Difference between pages "TurpinMckee895" and "BitLocker: how to image"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Created page with " If we are a business proprietor with no online awareness, social media marketing course, or look engine presence, you're quickly losing business to your competitors. With [h...")
 
(Traditional Imaging)
 
Line 1: Line 1:
  
If we are a business proprietor with no online awareness, social media marketing course, or look engine presence, you're quickly losing business to your competitors. With [http://implementseo.com SMART LINK SERVICE], you are able to get a step before your associates through online business today.  
+
= Imaging Options =
Acquire Your Company into the 21st Century
+
 
Forrester Analysis states that the amount of time people invest online has increased by 121 percent in the past five many years. In 2011, it is certainly not enough to passively have a website; the internet grows in magnitude as well as luxury every hour.  
+
There are multiple ways to image a computer with bitlocker security in place.
According to eMarketer Online Mind, online sales development is probably to achieve double digits year over year this holiday season.  
+
 
This means an exponential increase in the quantity of websites advertising similar items to yours, and the amount of individuals that look for your products daily. At [http://implementseo.com Implement SEO Services], we are determined to help and also your company up-to-date and competitive with your rivals.  
+
== Traditional Imaging ==
Submit the short form to the left for a consultation with one your specialists. Our team of look motor optimization professionals may design and also implement a specific strategy to meet with the individual requirements of your company. At Implement SEO - Smart Link Service, you'll never be just a dollar sign; each customer has a designated SEO specialist who functions with him man-to-man.  
+
 
Needless to say we understand which no two websites or situations tend to be the same and tend to be pleased to consult you about the individual needs and just how to attain a high ranking for the website.
+
One can make a traditional image with the image containing encrypted information.
 +
 
 +
EnCase v6 has an optional encryption module which can decrypt the information provided the password is available.
 +
 
 +
The password is a long series of digits broken up into 8 segments.
 +
 
 +
123456-123456-123456-123456-123456-123456-13456-123456
 +
 
 +
There is no whitespace in the password including not at the end.
 +
 
 +
The password is easily recovered from a Bitlocked computer provided it can be logged into.
 +
 
 +
Thus the basic steps are:
 +
 
 +
1) Make a tradition image
 +
2) Recover the password, this can be done by booting the original computer, or by creating a clone and booting the clone. (booting from a clone has not been tested at this time.)
 +
2.1) Once booted log into the computer
 +
2.2) Use the bitlocker control panel applet to display the password.  This can also be done from the command-line.
 +
2.3) record the password
 +
3) Load the image into EnCase v6 or higher with the Encryption module installed
 +
4) You will be prompted for the password. Simply enter it and continue.
 +
5) If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase.  The new image will have unencrypted data.
 +
5.1) After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire.  Select "do not add to case".  You will be presented a dialog window to enter new information about the image.  Make sure the destination you select for your new image does not exist.

Revision as of 18:14, 2 March 2012

Imaging Options

There are multiple ways to image a computer with bitlocker security in place.

Traditional Imaging

One can make a traditional image with the image containing encrypted information.

EnCase v6 has an optional encryption module which can decrypt the information provided the password is available.

The password is a long series of digits broken up into 8 segments.

123456-123456-123456-123456-123456-123456-13456-123456

There is no whitespace in the password including not at the end.

The password is easily recovered from a Bitlocked computer provided it can be logged into.

Thus the basic steps are:

1) Make a tradition image
2) Recover the password, this can be done by booting the original computer, or by creating a clone and booting the clone.  (booting from a clone has not been tested at this time.)
2.1) Once booted log into the computer
2.2) Use the bitlocker control panel applet to display the password.  This can also be done from the command-line.
2.3) record the password
3) Load the image into EnCase v6 or higher with the Encryption module installed
4) You will be prompted for the password.  Simply enter it and continue.
5) If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase.  The new image will have unencrypted data.
5.1) After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire.  Select "do not add to case".  You will be presented a dialog window to enter new information about the image.  Make sure the destination you select for your new image does not exist.