6

I have a .vhd image of a BitLocker encrypted drive.

When I mount and double click the drive, BitLocker wants me to enter a 48-digit recovery key and doesn't ask for a password.

Why is that so and how can I enter a password instead?

bitlocker

Note: I don't have either the key or the password of this drive. I'm trying to brute force the password using forensic software.

4

BitLocker wants me to enter a 48-digit recovery key and doesn't ask for a password

Notes:

  • The articles quoted for this answer are for older versions of Windows.
  • Things may have changed for Windows 10.

What causes BitLocker to start into recovery mode?

Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. For information about these reasons, see Recovery scenarios in the BitLocker Drive Encryption Technical Overview.

Source BitLocker Frequently Asked Questions (FAQ)


System recovery

A number of scenarios can trigger a recovery process, for example:

  • Moving the BitLocker-protected drive into a new computer.

  • Installing a new motherboard with a new TPM.

  • Turning off, disabling, or clearing the TPM.

  • Updating the BIOS.

  • Updating option ROM.

  • Upgrading critical early boot components that cause system integrity validation to fail.

  • Forgetting the PIN when PIN authentication has been enabled.

  • Losing the USB flash drive containing the startup key when startup key authentication has been enabled.

An administrator can also trigger recovery as an access control mechanism (for example, during computer redeployment). An administrator may decide to lock an encrypted drive and require that users obtain BitLocker recovery information to unlock the drive.

...

Recovery password

The recovery password is a 48-digit, randomly generated number that can be created during BitLocker setup. If the computer enters recovery mode, the user will be prompted to type this password by using the function keys (F0 through F9).


Recovery key

The recovery key can be created and saved to a USB flash drive during BitLocker setup; it can also be managed and copied after BitLocker is enabled. If the computer enters recovery mode, the user will be prompted to insert the recovery key into the computer.

Source Recovery scenarios


I also don't have either the key or the password of this drive.

If I lose my recovery information, will the BitLocker-protected data be unrecoverable?

BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive.

Source BitLocker Frequently Asked Questions (FAQ)


It's a vhd image that I mounted.

Perhaps a vhd image triggers "Moving the BitLocker-protected drive into a new computer."?

  • I just edited my question to state that I neither have a password nor a recovery key. I'm looking forward to brute force the password using a word list and forensic software. But brute forcing will only work on a password and not a recovery key. Can this still be done? – bytecode77 Dec 16 '15 at 17:44
  • I saw your edit. But BitLocker forcing me to enter a recovery key doesn't mean that it's still not encryptable by forensic software using brute force, right? I mean, the data is still there afterall and it's encrypted with the password. – bytecode77 Dec 16 '15 at 17:47
  • Answer updated. According to MS, yes " If the computer enters recovery mode, the user will be prompted to type this password by using the function keys (F0 through F9). " – DavidPostill Dec 16 '15 at 17:48
  • However, I'm not booting from that drive. It's a vhd image that I mounted. Is there a way I can try a password instead of recovery passwords or keys? – bytecode77 Dec 16 '15 at 17:50
  • Note: The articles I quoted were for older versions of Windows. Things may have changed for Windows 10. – DavidPostill Dec 16 '15 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.