BitLocker Disk Encryption

BitLocker Disk Encryption is a Microsoft Full Volume Encryption solution first included with the Enterprise and Ultimate editions of Windows Vista.

Indicator

Drives protected with BitLocker will have a different signature than the standard NTFS header. Instead, they have in their first sector:

EB 52 90 2D 46 56 45 2D 46 53 2D

or, in ASCII,

eR -FVE-FS-

Algorithm

The program uses either 128 or 256 AES with an elephant diffuser. See the links section for full details.

See Also

• BitLocker To Go
• Defeating Whole Disk Encryption

External Links

• Conducting forensic analysis on BitLocker protected volumes was discussed in the paper Implementing BitLocker for Forensic Analysis.
• Wikipedia entry on BitLocker
• Microsoft's Step by Step Guide
• Microsoft Technical Overview
• Microsoft FAQ
• Microsoft Description of the Encryption Algorithm
• Cold Boot Attacks, Full Disk Encryption, and BitLocker