Thomas White conducts independent research on DFIR / Infosec / Malvare outside the main work. He writes how the changes in BitLocker after Windows 7 affect the master recovery keys and where to look for when recovering the keys in his last post.
Thomas conducted a study on where to store encryption keys. He created a test plugin based on the research. A plugin that can extract BitLocker keys from Windows 7, and in theory versions of Windows, is higher than 7. The plugin is not completely reliable for Windows 8 – 10, but works in most cases with a few quirks.
If you have a comment on this study, you can contact with Thomas White.
