Ex01-files with bitlocker encryption

Hi all,

i can mount an external drive with ex01, ex02, … files. Then I’m able to see some volumes within the image. But this is only the first step.
But I want to add the bitlocker recovery key somewhere to be able to open the volumes and verify the content. Is this somehow possible ?
Thanks a lot

Autopsy does not currently support bitlocker decryption.

You can use Dislocker to decrypt a partition if you have the keys and then use the resulting image.

Arsenal Image Mounter from Arsenal Recon provides BitLocker drive imaging in professional (paid) mode.

Can you use Arsenal Image Mounter in free mode, mount the BitLocker image as read-only, enter the password/recovery key, and then reimage it as a decrypted drive?

I did this recently. Mount the bitclocker encrypted image in Arsenal as a read only removable drive. Enter password when prompted. Open Autopsy and choose Local Disk. I checked the box to make a VHD image so I didn’t have to keep mounting and unlocking the image. It seemed to work just fine. I’m sure you could mount/unlock the image with Arsenal and then use FTK Imager to image the drive if you wanted.