Forensic analysis of drives encrypted with windows bitlocker

Abstract

In the past few years, computing gadgets have become available to a huge population of users. Personal computers, laptops and mobile phones etc. are few obvious examples of the types of devices that store personal and sensitive information of users and enterprises. Such devices always remain vulnerable to be stolen, thus endangering the data contained therein. Therefore, a need was felt to harden the security of data stored on such devices, especially the laptops. In this wake, Microsoft Windows introduced the feature of whole drive encryption through Windows BitLocker, which is a logical volume encryption system. This utility first appeared Windows Vista (Ultimate & Enterprise) and later editions. BitLocker protects a system‟s / user‟s data against accidental exposure in cases of theft or loss of the system. However, under certain circumstances, it may be necessary to recover the data by tracing the BitLocker key, which is known to be stored somewhere on the BitLocked system. This research involves forensic analysis of disk drives encrypted with Windows BitLocker, with the purpose of tracing forensic artefacts in the encrypted volumes. Considering the wide use of removable storage media (USBs and external hard disks) and virtual machines, this research also includes analyses of such devices. Working on both offline and online states of the target disks, the focus has remained on identification of data structures in which the key material is stored; high probability portions of physical disk to hold these data structures and the method followed for the frequency of occurrence of those structures in different types of disks. It also includes identification and analysis of changes made to the registry and an endeavour has been made to establish the sequence in which various system libraries and files are called during the process of BitLocker encryption. Further work in this area may be carried out on newer versions of Microsoft Windows building upon the findings of this research. Few recommendations in this regard have also been included at the end of this thesis.