Dislocker, a free tool to decrypt Bitlocker volumes

Dislocker is a Linux and Mac OS X computer forensics tool to read Bitlocker encrypted partitions, it can be used with FUSE (Filesystem in Userspace), a loadable Unix Kernel module, or without it, once the partition has been decrypted you can mount it as NTFS and read or copy everything.

Bitlocker is a Microsoft utility designed with businesses in mind to fully encrypt a hard drive, it is only available in Windows Ultimate, Enterprise and Server platforms, Windows 8 will include it too. The encryption key can be stored inside a Trusted Platform Module chip found in high end computer motherboards. Although there is not known Bitlocker backdoor most businesses will ask for a password recovery option, Bitlocker allows you to create a recovery key that can be printed or stored in external media.

Hard drive Bitlocker encryption

Hard drive Bitlocker encryption

Bitlocker uses AES encryption in CBC mode with an optional Elephant diffuser, the Full Volume Encryption Key (FVEK) will be the same size as the encryption strength used, i.e. when encrypted with AES128bit the FVEK is 128bits long, in AES256bit mode the FVEK is 256bits long and if the Elephant diffuser is used the encryption key will be 512 bits long.

Dislocker is not a tool to crack a Bitlocker encrypted drive, the idea is to help investigators who already own the recovery password, external key file (BEK) or a clear key to access the volume, other tools like Encase can already do that but they are not free like Dislocker. The only approach to break a fully encrypted drive is getting hold of the computer while it is switched on and extract the encryption keys from RAM or try to brute force the passphrase in case the user has been stupid enough to use a dictionary word.

Visit Dislocker homepage

Leave a Reply