I can't open the image file that taken from my windows 10 installed disk which encrypted with bitlocker.
The problem is that I have only bitlocker password but i don't have recovery key. I can mount the disc but I can't open the disc.
The image file format is 'FTK Imager E01'. How can I open this image file without recovery key? I just know bitlocker password.
If I can open it as a virtual computer, I know it's in windows crypt. Can I convert this image file to VMDK format?
By the way, I am not a forensic master.
Is it an image taken from your own machine? If so, why don't you just use PowerShell to query the Bitlocker creds?
If you use the manage-bde command along with the get-protectors for the volume in question you can retrieve the recovery key that way.
If it's a forensic exhibit though (not clear on that or if you're just playing with your own machine), you could use EnCase to mount it as an emulated disk and then put your Bitlocker password in that way.
Hope that helps.
Is it an image taken from your own machine? If so, why don't you just use PowerShell to query the Bitlocker creds?
If you use the manage-bde command along with the get-protectors for the volume in question you can retrieve the recovery key that way.
If it's a forensic exhibit though (not clear on that or if you're just playing with your own machine), you could use EnCase to mount it as an emulated disk and then put your Bitlocker password in that way.
Hope that helps.
I formatted the disk unfortunately (