BitLocker: how to image - Revision history

Joachim Metz at 05:46, 17 July 2012

2012-07-17T05:46:16Z

Joachim Metz: /* See Also */

2012-03-08T06:40:46Z

‎See Also

Joachim Metz: /* See Also */

2012-03-08T06:40:30Z

‎See Also

Joachim Metz at 06:40, 8 March 2012

2012-03-08T06:40:17Z

Joachim Metz at 06:39, 8 March 2012

2012-03-08T06:39:27Z

Gregfreemyer: /* FTK Live Imaging */

2012-03-02T23:28:13Z

‎FTK Live Imaging

Gregfreemyer: /* Traditional Imaging */

2012-03-02T23:26:23Z

‎Traditional Imaging

Gregfreemyer: /* Traditional Imaging */

2012-03-02T23:14:15Z

‎Traditional Imaging

Gregfreemyer: Created page with " = Imaging Options = There are multiple ways to image a computer with bitlocker security in place. == Traditional Imaging == One can make a traditional image with the image..."

2012-03-02T23:13:27Z

Created page with " = Imaging Options = There are multiple ways to image a computer with bitlocker security in place. == Traditional Imaging == One can make a traditional image with the image..."

New page

= Imaging Options =

There are multiple ways to image a computer with bitlocker security in place.

== Traditional Imaging ==

One can make a traditional image with the image containing encrypted information.

EnCase v6 has an optional encryption module which can decrypt the information provided the password is available.

The password is a long series of digits broken up into 8 segments.

123456-123456-123456-123456-123456-123456-13456-123456

There is no whitespace in the password including not at the end.

The password is easily recovered from a Bitlocked computer provided it can be logged into.

Thus the basic steps are:

1) Make a tradition image
2) Recover the password, this can be done by booting the original computer, or by creating a clone and booting the clone. (booting from a clone has not been tested at this time.)
2.1) Once booted log into the computer
2.2) Use the bitlocker control panel applet to display the password. This can also be done from the command-line.
2.3) record the password
2) Load the image into EnCase v6 or higher with the Encryption module installed
3) You will be prompted for the password. Simply enter it and continue.
4) If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase. The new image will have unencrypted data.
4.1) After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire. Select "do not add to case". You will be presented a dialog window to enter new information about the image. Make sure the destination you select for your new image does not exist.

@@ Line 50: / Line 50: @@
 == See Also ==
 * [[BitLocker Disk Encryption]]
 * [[Defeating Whole Disk Encryption]]
 [[Category:Disk encryption]]
 [[Category:Windows]]

@@ Line 49: / Line 49: @@
 == See Also ==
-* [[BitLocker:BitLocker_Disk_Encryption]]
+* [[BitLocker Disk Encryption]]
 * [[BitLocker To Go]]
 * [[Defeating Whole Disk Encryption]]

@@ Line 49: / Line 49: @@
 == See Also ==
-* [[BitLocker:BitLocker Disk Encryption]]
+* [[BitLocker:BitLocker_Disk_Encryption]]
 * [[BitLocker To Go]]
 * [[Defeating Whole Disk Encryption]]

@@ Line 47: / Line 47: @@
 This was not attempted, but it seems reasonable to assume this will collect unencrypted files.
 [[Category:Disk encryption]]
 [[Category:Windows]]

← Older revision		Revision as of 06:39, 8 March 2012
Line 47:		Line 47:

	This was not attempted, but it seems reasonable to assume this will collect unencrypted files.		This was not attempted, but it seems reasonable to assume this will collect unencrypted files.
		+
		+	[[Category:Disk encryption]]
		+	[[Category:Windows]]

@@ Line 32: / Line 32: @@
 == FTK Live Imaging ==
-=== Live Imaging of a physical drive ===
+=== FTK Live Imaging of a physical drive ===
 Using FTK Imager lite, it was determined a live image of the physical system disk resulted in an image with an encrypted bitlocker container on it.
@@ Line 38: / Line 38: @@
 Note that the phrase "physical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
-=== Live Imaging of a logical partition ===
+=== FTK Live Imaging of a logical partition ===
 This has not been verified to work or fail at this time.
@@ Line 44: / Line 44: @@
 Note that the phrase "logical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
-=== Live Files and Folders collections ===
+=== FTK Live Files and Folders collections ===
 This was not attempted, but it seems reasonable to assume this will collect unencrypted files.

← Older revision		Revision as of 23:26, 2 March 2012
Line 29:		Line 29:
	5) If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase. The new image will have unencrypted data.		5) If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase. The new image will have unencrypted data.
	5.1) After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire. Select "do not add to case". You will be presented a dialog window to enter new information about the image. Make sure the destination you select for your new image does not exist.		5.1) After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire. Select "do not add to case". You will be presented a dialog window to enter new information about the image. Make sure the destination you select for your new image does not exist.
		+
		+	== FTK Live Imaging ==
		+
		+	=== Live Imaging of a physical drive ===
		+
		+	Using FTK Imager lite, it was determined a live image of the physical system disk resulted in an image with an encrypted bitlocker container on it.
		+
		+	Note that the phrase "physical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
		+
		+	=== Live Imaging of a logical partition ===
		+
		+	This has not been verified to work or fail at this time.
		+
		+	Note that the phrase "logical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
		+
		+	=== Live Files and Folders collections ===
		+
		+	This was not attempted, but it seems reasonable to assume this will collect unencrypted files.

@@ Line 20: / Line 20: @@
 Thus the basic steps are:
 ) Make a tradition image
 ) Recover the password, this can be done by booting the original computer, or by creating a clone and booting the clone.  (booting from a clone has not been tested at this time.)
 .1) Once booted log into the computer
 .2) Use the bitlocker control panel applet to display the password.  This can also be done from the command-line.
 .3) record the password
 ) Load the image into EnCase v6 or higher with the Encryption module installed
 ) You will be prompted for the password.  Simply enter it and continue.
 ) If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase.  The new image will have unencrypted data.
 .1) After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire.  Select "do not add to case".  You will be presented a dialog window to enter new information about the image.  Make sure the destination you select for your new image does not exist.