Ex01-files with bitlocker encryption

Autopsy Help
#1

Hi all,

i can mount an external drive with ex01, ex02, … files. Then I’m able to see some volumes within the image. But this is only the first step.
But I want to add the bitlocker recovery key somewhere to be able to open the volumes and verify the content. Is this somehow possible ?
Thanks a lot

#2

Autopsy does not currently support bitlocker decryption.

#3

You can use Dislocker to decrypt a partition if you have the keys and then use the resulting image.

#4

Arsenal Image Mounter from Arsenal Recon provides BitLocker drive imaging in professional (paid) mode.

#5

Can you use Arsenal Image Mounter in free mode, mount the BitLocker image as read-only, enter the password/recovery key, and then reimage it as a decrypted drive?

#6

I did this recently. Mount the bitclocker encrypted image in Arsenal as a read only removable drive. Enter password when prompted. Open Autopsy and choose Local Disk. I checked the box to make a VHD image so I didn’t have to keep mounting and unlocking the image. It seemed to work just fine. I’m sure you could mount/unlock the image with Arsenal and then use FTK Imager to image the drive if you wanted.