Mount Bitlocker Drive in Windows using FVEK from Memory Dump

Introduction

Bitlocker Drive Encryption is a full disk encryption feature included in Microsoft Windows operating systems. It helps protect data by encrypting the entire hard drive or specific partitions. However, if you forget your Bitlocker recovery key, you may not be able to access your encrypted data. In such cases, you can try using a memory dump containing the Full Volume Encryption Key (FVEK) to mount the Bitlocker drive in Windows. In this article, we will discuss how to mount a Bitlocker drive in Windows using an FVEK pulled from a memory dump.

Prerequisites

Before proceeding, make sure you have the following:

A Windows system with the Bitlocker Drive Encryption feature enabled.
Access to the memory dump file containing the FVEK.
A tool like Volatility or Win32dd to extract the FVEK from the memory dump.

Extracting FVEK from Memory Dump

To extract the FVEK from a memory dump using Volatility, follow these steps:

Download and install Volatility:

https://github.com/volatilityproject/volatility

Extract the FVEK using Volatility:

vol.py --profile=Win10x64 memory_dump.dmp bitlocker extract

The output will be in the form of a .bin file. Save it as "C:\BitlockerKey.bin" for the following steps.

Mounting Bitlocker Drive in Windows

To mount the Bitlocker drive in Windows using the extracted FVEK, follow these steps:

Create a new registry key:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\MemoryManagement\PrefetchParameters /t REG_DWORD /d 0 /f

Create a new file named "BitlockerDriveMount.reg" with the following content:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\StateFlags]

"SetupWasRun"="0"

"RmPnpSvcInstall"="0"

"RmPnpSvcStart"="4"

"RmPlugAndPlay"="0"

"RmUnattendedInstall"="1"

"RmAutoActivate"="1"

"RmOemPreinstall"="0"

"RmOemSkipRguidedAdmin"="1"

"RmOemSkipMachineOemProtectedRegBack"="1"

"RmOemSkipMachineOemUnattend"="1"

"RmOemSkipRguided"="1"

"RmOemSkipRguidedAdmin"="1"

"RmOemSkipRguidedOemPreinstall"="1"

"RmOemSkipRguidedUnattend"="1"

"RmOemSkipRguidedUserData"="1"

"RmOemSkipRguidedUserDataLocale"="1"

"RmOemSkipRguidedUserDataLocaleSpecific"="1"

"RmOemSkipRguidedProductKey"="1"

"RmOemSkipRguidedProductKeyPersist"="1"

"RmOemSkipRguidedProductKeyPersistBackup"="1"

"RmOemSkipRguidedProductKeyPersistBackupLocale"="1"

"RmOemSkipRguidedProductKeyPersistBackupLocaleSpecific"="1"

"RmOemSkipRguidedProductKeyPersistBackupOemPreinstall"="1"

"RmOemSkipRguidedProductKeyPersistBackupOemPreinstallLocale"="1"

"RmOemSkipRguidedProductKeyPersistBackupOemPreinstallLocaleSpecific"="1"

"RmO

Mount Bitlocker Drive in Windows using FVEK from Memory Dump

Introduction

Prerequisites

Extracting FVEK from Memory Dump

Mounting Bitlocker Drive in Windows

Latest News