Bitlocker Password Question

[Philip Shaw]

Good morning and Happy New Year. A customer has a drive that is asking for a Bitlocker password and he has no idea what it is. He sent me this link and it looks interesting but it doesn't appear to work with TPM enabled. Has anybody ever tried this method? Would it only work with a password and not if you are looking for the 48-character key?

Thanks. 

https://www.youtube.com/watch?app=desktop&v=gue6suh7ZlM&ab_channel=PentestsandTech

Virus-free. www.avast.com

[jol qwerr]

It will work on the 48 digit recovery key too, but will take ages to complete

[Markus Bauer]

It should work on the 48 digit key. I would use Hashcat and a good GPU! I have cracked multiple drives with hashcat + GTX1660 + HaveIBeenPwned wordlist...

[rzepk...@gmail.com]

HaveIBeenPwned wordlist is stored in plain-text passwords list ? or SHA1/NTLM hashes only?

[Markus Bauer]

Paintext - I will upload my to github as the old repo went offline due to data loss. 

[Markus Bauer]

I forget github has a file-size limit! Sourceforge to the rescue: https://sourceforge.net/projects/wordlist-collection/files/

[Philip Shaw]

He also sent me this link which seems potentially doable. Any thoughts?

https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network

Virus-free. www.avast.com

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/ac1e32d5-19a9-49e3-9c6d-4690447a7e0en%40googlegroups.com.

[LEE MARK]

Hello Please  where can I get the 48-bit key to get the HASH dictionary

Philip Shaw <shawcomput...@gmail.com> 于2022年1月3日周一 22:51写道：

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkbyUkDgZ7Yo0z7Eg_OTPOqpuFoJVQ3VAH-m94Ga0D55Eg%40mail.gmail.com.

[Markus Bauer]

Bitlocker is a pretty heavy heach to calculate - see benchmark results of a RTX 3090:

Hashmode: 22100 - BitLocker (Iterations: 1048576)

Speed.#1.........: 4363 H/s (75.02ms) @ Accel:1 Loops:4096 Thr:1024 Vec:1 

With that value we can calculate now:

10 posibilities ^ 48 char. long / 4363 hashes per sec. / 60 sec. / 60 min. / 24 hours / 365 days = 7.2678872e+36 years

You will be long gone before the 48 digit key is cracked...