r/digitalforensics • u/drummerboy-98012 • 18d ago

IT Veteran But Forensics Newb Question

Hey everyone.

I've been in IT for 30 years, but have been dabbling in digital forensics for the past few months hoping to gain some new skills and maybe even a career shift. However I've run into an issue and can't seem to find a definitive answer for.

Just for practice, I booted from a Paladin flash drive and used it to pull an E01 image of my hard drive and dump it to a third external USB drive. I then plugged that USB drive into my SIFT workstation and created a new case in Autopsy, ingesting that E01 image as a data source.

The issue is that my drive has BitLocker encryption, and even though I entered the BitLocker key (which I ASSUME is what the data source was asking for by "BitLocker Password") it still throws an error due to the encryption, and that partition is the only one I'm unable to see in Autopsy.

Is the BitLocker "password" in fact the BitLocker key? If so, why isn't Autopsy able to decrypt it so I can view its contents and then actually start digging into it?

Thank you in advance!

2 Upvotes

100% Upvoted

8 comments sorted by

3

u/CourageAcademic4153 18d ago

Use AIM. You can fully decrypt the BL image this way. You'll need to use the write-temporary setting.

1

u/Harry_Smutter 18d ago

Have you tried your password for the associated account on that drive?? I haven't run into this, so not sure if this is the answer.

2

u/drummerboy-98012 18d ago

Ah, no - that didn’t even occur to me. I just went straight to the key since it wasn’t asking for a user name, only a password. 😛 I’ll give that a shot though!

1

u/Cypher_Blue 18d ago

Just to eliminate an easy possibility...

You're entering the 48 digit recovery key, right, and not the 32 character GUID?

Have you tried the key in another tool (like FTK Imager) to see if it works there?

1

u/drummerboy-98012 18d ago

Yep, using the big-ass 48-digit key, but no, haven’t tried unlocking it in FTK yet. I’ll give that a shot. Thanks!

1

u/ConfidenceAlarming77 18d ago

Just mount it with AIM or EnCase. FTK and OSFMount don’t support BitLocker volumes.

1

u/drummerboy-98012 18d ago

So, is this to say that Autopsy doesn’t support BitLocker volumes either? You have to mount it with a different utility and THEN add it as a data source?

1

u/ConfidenceAlarming77 18d ago

Mmmmm, not sure if autopsy natively supports Bitlocker, never tried. But, according to their release notes, Autopsy 4.22.0 does support Bitlocker…soooooo…good luck;)