Accessing a remote Bitlocker volume thanks to F-Response and Dislocker

May/04/2018

Chances are you've run into this before. Remote Windows machine, you've got it mounted with F-Response and you are ready to dig right in, only to find out it's full disk encrypted. It's a common scenario with a few different potential options. Sometimes you can get around it by simply mounting the volume vs the physical device. However for something like Bitlocker that's not going to work.

Thankfully Windows 10 has built in support (provided you have a recovery key) to access the volume. However, what about if you are working under Linux? Well our resident Linux Fu Master has an option for you.

Accessing a remote Bitlocker volume using F-Response and Dislocker

Click here for a summary Mission Guide of all the commands in the video.

Warmest Regards,

M Shannon, F-Response

Back...