Copyright © 2025 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{171282,
        author = {ASHMIT SHARMA and Anju Anna Joseph and Kanan Bala Jena},
        title = {Decrypting Bit Locked drive: Using Open-Source Tools},
        journal = {International Journal of Innovative Research in Technology},
        year = {2025},
        volume = {11},
        number = {7},
        pages = {4053-4060},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=171282},
        abstract = {BitLocker encryption is designed to enhance data security by encrypting the entire hard drive, unlike traditional systems that only provide partial encryption. While this offers robust protection, it presents a significant challenge for forensic investigators, as all data on the drive becomes inaccessible without decryption. Forensic access to BitLocker-encrypted volumes relies on obtaining key protectors such as the Volume Master Key (VMK) or the Full Volume Encryption Key (FVEK). The use of the VMK as an intermediate key enables the modification of compromised protectors without re-encrypting the drive's data. This study explores the feasibility of decrypting BitLocker-encrypted volumes using open-source tools and assesses their effectiveness. The research aims to contribute to the development of forensic methodologies for encrypted data access. Furthermore, while commercial decryption tools employing similar techniques often come with significant costs, this study highlights how open-source alternatives provide cost-effective solutions to break the Bitlocked encrypted drive. Hence, offering a valuable resource for investigators with limited budgets.},
        keywords = {Breaking Bit-locked drives, Encryption, Decryption of Bit-locked drives, Open source forensics, Digital Forensics, brute force attack.},
        month = {January},
        }