I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external disk. The laptops (HP ProBooks) in this case uses Bitlocker and has (according to the vendor specifications) an TPM 2.0 Embedded Security Chip shipped with Windows 10 (Common Criteria EAL4+ Certified). One laptop has a Kioxia KBG30ZMV256G NVMe SSD, the other a SanDisk SSD X400 M.2 2280 (SD8SN8U-128G).
I did receive a Bitlocker recovery key for this laptop but I cannot be 100% sure that the recovery key is correct. I did also receive a local Windows Administrator user which I could use to boot and login to Windows and check the recovery keys but I rather don't want to boot the machine into Windows at all.
My plan is to (temporarily) disable Secure Boot, boot from the OSFClone USB and make a forensic image to an external disk. After that I want to re-enable Secure Boot again. I wonder if Bitlocker will prompt to enter a Recovery Key in this case when booting normally again? Or will it boot straight into Windows (after re-enabling) like nothing has happened?
It's an option if I have to enter the Bitlocker recovery key once after imaging and boot into Windows. But I rather don't boot into Windows and as I said I cannot be 100% sure the recovery key I've received is correct.
Lastly, what happens if I do (accidentally) boot into Windows before re-enabling Secure Boot, does re-enabling Secure Boot change back the old behavior (no recovery key required) or did it then save that one "unsecure boot" state and prompt it anyway till a recovery key is entered?
Also in this case I am not sure if OSFClone will image the unencrypted disk (which I suspect in case of a SED disk with TPM-only, as it should unlock when the machine with TPM and disk power on) or will I only manage to image the encrypted disk (which I suspect when SED and/or TPM is not used). Either way, the forensic processing software we use (Intella by Vound-Software) should be able to handle Bitlocker encrypted images when the recovery key is supplied but I rather want to understand exactly how it works and if my understanding of this matter is correct.