Bitunlocker
Last updated
Last updated
During a forensic in investigation, an image of a BitLocker encrypted drive was created.
You can download the image file here:
Recently, the BitLocker Recovery Key was obtained. It is as follows 547294-589028-080982-263945-161810-145343-350845-470613.
Your task is to mount the image, decrypt the volume and optain the flag. To complete that challege you can use a windows box or a linux system.
Download and install Arsenal Image Mounter from https://arsenalrecon.com/downloads/
Mounting the image.
Open Arsenal image Mounter
Click File
Click Mount disk image file…
Select your image.dd file
Select to mount as read-only
Unlock the volume:
A bitlocker encrypted volume starts always with hex:
EB 58 90 2D 46 56 45 2D 46 53 2D
`apt-get install dislocker`
mkidr /mnt/dislock dislocker-fuse -r -V bitlocker.dd -p547294-589028-080982-263945-161810-145343-350845-470613 -- /mnt/dislock
Mount volume with dislocker file:
mkdir /mnt/image mount -o ro,loop,show_sys_files,streams_interface=windows /mnt/dislock/dislocker-file /mnt/bitlock01
gio open Flag.pdf
Your BitLocker recovery key is a unique 48-digit numerical password that can be used to unlock your system if BitLocker is otherwise unable to confirm for certain that the attempt to access the system drive is authorized. This key may be stored in your Microsoft account, printed or saved as a file, or with an organization that is managing the device. The requirement for a recovery key in these cases is a critical component of the protection that BitLocker provides your data.
