I have imaged a hard disk and used passware, but to no avail - it says Encryption key External key, and not the actual key.

How do you think I would go about brute forcing it? Lets assume I had infinite time, what software(s) could I use for this?

Im quite interested in the concept and would like to test it on a drive I locked with TPM and a PIN, so any pointers from here would be useful and much appreciated.

Thanks in advance...


Well you have to brute-force the 48 character recovery key (https://blogs.msdn.microsoft.com/si_team/2006/08/10/bitlocker-recovery-password-details/)

As I remember it visually shown when 6 character sub-key is successfully entered so I guess it is possible but if there are tools available I'm unaware of.

Good luck

| improve this answer | |
  • Thanks for that info - do you know specifically what software I could use to automate this for me? I.e. Passware Kit forensic supports Hardware Acceleration, but for unknown reasons its not working for me.. – QuickishFM Jun 25 '16 at 21:07

You can use bitcracker. This tool was developed for that, for brute forcing BitLocker recovery key or user password.

Bitcracker performs a dictionary attack, so you still need to create a list of possible recovery keys. And you should be careful with creating such kind of list because there are special conditions for recovery key (look through this paper, chapter 5.4, for details or Microsoft documentation).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.