Tweet
This is the second time I have been unable to use your software with BitLocker encryption. The previous incident was reported and the subsequent patch resolved the issue not recognizing a BitLocker volume needing decryption. The latest issue and details are as follows, Subject formatted a Windows 10 BitLocker SSD drive. Upon previewing the drive it was clearly evident the encrypted data was still there. I imaged the SSD and added the image to OSF (v7.1.1012). I then added the volume containing the deleted/formatted BitLocker volume to decrypt it with the BE-Key we recovered. OSF reported the drive was not encrypted. Unfortunately, OSF didn't recognize the deleted/formatted BitLocker volume. I subsequently created a DD-image of the deleted BitLocker volume and again attempted to decrypt it with OSF and again it reported the volume was not encrypted. I subsequently mounted the DD-image with Arsenal Image Mounter which immediately requested the BE-Key. Arsenal Image Mounter subsequently successfully decrypted and mounted the deleted encrypted volume. I then imaged decrypted volume using X-Ways. The new decrypted logical image was successfully used by both OSF and X-Ways to recover the deleted documents of interest.
I am a paid registered user of OSF and if you need more details feel free to contact me.
It would be nice if your software would recognize a deleted or formatted Bitlocker volume and decrypt it.
Regards,
Brad
Retired Police Officer (LVMPD)
DFE for Expert Data Forensics
I am a paid registered user of OSF and if you need more details feel free to contact me.
It would be nice if your software would recognize a deleted or formatted Bitlocker volume and decrypt it.
Regards,
Brad
Retired Police Officer (LVMPD)
DFE for Expert Data Forensics
Comment