9

I have a .vhd image of a BitLocker encrypted drive.

When I mount and double click the drive, BitLocker wants me to enter a 48-digit recovery key and doesn't ask for a password.

Why is that so and how can I enter a password instead?

bitlocker

Note: I don't have either the key or the password of this drive. I'm trying to brute force the password using forensic software.

2
  • To cite @RamHound's comment: If you didn't save the recovery key, and BitLocker requires the recovery key to access your data, then you are simply out of luck in the future follow the instructions and save the recovery key. This comment is under the assumption that, it is asking for the recovery key, not the password when you connect to the drive to the computer and go to mount and access the volume. (p.s. If your computer is domain joined it might be stored in the computer ActiveDoirectory object.)
    – T.Todua
    Commented Nov 21, 2021 at 6:04
  • Note, that manage-bde -unlock G: -pw doesn't seem to work in such case.
    – T.Todua
    Commented Nov 21, 2021 at 6:16

1 Answer 1

6

BitLocker wants me to enter a 48-digit recovery key and doesn't ask for a password

Notes:

  • The articles quoted for this answer are for older versions of Windows.
  • Things may have changed for Windows 10.

What causes BitLocker to start into recovery mode?

Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. For information about these reasons, see Recovery scenarios in the BitLocker Drive Encryption Technical Overview.

Source BitLocker Frequently Asked Questions (FAQ)


System recovery

A number of scenarios can trigger a recovery process, for example:

  • Moving the BitLocker-protected drive into a new computer.

  • Installing a new motherboard with a new TPM.

  • Turning off, disabling, or clearing the TPM.

  • Updating the BIOS.

  • Updating option ROM.

  • Upgrading critical early boot components that cause system integrity validation to fail.

  • Forgetting the PIN when PIN authentication has been enabled.

  • Losing the USB flash drive containing the startup key when startup key authentication has been enabled.

An administrator can also trigger recovery as an access control mechanism (for example, during computer redeployment). An administrator may decide to lock an encrypted drive and require that users obtain BitLocker recovery information to unlock the drive.

...

Recovery password

The recovery password is a 48-digit, randomly generated number that can be created during BitLocker setup. If the computer enters recovery mode, the user will be prompted to type this password by using the function keys (F0 through F9).


Recovery key

The recovery key can be created and saved to a USB flash drive during BitLocker setup; it can also be managed and copied after BitLocker is enabled. If the computer enters recovery mode, the user will be prompted to insert the recovery key into the computer.

Source Recovery scenarios


I also don't have either the key or the password of this drive.

If I lose my recovery information, will the BitLocker-protected data be unrecoverable?

BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive.

Source BitLocker Frequently Asked Questions (FAQ)


It's a vhd image that I mounted.

Perhaps a vhd image triggers "Moving the BitLocker-protected drive into a new computer."?

7
  • I just edited my question to state that I neither have a password nor a recovery key. I'm looking forward to brute force the password using a word list and forensic software. But brute forcing will only work on a password and not a recovery key. Can this still be done?
    – bytecode77
    Commented Dec 16, 2015 at 17:44
  • I saw your edit. But BitLocker forcing me to enter a recovery key doesn't mean that it's still not encryptable by forensic software using brute force, right? I mean, the data is still there afterall and it's encrypted with the password.
    – bytecode77
    Commented Dec 16, 2015 at 17:47
  • Answer updated. According to MS, yes " If the computer enters recovery mode, the user will be prompted to type this password by using the function keys (F0 through F9). "
    – DavidPostill
    Commented Dec 16, 2015 at 17:48
  • However, I'm not booting from that drive. It's a vhd image that I mounted. Is there a way I can try a password instead of recovery passwords or keys?
    – bytecode77
    Commented Dec 16, 2015 at 17:50
  • Note: The articles I quoted were for older versions of Windows. Things may have changed for Windows 10.
    – DavidPostill
    Commented Dec 16, 2015 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .