Difference between revisions of "BitLocker Disk Encryption"

From Forensics Wiki
Jump to: navigation, search
m
(Added which editions have it)
Line 1: Line 1:
BitLocker, introduced with [[Microsoft]]'s [[Windows|Windows Vista]], is a program for full volume encryption.  
+
BitLocker ia a [[Microsoft]] [[Full Volume Encryption]] solution first included with the Enterprise and Ultimate editions of [[Windows|Windows Vista]].  
  
 
== Indicator ==  
 
== Indicator ==  
Line 8: Line 8:
  
 
The program uses either 128 or 256 [[AES]] with an elephant diffuser. See the links section for full details.
 
The program uses either 128 or 256 [[AES]] with an elephant diffuser. See the links section for full details.
 +
 +
== Recovery Keys ==
  
 
== External Links ==
 
== External Links ==

Revision as of 07:29, 10 May 2007

BitLocker ia a Microsoft Full Volume Encryption solution first included with the Enterprise and Ultimate editions of Windows Vista.

Contents

Indicator

Drives protected with BitLocker will have a different signature than the standard NTFS header. Instead, they have in their first sector, they have
EB 52 90 2D 46 56 45 2D 46 53 2D
, or, in ASCII,
eR -FVE-FS-

Algorithm

The program uses either 128 or 256 AES with an elephant diffuser. See the links section for full details.

Recovery Keys

External Links