7
I have a .vhd
image of a BitLocker encrypted drive.
When I mount and double click the drive, BitLocker wants me to enter a 48-digit recovery key and doesn't ask for a password.
Why is that so and how can I enter a password instead?
Note: I don't have either the key or the password of this drive. I'm trying to brute force the password using forensic software.
I just edited my question to state that I neither have a password nor a recovery key. I'm looking forward to brute force the password using a word list and forensic software. But brute forcing will only work on a password and not a recovery key. Can this still be done? – bytecode77 – 2015-12-16T17:44:26.807
I saw your edit. But BitLocker forcing me to enter a recovery key doesn't mean that it's still not encryptable by forensic software using brute force, right? I mean, the data is still there afterall and it's encrypted with the password. – bytecode77 – 2015-12-16T17:47:40.283
Answer updated. According to MS, yes " If the computer enters recovery mode, the user will be prompted to type this password by using the function keys (F0 through F9). " – DavidPostill – 2015-12-16T17:48:39.693
However, I'm not booting from that drive. It's a vhd image that I mounted. Is there a way I can try a password instead of recovery passwords or keys? – bytecode77 – 2015-12-16T17:50:21.433
Note: The articles I quoted were for older versions of Windows. Things may have changed for Windows 10. – DavidPostill – 2015-12-16T17:51:16.807
"It's a vhd image that I mounted". Don't know about that. Sorry. Perhaps a vhd image is "Moving the BitLocker-protected drive into a new computer."? – DavidPostill – 2015-12-16T17:51:57.757
@bytecode77 You could try
manage-bde -unlock V: -password
{enter} and see if it gives back a password prompt. - Maybe you have in the mean time, did it work? – A71 – 2016-05-11T22:23:07.977