Posts

Showing posts from October, 2021

Volatility Framework | Mounting BitLocker Protected Volume

Image
  The integration of strong encryption into operating systems is creating challenges for forensic examiners, potentially preventing them from recovering any digital evidence from a computer. Because strong encryption cannot be circumvented without a key or passphrase, forensic examiners may not be able to access data after a computer is shut down BitLocker drive encryption Secure Your Data! BitLocker  is a security feature added in Windows Vista (also available in any higher version) that protects a computer's file system. BitLocker encrypts disk drives and their contents. When encrypted, others cannot see your files even if the computer had been stolen or the hard disk was taken. BitLocker also works on removable storage drives. In order to access an encrypted drive, users must authenticate/login to access the data. Recovering the BitLocker Keys on Windows 8.1 and Windows 10 becomes crucial in order to carry on the investigation.This can be achieved using the following volatili