Or at least disabling auto-mount and attaching the disk as removable storage to another PC from which you will create an image or clone of the unmounted volume. OK, first things first: if you're trying to make a forensic image of a disk, and you're doing ANYTHING AT ALL that involves booting the machine it's in before you initiate the image, stop and ask yourself why you aren't just removing the disk and cloning it using dedicated hardware. Either way, the forensic processing software we use (Intella by Vound-Software) should be able to handle Bitlocker encrypted images when the recovery key is supplied but I rather want to understand exactly how it works and if my understanding of this matter is correct. Lastly, what happens if I do (accidentally) boot into Windows before re-enabling Secure Boot, does re-enabling Secure Boot change back the old behavior (no recovery key required) or did it then save that one "unsecure boot" state and prompt it anyway till a recovery key is entered?Īlso in this case I am not sure if OSFClone will image the unencrypted disk (which I suspect in case of a SED disk with TPM-only, as it should unlock when the machine with TPM and disk power on) or will I only manage to image the encrypted disk (which I suspect when SED and/or TPM is not used). But I rather don't boot into Windows and as I said I cannot be 100% sure the recovery key I've received is correct. It's an option if I have to enter the Bitlocker recovery key once after imaging and boot into Windows. I wonder if Bitlocker will prompt to enter a Recovery Key in this case when booting normally again? Or will it boot straight into Windows (after re-enabling) like nothing has happened?
After that I want to re-enable Secure Boot again. My plan is to (temporarily) disable Secure Boot, boot from the OSFClone USB and make a forensic image to an external disk. I did also receive a local Windows Administrator user which I could use to boot and login to Windows and check the recovery keys but I rather don't want to boot the machine into Windows at all.
I did receive a Bitlocker recovery key for this laptop but I cannot be 100% sure that the recovery key is correct. One laptop has a Kioxia KBG30ZMV256G NVMe SSD, the other a SanDisk SSD X400 M.2 2280 (SD8SN8U-128G). The laptops (HP ProBooks) in this case uses Bitlocker and has (according to the vendor specifications) an TPM 2.0 Embedded Security Chip shipped with Windows 10 (Common Criteria EAL4+ Certified).
I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external disk.
0 kommentar(er)
