BitLocker To Go - Jesse Kornblum

More documents

Recommendations

Info

What Hasn't Changed• Logical access to a drive is not affected– Programs do not need to know about <strong>BitLocker</strong> to access the drive• Physical access to volume– Use \\.\C: file– This file handle can be imaged• Still using AES with Elephant diffuser• <strong>BitLocker</strong> can be disabled but still encrypt the data12
What Hasn't Changed• For each particular key k– Metadata contains copy of the VMK encrypted with that key– E(VMK, k)• Metadata also contains copy of k encrypted with VMK– E(k, VMK)• Having one key means you can get all the keys– Allows user to recreate an access device– Allows us to create an access device, too13
Page 1 and 2: C Y B E RS E C T O RBitLocker To Go
Page 3 and 4: • BitLocker Disk Encryption (BDE)
Page 5 and 6: - Introduced in Windows 7 (Fall 200
Page 7 and 8: Why You'll See More BitLockerUser r
Page 9 and 10: What Hasn't Changed• Computationa
Page 14 and 15: • Let's suppose metadata contains
Page 16 and 17: • Volume is protected using Smart
Page 18 and 19: Drive Layout• Version one munged
Page 20 and 21: Version 2 Drive LayoutDatNTFSF M M
Page 22 and 23: • Right-click easy for USB device
Page 24 and 25: BitLocker To Go Drive LayoutDate xF
Page 26 and 27: Policy Settings• Stored in Regist
Page 28 and 29: Auto Unlock Keys28
Page 30 and 31: • Need the Full Volume Encryption
Page 32 and 33: Incident Response• Want the auto
Page 34 and 35: • Look for clear key• Indicates
Page 36 and 37: Forensics• Try it out!• There's
Page 38 and 39: • Look for evidence of use on XP
Page 40 and 41: • Introduction• While you'll se

BitLocker To Go - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?