# Bitunlocker

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FHukWtnfMLJfXRlMaiYU1%2Fbitunlocker.png?alt=media&#x26;token=2b44fdab-3ffd-44b1-9955-c791cd7c77a2" alt=""></div>

### 1. Introduction

* During a forensic in investigation, an image of a BitLocker encrypted drive was created.
* You can download the image file here:

{% embed url="<https://www.dropbox.com/s/wms05yp1h9aamut/BitLocker.zip?dl=0>" %}

* Recently, the BitLocker Recovery Key was obtained. It is as follows\
  **547294-589028-080982-263945-161810-145343-350845-470613**.

Your task is to mount the image, decrypt the volume and optain the flag. To complete that challege you can use a windows box or a linux system.

### 2. Solution with windows

Download and install Arsenal Image Mounter from <https://arsenalrecon.com/downloads/>

Mounting the image.

* Open Arsenal image Mounter
* Click File
* Click Mount disk image file…
* Select your image.dd file
* Select to mount as read-only

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FksSzBmtyv7abij50BS5v%2Fbitunlocker02.png?alt=media&#x26;token=3d62096c-2f6a-41b6-bc39-f611e989e698" alt=""></div>

Unlock the volume:

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FKRhcECQxLEUMkiIfcqRR%2Fbitunlocker03.png?alt=media&#x26;token=a52a6807-7570-4b3a-a208-fbb97d4393be" alt=""></div>

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FRLRNlnJDXsWTIzzv8whQ%2Fbitunlocker05.png?alt=media&#x26;token=94ac55bf-e86c-49e9-a7b1-c9710356141c" alt=""></div>

### 3. Grab the flag in windows

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FLa1jPJZatIEr5JE8uXH7%2Fbitunlocker06.png?alt=media&#x26;token=d6732795-a32b-400d-864d-00efdc9aabf1" alt=""></div>

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FIAdM0z0XnXLt2kTLK3Yy%2Fbitunlocker07.png?alt=media&#x26;token=55f93002-30b9-4020-838b-3de2a1354c64" alt=""></div>

### 4. Solution with Linux

A bitlocker encrypted volume starts always with hex:\
`EB 58 90 2D 46 56 45 2D 46 53 2D`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2F7h3gLnTc3kEk8T2b78Pn%2Fdislock01.png?alt=media\&token=d73be312-ee0f-48e6-a3bd-886a8484cf7d)

`` `apt-get install dislocker` ``

`mkidr /mnt/dislock dislocker-fuse -r -V bitlocker.dd -p547294-589028-080982-263945-161810-145343-350845-470613 -- /mnt/dislock`

Mount volume with dislocker file:

`mkdir /mnt/image mount -o ro,loop,show_sys_files,streams_interface=windows /mnt/dislock/dislocker-file /mnt/bitlock01`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2Fu2FAhjok16eTJHNuyQJ3%2Fdislock02.png?alt=media\&token=e7cbec34-571c-4ea2-866f-951486416b6b)

### 5. Grab the flag in linux

`gio open Flag.pdf`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FXzcAEwG89HbnbGGmsIoD%2Fdislock03.png?alt=media\&token=f3e9d8bd-f399-42f9-b810-a3b96ab98c8f)

### 6. Where to find Bitlocker Recovery key

Your BitLocker recovery key is a unique 48-digit numerical password that can be used to unlock your system if BitLocker is otherwise unable to confirm for certain that the attempt to access the system drive is authorized. This key may be stored in your Microsoft account, printed or saved as a file, or with an organization that is managing the device. The requirement for a recovery key in these cases is a critical component of the protection that BitLocker provides your data.

{% embed url="<https://support.microsoft.com/en-us/windows/finding-your-bitlocker-recovery-key-in-windows-6b71ad27-0b89-ea08-f143-056f5ab347d6>" %}