Trying to regain files wiped from a BitLocker-encrypted drive

Autopsy Help
1

Brand new to Autopsy (And Forensics in general), any help greatly appreciated retrieving lost files or observations about process followed if i’ve missed something obvious.

TL:DR;

  • Staff member wiped a VIP’s laptop without backing up files first
  • Drive is encrypted with BitLocker but i’ve got recovery password
  • We don’t zero the drive during the process (as best i’m aware), so I believe there’s a chance to salvage something from it
  • Stopped all use of machine & used FTK Imager to create a Raw (dd) image
  • Loaded it into Autopsy, ingesting all modules available
  • It indicated the presence of an encrypted volume, and appeared to complete within 30 seconds, but it’s now hanging at “75% - Analysing Files” 3 hours later. Screenshot attached.
  • The machine has not yet been re-encrypted with Bitlocker, so this implies that it has managed to find something prior to wipe that might be salvageable?

Is this delay expected and I just need to be patient?
Because I have the BL key, is there a way for me to use it to decrypt the drive and potentially recover the files?
If not, is there an alternate method or tool out there that might help with this set of circumstances?

Autopsy-Bitlocker
Autopsy-Bitlocker1813×874 205 KB

2

I don’t think autopsy does bitlocker decryption. Check any tutorial on decrypting bitlocker image with a recovery key. E.g:

Without decrypting the drive you won’t be able to extract any information.

3

Sorry for the delay.

Thanks for your response, the guide was very helpful, and under normal circumstances i’m sure that would have been enough.
Sadly though despite getting in, I wasn’t able to salvage anything from the drive.
Appreciate your help.