BitLocker To Go - Jesse Kornblum

More documents

Recommendations

Info

• Look for evidence of use on XP and Vista systems• Prefetch files for BitLockerToGo.exeForensics38
• Can add an access device• Remember, only one password per device• But external keys or recovery keys are fair game• Can recreate an access device• Use stored copies of the VMK• Can copy auto unlock keys from one computer to another• Have to be decrypted and re-encryptedOperations39
Page 1 and 2: C Y B E RS E C T O RBitLocker To Go
Page 3 and 4: • BitLocker Disk Encryption (BDE)
Page 5 and 6: - Introduced in Windows 7 (Fall 200
Page 7 and 8: Why You'll See More BitLockerUser r
Page 9 and 10: What Hasn't Changed• Computationa
Page 12 and 13: What Hasn't Changed• Logical acce
Page 14 and 15: • Let's suppose metadata contains
Page 16 and 17: • Volume is protected using Smart
Page 18 and 19: Drive Layout• Version one munged
Page 20 and 21: Version 2 Drive LayoutDatNTFSF M M
Page 22 and 23: • Right-click easy for USB device
Page 24 and 25: BitLocker To Go Drive LayoutDate xF
Page 26 and 27: Policy Settings• Stored in Regist
Page 28 and 29: Auto Unlock Keys28
Page 30 and 31: • Need the Full Volume Encryption
Page 32 and 33: Incident Response• Want the auto
Page 34 and 35: • Look for clear key• Indicates
Page 36 and 37: Forensics• Try it out!• There's
Page 40 and 41: • Introduction• While you'll se

BitLocker To Go - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?