BitLocker
Definition
Microsoft's full-volume encryption on Windows. Volume Master Key wrapped under TPM, password, recovery key (48 digits), or AD/MBAM/Intune escrow. Hashcat mode -m 22100.
- Platform
- Windows full-volume encryption
- Key protection
- TPM, password, or 48-digit recovery key
- Enterprise escrow
- Active Directory, MBAM, or Intune
- Hashcat mode
- -m 22100
Common questions
Why does BitLocker's TPM binding matter for forensic acquisition?+
When the Volume Master Key is sealed to the TPM, the volume unlocks automatically only on the original hardware in its expected boot state, so imaging the drive alone without the source machine, or without a recovery key or escrowed key, generally will not yield readable data.
What is the fastest route to a BitLocker-protected volume in casework?+
Recovering the 48-digit recovery key from AD, MBAM, or Intune escrow, or obtaining it from the device owner, is far more reliable than attempting to brute-force the key, which is computationally infeasible against a properly generated BitLocker key.
Related terms
- Deletion vs Erasure
- Deletion marks the file entry as free; content blocks remain until overwritten. Erasure (shred, sdelete, secure-erase) overwrites the blocks before unlinking. The...
- File Carving
- Recovery technique that scans raw disk blocks for known file headers and footers, ignoring filesystem metadata. The only option when the filesystem...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...