0

I want to use dislocker. I do not have the keys but I found the parameter -u at dislocker. So mounting the hard drive looks like: dislocker -r -V /dev/nvme0n1p3 -u123456789 -- /root/1

I recieve a error message like this: Fri Aug 12 09:20:25 2022 [CRITICAL] None of the provided decryption mean is decrypting the keys. Abort. Fri Aug 12 09:20:25 2022 [CRITICAL] Unable to grab VMK or FVEK. Abort.free(): double free detected in tcache 2 Abgebrochen (Speicherabzug geschrieben)

I am using Ubuntu 20.04.3 LTS

Which password was meant to decrypt?

I also tried parameter -p with same result.

Every help is welcome.

Cheers, Heinz

2
  • Is partition 3 the partition on which Windows is installed? Is there information you need? Do you dual boot? Do you want to keep the dual boot? Give us some more information ( and partition layout, version of Ubuntu etc.).
    – Joepie Es
    Commented Aug 12, 2022 at 9:58
  • Hi,The 3d partition is not a windows OS installation. And the hard disk is connected to my working PC with Ubuntu. It cames from my HP Notebook. Commented Aug 14, 2022 at 7:14

1 Answer 1

0

From man dislocker :

-u, --user-password=[USER_PASSWORD]
decrypt the volume using the user password method.

The "user-password" -u option doesn't mean you specify the user (maybe a misnomer, granted!), then the password. You only specify the password, Bitlocker is not unlocked with a user/password" method. When someone does have the password, they either type,

  • -u [nothing] => they'll be prompted later for password
  • -u space [their password]

Also, I would not try to mount the dislocker file on /root/1, typically you mount it on /mnt/your-choice (e.g. /mnt/ntfs)

If your OEM configured Bitlocker and you don't have a password, then you can create a FVEK or VMK restoration file, from the Windows computer. Then you use it with dislocker with the --fvek or --vmk option.

In a Windows shell you can use manage-bde status (where BDE stands for Bitlocker Disk Encryption) to learn more about the protectors currently in use in your Bitlocker configuration https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker. Typically in an OEM (vendor) configuration, you'll see "TPM", which means hardware protection by the TPM chip on your motherboard. But there can be several protectors. See also manage-bde tpm

In my experience, dislocker over samba (ethernet cable between windows computer and linux computer) does not work. (But my setting was different : trying to mount external bitlocker drive plugged in Windows computer, on a Ubuntu computer connected to Windows computer through ethernet.) If Samba is not an option, you could physically remove the internal HDD, buy an external HDD tray and plug it over USB on your ubuntu computer. But TPM won't like this, so create the Bitlocker restoration files (fvek or vmk) or recovery password before.

From : https://pulsesecurity.co.nz/articles/TPM-sniffing (I understand you're the legit owner of the Windows computer, but this page for hackers explains the basics quite well)

Windows uses BitLocker to encrypt drives. The data is encrypted using the Full Volume Encryption Key (FVEK). The FVEK is in turn encrypted with the Volume Master Key (VMK). The VMK is encrypted by multiple protectors. For example, in the default configuration there are two protectors. One is the TPM, the other is the Recovery Key. All of this exist so that if an attacker has physical access to the device, they can’t boot the laptop into a Linux live distro (or remove the drive) and access your data.

Proof that you can extract TPM / Bitlocker-encrypted drive and use it on another Windows computer (as POC, proof of concept) : https://social.technet.microsoft.com/Forums/windows/en-US/dc4b0c7d-bb1b-4a74-bc06-7d084fb38926/moving-bitlocker-encrypted-drive-to-new-computer?forum=win10itprogeneral

The selected answer [not shown here] is wrong.
"If you move encrypted hard drive to new PC, it won't work." - wrong.
You can move the drive and boot from it after entering the recovery key - as simple as that.
When booted, you can add a new protector like a password after removing the old TPM protector.

Warning : For dislocker, not sure if you have to remove the TPM protector (cf. last quote above) or if you can choose one protector among others. If you remove it, then if you put the disk back in your windows computer, you'll be prompted for password at boot.

Add a recovery key as a new protector to your TPM configuration : https://docs.microsoft.com/en-us/powershell/module/bitlocker/add-bitlockerkeyprotector?view=windowsserver2022-ps
=> Example 2: Add a recovery key for all BitLocker volumes
PS C:\>Get-BitLockerVolume | Add-BitLockerKeyProtector -RecoveryKeyPath "E:\Recovery\" -RecoveryKeyProtector (PS : Powershell)

Also note that you'll probably have to compile dislocker from (github) source, as the latest Bitlocker encryption mode is not handled by the latest (pretty old) dislocker release (looks unmaintained)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .