BitLocker To Go - Jesse Kornblum

• Look for written down/printed out recovery key• Eight groups of six digits• Each group is a multiple of 11• Look for Recovery key files• Unicode text• Contain string "Full recovery key identification:"• Look for External key files• Should be stored on USB devices• .BEK extensionIncident Response33