How could I mount my BitLocker encrypted drive on Ubuntu?

I have checked the Wine website, and it had no BitLocker support, and I have no idea how to install Dislocker on my computer.

I can not remove the encryption because my school computers use Windows OS instead of Linux OS. Also because I installed Ubuntu because my Windows OS was not working.

7 Answers 7


Since Ubuntu 18.04, Dislocker is available in the Ubuntu Universe packages. It can be installed using

sudo apt install dislocker

You may need to

sudo add-apt-repository universe
sudo apt update

First, we make two folders, /media/bitlocker and /media/mount:

sudo mkdir /media/bitlocker /media/mount

Then, download and then extract Dislocker.

You'll want to install some needed packages:

sudo apt-get install libfuse-dev

To install it, we need to change directory to the dislocker folder:

cd dislocker

Depending on your operating system, you'll need to choose one of these:

  • For Debian-like distos based on Debian Jessie or Ubuntu 14.04 or older:

     aptitude install gcc cmake make libfuse-dev libpolarssl-dev ruby-dev
  • For Debian-like distos based on Debian Stretch or Ubuntu 16.04 or later:

     aptitude install gcc cmake make libfuse-dev libmbedtls-dev ruby-dev

Now we finally install dislocker:

cmake .
sudo make install

Here, we need to find our partition so we dont erase all of our drives accidentally:

sudo fdisk -l

If we have a recovery password, we can decrypt it using this:

sudo dislocker -r -V /dev/sdaX -p 1536987-000000-000000-000000-000000-000000-000000-000000 -- /media/bitlocker

PS: You should replace 1536987-000000-000000-000000-000000-000000-000000-000000 with your recovery password.

If you know your password, we can just use that too:

sudo dislocker -r -V /dev/sdaX -u yourPassword -- /media/bitlocker

If your disk is mounted to sdb, use option sdb1.

If you are decrypting with a recovery file then use "path/to/.BEK" instead:

sudo dislocker-fuse -V /dev/sdcX -f /media/user/usb-drive/00000000-0X0X-0XX0-XXX0-XXXX0XXX00XX.BEK -- /media/bitlocker

Now, we finally mount our file:

sudo -i
cd /media/bitlocker
mount -r -o loop dislocker-file /media/mount

(If the mount above fails with "Permission denied" add the -r option and try again.)

Now you can move to the /media/mount folder and see your decrypted data.

Read the source for more information and details.

  • I don't have recovery password. And I'm not sure where to get this from. Can you tell me about this ?
    – Ejaz Karim
    Commented May 16, 2015 at 10:05
  • 1
    I also needed this: sudo apt-get install libpolarssl-dev - otherwise make would fail. Commented Dec 20, 2015 at 17:56
  • 4
    Does this also allow for writing to the bitlockered drive as well as reading?
    – Samir
    Commented Sep 6, 2016 at 10:18
  • 1
    failed on ubuntu 16.10 Commented Nov 6, 2016 at 4:16
  • 1
    dislocker should support read-write (rw) access to some bitlocker containers/versions, "the source" link says windows 8 rw access wasn't supported yet (in 2014) and a comment says it would "silently mount as ro (even though mount shows as rw)" probably leading to the mount error "ntfs-3g-mount: mount failed: Permission denied". Omitting the -r option to dislocker & mount should try mounting rw
    – Xen2050
    Commented Jan 25, 2017 at 10:45

You need Dislocker to use BitLocker-encrypted drives. You can download it from here or there is a GitHub repository also.

To install it you will need:

  • A compiler, GCC or Clang;
  • Make (or gmake, for FreeBSD)
  • Headers for FUSE;
  • Headers for PolarSSL;
  • A partition encrypted with BitLocker, from Windows Vista, 7 or 8.

For detailed instructions, see this page or refer to install.txt file in the downloaded Dislocker archive.

  • 7
    Did you really have to link to the Wikipedia page about GitHub?
    – Vercas
    Commented Jul 25, 2018 at 10:35

Very good tutorial, however there's one problem. Since the file is read only you will need to use the read-only flag:

mount -ro loop dislocker-file /media/mount

Also the -u (--user-password) option to make this much easier:

sudo dislocker -r -V /dev/sdaX -u -- /media/mount
Enter the user password:▯ 

If you want to mount again in the same folder use:

sudo dislocker -r -V /dev/sdaX -u -- -o nonempty /media/mount

(Where X should be replaced by the number of your encrypted drive, e.g. /dev/sda7)

  • 3
    Also, do NOT use make uninstall for this package. It will break your symlinks and it will look like your /usr/bin has been deleted and you will think you will have to reinstall your distro however the files are all there after you reboot. I can't find the page that helped me fix this problem however there are other problems with the Makefile that the maintainer should be aware of.
    – technop
    Commented Oct 12, 2015 at 6:24

Modern versions of Ubuntu/Kubuntu can decrypt BitLocker partitions without extra software.

At least, I've tested in Kubuntu 22.04 (and everything is fine).


I installed dislocker recently and running the script cmake . triggered errors on trying to find polarssl despite it being installed.

By chance, I eventually managed to install it: you should not run cmake under /dislocker/src directory as mentioned in the first reply (maybe it worked in the past) but should:

cd /dislocker
cmake .
  • Maybe make works in dislocker/src, while cmake doesn't?
    – Xen2050
    Commented Apr 28, 2016 at 23:44

the new package name for libpolarssl is: libmbedtls-dev

so you can install the libpolarssl compoments for cmake by installing it:

apt-get install libmbedtls-dev

Then cname and everything else will work fine

  • So this and all older solutions entail that the encryption key is fully stored on the drive itself, rather than part of it being stored only on the TPU of the motherboard as is the case with BitLocker itself, right?
    – matanox
    Commented Dec 20, 2017 at 18:49

Warning: Answer only works for Ubuntu 22.04 (Jammy) and newer

cryptsetup added BitLocker experimental support in version 2.3 (Jammy package is v2.4.x), and that support was mature by version 2.6 (Mantic package is v2.6.1) (ref. Ubuntu packages).

The basi structure of usage is to create an decrypted mapped device of the encrypted partition with cryptsetup, and then mount that mapper device with mount:

Install cryptsetup in case it isn't already installed:
$ sudo apt install cryptsetup
Create the mapped decrypted device
$ sudo cryptsetup open --type bitlk /dev/sda3 win11 
Enter passphrase for /dev/sda3:    <<< VOLUME KEY TO BE INPUT HERE
Mount the mapped device
$ sudo mount /dev/mapper/win11 /media/win11/

Please note that the target directory should exist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .