A Decryption Catch-22: EFS vs Windows Bitlocker

Question

I have myself in a bit of a pickle. My primary hard drive is encrypted with Windows 10 Bitlocker, and the text file with my recovery key, on an external drive, has turned out to be encrypted with Windows 10 EFS! I don't know whether I should be working on a solution for the Bitlocker or the EFS.

Background

My primary hard drive is encrypted with Bitlocker (built into Windows 10 Professional) and is set up such that the computer will boot if a particular thumb drive is inserted. About a week ago, it suddenly refused to boot, acting as if the thumb drive was not inserted.

I keep backups by simply drag-and-dropping the folders with my documents onto external USB hard drives. Those folders include the .TXT file with the Bitlocker recovery key.

My recovery plan was to plug one of my backup external hard drives into another computer to read the .TXT file that contains the recovery key, which i understand is about a 25 (or so) digit number.

Problem

Apparently at some point I unwittingly applied EFS (encrypting file system) to the folder with my documents, and that EFS carried through to my backup external hard drives. I say unwittingly, because I do not remember doing it, but I guess at some point my small mind saw a checkbox with an option to do it, and I thought to myself, "what a great idea!" Nice work, Mr. Secure Guy!

On another computer, I can plug in the external drive, navigate the folders, but when I try to open a file it says "Access Denied"

Now I am stuck in a catch-22. I can't access either drive without accessing the other one first. EFS vs. Bitlocker. Is there any hope to recover my documents?

Possibly Helpful Extra Information

Here are a few extra bits of information, that may or may not be helpful:

• If necessary, I am competent enough to run Kali Linux from a live CD and run some basic exploits, just from a one week class I took on pen-testing. I'm definitely not a seasoned hacker though.

• The USB drive that is supposed to have my Bitlocker decryption key does not seem to be malfunctioning. I can add and remove files to it from another machine. I have the BEK file, but I have no idea how I might be able to extract the recovery key from it. Opening it in Notepad just gives me gibberish.

• The Bitlocker decryption failure happened immediately after I plugged in a new USB hub, which is "ORICO MH4PU Aluminum 4 Ports USB 3.0 Clip-type HUB" from NewEgg. The hub seems to be working fine in every respect, so I doubt it's related, but who knows? Yes, I have tried removing the hub and rebooting, didn't help.

• I tried copying my BEK file to a different USB thumb drive, but did not change results: the machine still behaved as if the decryption key was not inserted. (did not boot).

• My USB thumb drive is at least 10 years old, but was only used regularly for about 2 years, sat idle for about 5 years, and then became my decryption key for about the last 3 years. I'm aware of the limited lifespan for flash memory, but it has had a pretty light duty life. It's a generic 4MB stick.

• I have already investigated the possibility that the NTFS File Permission System is involved. On the other computer I have successfully taken "ownership" of the file and assigned myself full control permissions with no error messages. I'm pretty sure EFS is the culprit, but open to learning otherwise.

• I do not have a Microsoft account, The Windows 10 machine is set up with only local accounts. I have the username and password.

• All Microsoft telemetry was turned off long ago.

• I've tried inserting the thumb drive with the decryption key into different USB ports, including the ones directly in the back of the motherboard.

• This is a homebuilt computer, about 11 years old. It has experienced a few hardware failures over the years but I was able to successfully troubleshoot them and replace the parts as necessary. It's not currently showing any sign of hardware failure. In fact, one of my "other machines" is simply another hard drive in the same computer (that I am using now).

Specific Suggestions for Answers

A workable answer to either of these would really make my day:

• How can I extract the Bitlocker recovery key from the BEK file which seems to be intact?

• I think that Bitlocker is pretty unassailable, but is there a way I can attack EFS, for example something in Metasploit?

Thank you all for any assistance!

Answer 1

My recovery plan was to plug one of my backup external hard drives into another computer to read the .TXT file that contains the recovery key, which i understand is about a 25 (or so) digit number.

[...] The USB drive that is supposed to have my Bitlocker decryption key does not seem to be malfunctioning. I can add and remove files to it from another machine. I have the BEK file, but I have no idea how I might be able to extract the recovery key from it. Opening it in Notepad just gives me gibberish.

Startup keys use a binary format, so "gibberish" is normal – it's like you're trying to read a MP3 or GIF with Notepad. BitLocker recovery keys come in two different formats: a numeric "recovery password" stored in a .txt file (with some explanatory fluff along with it) and a binary "startup key" stored in a .bek file. It is possible to have both, but you cannot turn one into another.

How can I extract the Bitlocker recovery key from the BEK file which seems to be intact?

The latter .BEK format is not text in the first place, so there's nothing to extract really – the file is the key.

You could use tools like dislocker-bek or bek_file.py to display its details including the raw AES key data – that'll at least tell you whether the file is corrupted or not. But there's no point in converting it to a numeric key because Windows knows it wasn't a numeric key (the disk's metadata says so).

I think that Bitlocker is pretty unassailable, but is there a way I can attack EFS, for example something in Metasploit?

Only if you have access to the user profile where the EFS keys are stored – which you don't.

EFS recovery tools just find the correct files from C:\Users\...\Credentials (the keys are protected using your OS password), but there is no exploit that could just magically produce the key out of nowhere.

Now I am stuck in a catch-22. I can't access either drive without accessing the other one first. EFS vs. Bitlocker. Is there any hope to recover my documents?

There are two possibilities: either the Windows bootloader is unable to access USB devices (which is possible, since it doesn't have access to the usual drivers in the OS) – or your key file is for the wrong disk and therefore useless. One way to find out is by bypassing the Windows bootloader and using alternative BitLocker tools.

Within Linux, use lsblk to find your Windows partition, then run either dislocker or bdemount (mostly equivalent) to access its contents using the BEK file mentioned earlier:

dislocker --bekfile Key.BEK /dev/sda2 /mnt

bdemount -s Key.BEK /dev/sda2 /mnt

From there, you can treat /mnt/dislocker-file or /mnt/bde1 as if it were a regular block device containing the NTFS filesystem: you can mount it using ntfs-3g and extract other files, or you can ntfsclone the whole thing into another empty disk (leaving it without BitLocker encryption at all).

Answer 2

It's been a crazy few months with coronavirus. The computer has been "usable" with a WIN10 installation on a crummy old IDE 80GB hard drive for the most basic tasks, so I haven't had a chance to work on it until this weekend. Finally I made progress!

Success!

I took a real long shot, and it paid off. Got a new inexpensive thumb drive, copied my BEK file to it, and lo and behold it decrypted my C: drive and booted! But wait--I wasn't sure if the successful boot was repeatable. And it turned out to not be. So it's a good thing I did this right away:

Immediate Action Required on Successful Boot

GOOD IDEA--Immediately printed the 48 digit recovery key for my system drive. Yes actually printed on paper. This was VERY important, because it turned out that my lucky fluke boot up was NOT repeatable. The darn thing will simply not decrypt via thumb drive, as of now. Why not--reasons still unknown. Why it worked that one time--reasons still unknown. Printing this recovery key allowed me to switch back and forth at will between my original broken installation and my crummy temporary troubleshooting installation.

Attempts at a Permanent Fix

Now I had the challenge of changing the way I do backups to make sure they are actually restorable, because I had now realized that whatever I was doing, it was wrong in some way. I used the temporary crummy WIN10 installation on the 14 year old IDE 80GB hard drive as a "test" computer. I had to figure out a way to make sure that the files I drag-and-drop onto external drives were fully readable on another computer. Here's what worked and what didn't:

1. Tried adding Full Control permissions for all "Users" in the properties->security->advanced tab of the folder that was giving me trouble. I made sure to check the box that said to inherit this permission to all subfolders and items. This did not work at all. When I booted into my troubleshooting WIN10 installation, it was still Access Denied to all my files. So apparently file permissions were unrelated to the problem.

2. From my primary/old/broken Windows, I right-clicked on my data drive partition and went to General->Advanced to turn off the EFS encryption. But it was already turned off! The "Encrypt Contents..." box was un-checked. This was not helpful. So apparently the drive was not encrypted.

3. From my primary/old/broken Windows, I reformatted one of my external backup drives to exFAT instead of NTFS, and then copied the troublesome documents directory to that. This did not work at all. When I booted into my temporary WIN10 installation (aka "new" computer), it was still Access Denied to all my files. So apparently NTFS file system is not part of whatever was wrong.

What DID Work

1. Here's what actually did work: From my primary/old/broken Windows, I selected all of the folders in the root directory, right-clicked, and went Properties->Advanced and only THEN I could see that some of them were encrypted. I had a square in the checkbox that signifies a mixture of yes and no for the checkbox state. I turned it off here, applied to all subfolders and items in them. And then of course after that I need to re-copy my newly accessible documents folder to my external backup hard drives.

Final Lesson Learned

Be sure to TEST your backup strategy, by trying to restore your backup to another computer. And make sure you can actually open and manipulate the files. Navigating the folders is no guarantee!

My Story Isn't Over But this Question Is

Obviously there is something fishy going on with either my hardware or Windows. Why can I boot manually entering the 48 digit key, but I can't boot with a USB drive? This might yet be some type of motherboard failure, or corrupted Bitlocker.

After I am confident that my backed up documents are accessible from a new computer, I'm going to have to nuke this thing from orbit and start over. No problem--I can do some nice troubleshooting without being in a cold sweat.