Implementing BitLocker Drive Encryption for Forensic Analysis
J. Kornblum
Digital Investigation

Paper (Author's version, pdf)     DOI for published article     Bibtex

This paper documents the BitLocker Drive Encryption system included with some versions of Microsoft's Windows Vista. In particular it describes the key management system, the algorithms and modes used, and the metadata format. Particular attention is given to methods forensic examiners can use to access protected data. There are some unanswered questions about how the cryptosystem operates, including an undocumented key management decision. This decision could allow, in a particular usage scenario, unauthorized access to a protected volume.

Home     Publications     Presentations     Utilities     Tools     Blog