{"id":13511089,"url":"https://github.com/tribalchicken/volatility-bitlocker","last_synced_at":"2025-03-30T19:30:45.389Z","repository":{"id":201254211,"uuid":"53730967","full_name":"tribalchicken/volatility-bitlocker","owner":"tribalchicken","description":"Volatility plugin to extract BitLocker Full Volume Encryption Keys (FVEK)","archived":false,"fork":false,"pushed_at":"2021-09-20T21:01:27.000Z","size":8,"stargazers_count":62,"open_issues_count":1,"forks_count":27,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-11-01T12:36:04.571Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tribalchicken.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2016-03-12T12:39:40.000Z","updated_at":"2024-07-19T12:02:40.000Z","dependencies_parsed_at":null,"dependency_job_id":"7030e66e-af27-4949-84b7-c97239f0c770","html_url":"https://github.com/tribalchicken/volatility-bitlocker","commit_stats":null,"previous_names":["tribalchicken/volatility-bitlocker"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-bitlocker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-bitlocker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-bitlocker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-bitlocker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tribalchicken","download_url":"https://codeload.github.com/tribalchicken/volatility-bitlocker/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246368642,"owners_count":20766055,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T03:00:34.308Z","updated_at":"2025-03-30T19:30:45.113Z","avatar_url":"https://github.com/tribalchicken.png","language":"Python","funding_links":[],"categories":["Volatility plugins","Volatility 2","\u003ca id=\"4d2a33083a894d6e6ef01b360929f30a\"\u003e\u003c/a\u003eVolatility"],"sub_categories":["Plugins"],"readme":"# volatility-bitlocker\n\n**Update 2016-04-06:** Applied a hacky fix for 32-bit windows. I've realised that I need a more robust solution to handle slight differences in Windows 8 and 32-bit Windows... That will happen soon and will include full Windows 8 support. Until then, Win8 is not currently supported ( 8.1 is though). Contact me if you need more info.\n\nA plugin for the Volatility Framework which aims to extract BitLocker Full Volume Encryption Keys (FVEK) from memory. Works on Windows 7 through to Windows 10.\n\nThis is very much a work-in-progress and support for Windows 8 - 10 is highly experimental.\n\nFinds the FVEK on Windows 7 by searching for the FVEc pool tag.\n\nAttempts to locate the FVEK on Windows 8, 8.1 and 10 by analysing memory after finding the Cngb pool tag.\n\nArticle here: https://tribalchicken.net/recovering-bitlocker-keys-on-windows-8-1-and-10/\n\n## Usage\nbitlocker.py is a plugin for the Volatility Framework. You can either place the plugin in the plugins directory at `volatility/plugins`, or  alternatively, you can place the plugin in a separate directory and point volatility to it with `--plugins`\n\nFor example, using a directory called \"Plugins\":\n\n```\nvoldev$ ls plugins\nbitlocker.py\nvoldev$ volatility --plugins=plugins/ --profile=Win81U1x64 -f WIN81X64-20160916-061911.raw bitlocker\n```\n\n## Common Problems\n\n### Volatility tells you it needs something to do\n\nVolatility doesn't know about the plugin. Check the location of the plugin, and run `volatility --info` to determine if it is detected\n\n### The plugin doesn't find anything\nThere could be many causes.\n\n- The drive is not bitlocker encrypted\n- The memory image does not contain the key (Image captured after key is evicted from memory, overwritten during acquisition, etc)\n- The key exists but the plugin doesn't find it.\n\nIf you suspect the plugin isn't working for you then I would love to know.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftribalchicken%2Fvolatility-bitlocker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftribalchicken%2Fvolatility-bitlocker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftribalchicken%2Fvolatility-bitlocker/lists"}