https://www.forensicfocus.com/Forums/viewtopic/t=17943/


If locked with a simple PIN try asking for the PIN. Otherwise you'll need the recovery key which you'll probably have to ask for too.

If you have a RAM image you could try using volatility to extract the FVEK (Full Volume Encryption Key). Use either https://github.com/elceef/bitlocker or https://github.com/tribalchicken/volatility-bitlocker

Then using either https://github.com/libyal/libbde or https://github.com/Aorimn/dislockeryou should then be able to unlock using the recovered FVEK.

Or you could try and brute force it? https://github.com/e-ago/bitcracker

If you are lucky the clearkey may be available in which case it should unlock automatically when emulated as a physical disk to windows or by using https://github.com/libyal/libbde or https://github.com/Aorimn/dislocker 

+ Recent posts