You receive a laptop (powered off) in a high-stakes case. You are told the owner is extremely technical but given no useful technical details. The laptop is modern, with chassis intrusion features, and you must assume Secure Boot & BitLocker are in use. How do you proceed? #DFIR - ThreadSky

arsenalrecon.bsky.social • 10 days ago

You receive a laptop (powered off) in a high-stakes case. You are told the owner is extremely technical but given no useful technical details. The laptop is modern, with chassis intrusion features, and you must assume Secure Boot & BitLocker are in use. How do you proceed? #DFIR

Comments

arsenalrecon.bsky.social•9 days ago

Considerations include protecting the integrity of internal storage, invasiveness, likelihood of success, time, & yes, cost. What if it's a personal device, not corporate? If the user does not know/refuses to provide the BitLocker Recovery Key & Microsoft doesn't have it? #DFIR

arsenalrecon.bsky.social•8 days ago

Consider a series of small, but safe steps in this kind of scenario - let’s start w/ determining the current state of BitLocker, w/o losing the ability to take at least one additional step - boot w/ WinFE, connect AIM Remote Agent to AIM, & "Show BitLocker status". #DFIR

arsenalrecon.bsky.social•8 days ago

Now you know what state BitLocker is in, without harming your ability to take another step. Can we take another small, but safe step? Yes - you can obtain a disk image of the locked disk across your network with AIM Remote Agent.

arsenalrecon.bsky.social•8 days ago

Now onto a third small, but safe step. Was TPM the only BitLocker protector, or tied to the others? If not, w/ WinFE & AIM Remote Agent connected to AIM, you could try unlocking BitLocker w/ possible protectors - e.g. PIN, password, &/or recovery key - w/o risking recovery mode!

arsenalrecon.bsky.social•8 days ago

Onto a fourth small, but safe step. If a possible protector worked, you can leverage all of AIM’s advanced functionality across the network for extremely powerful triage. Browse the remote & now unlocked disk, mount VSCs, & launch a VM w/ Windows authentication & DPAPI bypasses!

arsenalrecon.bsky.social•8 days ago

What if none of the possible protectors worked, or BitLocker required TPM or recovery key? Options branch out - get the recovery key (e.g. legal process to Microsoft, court order to suspect), or try possible protectors against original evidence & risk BitLocker's recovery mode.

Comments

Posting Rules

Reply