FTK Imager E01 Bitl...
 
Notifications
Clear all

FTK Imager E01 Bitlocker Problem.

3 Posts
2 Users
0 Likes
1,479 Views
 xLab
(@xlab)
Posts: 2
New Member
Topic starter
 

I can't open the image file that taken from my windows 10 installed disk which encrypted with bitlocker.
The problem is that I have only bitlocker password but i don't have recovery key. I can mount the disc but I can't open the disc.
The image file format is 'FTK Imager E01'. How can I open this image file without recovery key? I just know bitlocker password.
If I can open it as a virtual computer, I know it's in windows crypt. Can I convert this image file to VMDK format?
By the way, I am not a forensic master.

 
Posted : 08/08/2018 8:44 am
hectic_forensics
(@hectic_forensics)
Posts: 40
Eminent Member
 

Is it an image taken from your own machine? If so, why don't you just use PowerShell to query the Bitlocker creds?

If you use the manage-bde command along with the get-protectors for the volume in question you can retrieve the recovery key that way.

If it's a forensic exhibit though (not clear on that or if you're just playing with your own machine), you could use EnCase to mount it as an emulated disk and then put your Bitlocker password in that way.

Hope that helps.

 
Posted : 08/08/2018 10:56 am
 xLab
(@xlab)
Posts: 2
New Member
Topic starter
 

Is it an image taken from your own machine? If so, why don't you just use PowerShell to query the Bitlocker creds?

If you use the manage-bde command along with the get-protectors for the volume in question you can retrieve the recovery key that way.

If it's a forensic exhibit though (not clear on that or if you're just playing with your own machine), you could use EnCase to mount it as an emulated disk and then put your Bitlocker password in that way.

Hope that helps.

I formatted the disk unfortunately (

 
Posted : 08/08/2018 1:06 pm
Share: