Slides (pdf) - Jesse Kornblum

More documents

Recommendations

Info

BitLocker Tool Marks • Searching for BitLocker AES key schedules in RAM – Overlapped slightly
BitLocker Tool Marks • 0x0 FVEc pool tag • 0x14 Algorithm ID, must be 0x8000-0x8003 • 0x1C Start of first BitLocker AES schedule – AES key must be at start and end of schedule • bytes 0x1C-0x2C and 0x15C-0x16C – Zeros at end of schedule if 128-bit mode • 0x1EC Start of second BitLocker AES schedule – Same rules as above – Normal 256-bit AES key schedules require 0x1E0 bytes • But overlapping saves 0x10 bytes
Page 1 and 2: C Y B E R S E C T O R Practical Met
Page 3 and 4: No Encryption Application Operating
Page 5 and 6: Data on the Hard Drive Four score a
Page 7 and 8: Searching for Keys in RAM
Page 9 and 10: Current Methods • Brute Force - T
Page 11 and 12: Current Methods • Source code ana
Page 13 and 14: Tool Marks • Were the screwdriver
Page 15 and 16: • Hard to detect the keys - Small
Page 17 and 18: BitLocker Drive Encryption • I am
Page 19 and 20: • Brute Force works - FVEK is in
Page 21: • AES key schedules - Encryption
Page 25 and 26: BitLocker Tool Marks • Not perfec
Page 27 and 28: Finding Tool Marks • How did we d
Page 29 and 30: Forensics Tool Marks • Requires a
Page 31 and 32: • Full Volume Encryption Key (FVE
Page 33 and 34: • Contains E(FVEK, VMK) - FVEK en
Page 35 and 36: Scenario • Legitimate user has Ex
Page 40 and 41: Outline • Introduction • Types
Page 42 and 43: Thank you • ManTech International
Page 44: References • Key Schedule Searchi

Slides (pdf) - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?