BitLocker Disk Encryption

From ForensicsWiki
Revision as of 01:59, 13 February 2009 by Jessek (Talk | contribs) (BitLocker moved to BitLocker Disk Encryption)

Jump to: navigation, search

BitLocker is a Microsoft Full Volume Encryption solution first included with the Enterprise and Ultimate editions of Windows Vista.


Drives protected with BitLocker will have a different signature than the standard NTFS header. Instead, they have in their first sector:
EB 52 90 2D 46 56 45 2D 46 53 2D
or, in ASCII,


The program uses either 128 or 256 AES with an elephant diffuser. See the links section for full details.

Recovery Keys

See Also

Defeating Whole Disk Encryption

External Links