Bitlocker Images

[Sophlee]

Hi All, Apologies if this is answered elsewhere - reached the point where I can no longer see for looking..
I wondered if you could direct me to the correct place for support please.

At the moment a client of mine has supplied me with a forensic image of a drive (created in Guymager) which OSForensics recognises with the correct 2 partitions - a 500Mb and a 223.1 GB) but I am aware the drive has Bitlocker encryption installed and in use. I have the decrypt code also supplied by the customer - but am struggling to see where they key would be entered for access to the image. Any assistance would be greatly appreciated.

[JeffS]

Hi. Happy to help. It sounds like you have already completed the first step by adding the forensic image file to the case within OSF. Once you have added the image to the case through the "Add Device" dialog, you will need to go back and re-open the "Add Device" dialog and choose the "BitLocker Encrypted Drive" option toward the bottom, then select the encrypted drive from the drop-down box. You can then decrypt the image by clicking on the "Verify Key" hyperlink and entering the decryption key. There are step-by-step detailed instructions on this in the OSF Help File which you can download for free from our website at the following link: https://www.osforensics.com/downloads/OSF_help.pdf (see pages 26-29)