1

I'm facing a situation, where I'd like to decrypt a "corrupted" Bitlocker protected drive (Windows 10 Partition) by using the known 48-digit recovery key. Corrupt means, I executed a restore (Windows internal restore of a System Image) procedure that got stuck, leaving me with an, as it seems, unusable Bitlocker header, so that the Microsoft tools repair-bde or manage-bde -status don't recognize the drive as a Bitlocker-protected one.*

Does anybody know how to decrypt the encrypted raw disk image by using the recovery key, to get another (but decrypted) raw disk image (with which I could perform further data restore steps)?


* As this is not directly relevant to the question (but the topic may occur) I'm going to describe my situation for those interested in more detailed here: Notebook without TPM. Two fixed drives, one with Windows 10, Bitlocker protected, and a secondary (data) drive, Bitlocker protected as well. The second one was set-up for auto-unlock when booting up the OS. System Image (Windows internal Back up and restore function) existent on the Second drive, which I tried to restore two the primary drive. That restore process crashed, leaving me with an unusable system. Three obvious mistakes (yep, I learned my lesson...): 1. I don't have another backup on an independent (external) drive, 2. I didn't create an raw-image of the intact system drive before using the fragile Windows restore, 3. I only have the user-defined password for this second drive and not the recovery key (48-digit or .bek file). Unfortunately the password by itself takes me nowhere without the OS that I just killed, respectively switching to auto-unlock seems to change the "keychain", so at the moment accessing the backup of the first drive is impossible.

The last two approaches I had in mind are to see what I can rescue from the primary drive, and to see, whether I can extract the stored auto-unlock key (further reading on this here), to unlock the secondary drive, with the intact system image on it.

migrated from crypto.stackexchange.com Dec 31 '18 at 0:43

This question came from our site for software developers, mathematicians and others interested in cryptography.

0

Update on this: it seems that the Microsoft restore process first wipes the drive, and then restores the image unencrypted (at least to the point where it crashed) probably before encrypting it again. Therefore I am now able to restore the relevant User Data on the primary OS drive with conventional recovery tools.

As I wrote beforehand the computer has a fixed second Bitlocker encrypted drive, which was set to auto-unlock before the faulty Windows restore process.

With the recovery of the primary drive I was able to get the Data Key stored in the registry at

HKLM\SYSTEM\CurrentControlSet\Control\FVEAutoUnlock\

which starts with 70 00 00 00 09 00 00 00 14 aa 47 e0 89 4e 0e 4c ...

I've read that it is a DPAPI encrypted key, which should be decryptable with DataProtectionDecryptor, but it doesnt start with the standard DPAPI sequence 01 00 00 00 D0 8C 9D ... . So at the moment I don't know which information(keys) to use and where they come from to transform this key to the valid Bitlocker recovery key?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.