BitLocker To Go - Jesse Kornblum

More documents

Recommendations

Info

Policy Settings• Stored in Registry• Control complexity, writing to unprotected devices• HKCU\Software\Policies\Microsoft\FVE
Auto Unlock Keys• User can configure system to automatically unlock a volume– <strong>BitLocker</strong> External Key stored in registry• HKCU\Software\Microsoft\Windows\CurrentVersion\ FveAutoUnlock\{GUID}• Key and metadata encrypted using CryptProtectData function– Uses login credentials and 3DES– Can be decrypted on the same machine27
Page 1 and 2: C Y B E RS E C T O RBitLocker To Go
Page 3 and 4: • BitLocker Disk Encryption (BDE)
Page 5 and 6: - Introduced in Windows 7 (Fall 200
Page 7 and 8: Why You'll See More BitLockerUser r
Page 9 and 10: What Hasn't Changed• Computationa
Page 12 and 13: What Hasn't Changed• Logical acce
Page 14 and 15: • Let's suppose metadata contains
Page 16 and 17: • Volume is protected using Smart
Page 18 and 19: Drive Layout• Version one munged
Page 20 and 21: Version 2 Drive LayoutDatNTFSF M M
Page 22 and 23: • Right-click easy for USB device
Page 24 and 25: BitLocker To Go Drive LayoutDate xF
Page 28 and 29: Auto Unlock Keys28
Page 30 and 31: • Need the Full Volume Encryption
Page 32 and 33: Incident Response• Want the auto
Page 34 and 35: • Look for clear key• Indicates
Page 36 and 37: Forensics• Try it out!• There's
Page 38 and 39: • Look for evidence of use on XP
Page 40 and 41: • Introduction• While you'll se

BitLocker To Go - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?