are aware of the difference between Recovery Key (keyfile initially stored to a removable drive) and Recovery Password aka Numeric Password (printed or stored to an arbitrary file system)?


   
ReplyQuote
(@sahar55)
Active Member
Joined: 9 years ago
Posts: 16
Topic starter  

Hi guys, i got a disk image encrypted with bitlocker,
my client sent me the recovery key file so i should have what i need to decrypt it.
(i do not know the operating system of the encrypted drive)

So far i've tried mounting the img with OSFMount and then i used manage-bde on the mounted drive like so
"manage-bde.exe -unlock G -RecoveryPassword "recovery_key" "

You are aware of the difference between Recovery Key (keyfile initially stored to a removable drive) and Recovery Password aka Numeric Password (printed or stored to an arbitrary file system)?

Yes, i used the numeric password
XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX


   
ReplyQuote
passcodeunlock
(@passcodeunlock)
Prominent Member
Joined: 9 years ago
Posts: 792
 

We had this error before with bitlocker, for some reason manage-bde.exe is looking for a system partition + the original Windows installation partition as well.


   
ReplyQuote
AmNe5iA
(@amne5ia)
Estimable Member
Joined: 9 years ago
Posts: 175
 

What version of Windows encrypted it? The latest versions of Windows 10 introduced XTS method of encrypting which previous version of Windows can't deal with.

I noticed though that you also tried dislocker and the latest version of that CAN cope with XTS so I can only conclude they have given you the wrong BitLocker Recovery Key.


   
ReplyQuote
Share: