{"id":13511087,"url":"https://github.com/breppo/Volatility-BitLocker","last_synced_at":"2025-03-30T19:30:44.039Z","repository":{"id":60043311,"uuid":"236448979","full_name":"breppo/Volatility-BitLocker","owner":"breppo","description":"Volatility plugin to retrieve the Full Volume Encryption Key in memory. The FVEK can then be used with the help of Dislocker to mount the volume.","archived":false,"fork":false,"pushed_at":"2020-01-27T11:01:09.000Z","size":8,"stargazers_count":35,"open_issues_count":1,"forks_count":3,"subscribers_count":4,"default_branch":"master","last_synced_at":"2024-11-01T12:36:01.617Z","etag":null,"topics":["volatility"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/breppo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-01-27T08:42:00.000Z","updated_at":"2024-10-09T20:34:02.000Z","dependencies_parsed_at":"2022-09-25T18:13:06.239Z","dependency_job_id":null,"html_url":"https://github.com/breppo/Volatility-BitLocker","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/breppo%2FVolatility-BitLocker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/breppo%2FVolatility-BitLocker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/breppo%2FVolatility-BitLocker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/breppo%2FVolatility-BitLocker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/breppo","download_url":"https://codeload.github.com/breppo/Volatility-BitLocker/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246368637,"owners_count":20766054,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["volatility"],"created_at":"2024-08-01T03:00:34.219Z","updated_at":"2025-03-30T19:30:43.784Z","avatar_url":"https://github.com/breppo.png","language":"Python","funding_links":[],"categories":["Volatility 2"],"sub_categories":["Plugins"],"readme":"# Volatility plugin: BitLocker\n\nVolatility plugin that retrieves the Full Volume Encryption Key (FVEK) in memory. The FVEK can then be used with [Dislocker](https://github.com/Aorimn/dislocker) to decrypt the volume. \nThis plugin has been tested on every 64-bit Windows version from Windows 7 to Windows 10 and is fully compatible with Dislocker.\n\nThis work was done during my internship at [Synetis](https://www.synetis.com/).\n\nAvailable options:\n\n- Dump-dir: Dump the key to use it with bdemount, requires an output path\n- Dislocker: Dump the key to use it with Dislocker, requires an output path\n- Verbose: Add more information about the memory pools currently reviewed\n- Debug: When the correct FVEK is not returned, it might help\n\n## Installation\n\nJust copy the bitlocker.py file into the volatily plugin path: \n\n```\ncp bitlocker.py path/to/volatility/volatility/plugins/ \n```\n\n## Example\n\nDump a memory image (it can be done using FTK Imager for example), and type:\n\n```\npython vol.py -f ${DUMP.raw} bitlocker --profile=${Windows_Profile} \n```\n\nThis will print the potential found FVEKs. The first returned should be the one as the plugin goes from the current Windows versions to the oldest.\n\n\nTo test the FVEK with Dislocker, you can add the Dislocker option: \n\n```\npython vol.py -f ${DUMP.raw} bitlocker --profile=${Windows_Profile} --dislocker /path/to/dump\n```\n\nThe output will look like this:\n\n```\nVolatility Foundation Volatility Framework 2.6.1\n\n[FVEK] Address : 0xb7811050c9a0\n[FVEK] Cipher  : AES-XTS 128 bit (Win 10+)\n[FVEK] FVEK: 3ba9a1c2dde7c63e5f7851914a9dd120\n[DISL] FVEK for Dislocker dumped to file: path/to/dump/0xb7811050c9a0-Dislocker.fvek\n\n\n\n[FVEK] Address : 0xb78110504cc0\n[FVEK] Cipher  : AES 128-bit (Win 8+)\n[FVEK] FVEK: 8002ed825cfe78a3148640365511c03b\n[DISL] FVEK for Dislocker dumped to file: path/to/dump/0xb78110504cc0-Dislocker.fvek\n\n\n\n[FVEK] Address : 0xb78110ad8580\n[FVEK] Cipher  : AES 256-bit (Win 8+)\n[FVEK] FVEK: 5f75f4782de42f3df2c33b3a89a5d15775730e47327d4a1160c0559f3fd752d0\n[DISL] FVEK for Dislocker dumped to file: path/to/dump/0xb78110ad8580-Dislocker.fvek\n\n\n\n[FVEK] Address : 0xb781133b4990\n[FVEK] Cipher  : AES 128-bit (Win 8+)\n[FVEK] FVEK: 922eff6970d6b214d81539297aea715f\n[DISL] FVEK for Dislocker dumped to file: path/to/dump/0xb781133b4990-Dislocker.fvek\n```\n\nAfter that, you can mount the disk by using Dislocker:\n\n```\ndislocker -k path/to/dump/0xb7811050c9a0-Dislocker.fvek /path/to/disk /path/to/dislocker \u0026\u0026 mount /path/to/dislocker/dislocker-file /path/to/mount\n```\n\n## Issues with bdemount\n\nWhile Dislocker will mount the volume in read-write mode, bdemount will respect the hibernation flag and may mount it in read-only mode. Moreover, there is one known issue which makes bdemount and my output not compatible for AES-XTS 128-bit key. \n\nI recommend to use Dislocker.\n\n## Credits\n\nCredits to Marcin Ulikowski (https://github.com/volatilityfoundation/community/tree/master/MarcinUlikowski) and TribalChicken (https://github.com/tribalchicken/volatility-bitlocker and https://tribalchicken.net/recovering-bitlocker-keys-on-windows-8-1-and-10) for previous works.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbreppo%2FVolatility-BitLocker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbreppo%2FVolatility-BitLocker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbreppo%2FVolatility-BitLocker/lists"}