BSOD_bitlocker_recover

BitLocker VMK Carving Tool

This Python script helps you extract potential BitLocker Volume Master Keys (VMKs) from memory dump files, such as those generated by a Blue Screen of Death (BSOD). It's a command-line utility designed to assist in forensic investigations where BitLocker encryption is involved. Though intended for BSOD dumps this will also work on disk images, exported unallocated disk space,

Demo of use and mounting drive with key: https://www.youtube.com/watch?v=PFWVIZsGOaI&feature=youtu.be

Usecase

I designed this tool to unlock locked onedrive vaults, if a computer you are examining crashed when the volume was open this will allow you to examine the suspects vault data

How It Works

The script works by searching the binary data of a memory dump file for specific byte patterns that indicate the presence of a BitLocker Volume Master Key header. Once identified, it extracts the subsequent 64 hexadecimal characters, which represent the potential VMK. It also includes a filtering step to remove common false positives. Features

Memory Dump Analysis: Processes MEMORY.DMP files to identify potential BitLocker VMKs.
Pattern Matching: Uses regular expressions to locate the unique VMK header signature.
False Positive Filtering: Includes a basic filter to reduce irrelevant results.
Simple Command-Line Interface: Easy to use by providing the memory dump file as an argument.

Requirements

Python 3.x

Usage

Save the script: Save the provided Python code as bitlocker_carve.py (or any other .py file name).

Obtain a memory dump: Ensure you have a MEMORY.DMP file (or any other memory dump file) that you wish to analyze.

Run the script: Open a terminal or command prompt, navigate to the directory where you saved the script and the memory dump, and execute the script with the memory dump file as an argument:
Bash

python bitlocker_carve.py MEMORY.DMP

Replace MEMORY.DMP with the actual path to your memory dump file if it's not in the same directory.

Example Output

[+] Found MEMORY.DMP. [+] Found 1 potential BitLocker VMK key(s): 1: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 Press Enter to exit...

Important Notes

This tool identifies potential BitLocker VMKs. Further analysis may be required to confirm their validity.
The effectiveness of this tool depends on the quality and completeness of the memory dump.
Always handle memory dumps and extracted keys with appropriate security measures.

Acknowledgments

A huge thank you to WithSecureLabs/bitlocker-spi-toolkit for their foundational work, which significantly inspired and made this script possible.