BlackBag 2018 Relea...
 
Notifications
Clear all

BlackBag 2018 Release 3.1 - BitLocker Compatible?

5 Posts
4 Users
0 Likes
1,063 Views
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
Topic starter
 

Colleagues,

I ingested a DD forensic image file of a Windows 7 machine using BlackBag 2018 3.1

The main partition of the DD image is BitLocker encrypted and I have the Bitlocker key.

However, I see no mention of BitLocker compatibility in the BlackBag help guide or anywhere online at BlackBag's webiste.

There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am D .

Does anyone know if BlackLight 3.1 is compatible with Bitlocker encrypted images?

If "yes", please advise as the steps to enter the BL key while using BlackBag.

Many thanks!

 
Posted : 05/12/2018 5:56 pm
(@badgerau)
Posts: 96
Trusted Member
 

I have never unlocked a Bitlocker image in Blacklight but have always found their support to be good.

https://www.blackbagtech.com/support.html

 
Posted : 05/12/2018 10:31 pm
(@randomaccess)
Posts: 385
Reputable Member
 

There is not an obvious (at least to me) way to ask BlackLight support about Bitlocker compatibility so here I am D .

support@blackbagtech.com generally works for me

Regarding bitlocker
i'd mount the image, enter the key, and then take an image of the decrypted state since blacklight most probably doesnt ingest bitlocker drives natively

 
Posted : 06/12/2018 9:39 am
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
Topic starter
 

Thanks for the responses - yes my next step is to mount the encrypted image and then create a new unencrypted image.

Actually I am now ingesting the image in OSForensics which automatically prompts for the BL key.

My love for BlackLight is not diminished but it seems like a reasonable feature to have, IMO.

 
Posted : 06/12/2018 1:48 pm
(@dandaman_24)
Posts: 172
Estimable Member
 

A new version of BL is coming soon, hopefully with the bitlocker decryption feature.

 
Posted : 06/12/2018 10:17 pm
Share: