Posts Tagged ‘Bitlocker Recovery Keys’

Computer attacks constantly worry administrators and computer users. Earlier we already talked about volatility.

Plugin for the platform Volatility Framework, whose goal is to extract the encryption keys Full Volume Encryption Keys (FVEK) from memory. It works from Windows 7 to Windows 10. Unfortunately, the support for Windows 8 – 10 is very experimental, but it works in most cases with a few quirks.

Experts of the company Fox-IT developed a method of attack on third-party channels, allowing using inexpensive equipment to intercept the AES-256 encryption key from a distance of 1 m.

Thomas White conducts independent research on DFIR / Infosec / Malvare outside the main work. He writes how the changes in BitLocker after Windows 7 affect the master recovery keys and where to look for when recovering the keys in his last post.

This plugin, developed by Marcin Ulikowski, finds and extracts Full Volume Encryption Key (FVEK) from memory dumps and/or hibernation files.