>> The last thing that we wanted to
talk about in this video is essentially how
to get our Windows BitLocker encryption keys.
We're again going to want to pull up
>> the command prompt.
>> Then from here, we're going to type
in the following commands.
If we wanted to see if the system had BitLocker on it,
we would essentially type the command
manage-bde.exe status,
and then it's going to run.
We have to run this as an administrator.
[NOISE]
On your victim machine
we would want to run that as an administrator,
so again, we'll type it over again,
and then it will provide you the status
of all of the devices on the system.
We can see our operating system Drive C,
it is fully decrypted,
the protection status, it is turned off.
Lock status is unlocked.
If we did have BitLocker on our system,
we would essentially type another command.
I'll go ahead and show you that,
it's not going to return anything though.
That's what it would look like,
and we don't have any protectors because we
don't have BitLocker on our system.
However, if it did return encryption keys,
you would essentially want to copy this and
then you would want to turn that into
a text file on
your forensic thumb drive.
That process is finally finished,
it is a rather large file.
But essentially we could take this,
we could have actually centrally
had it write to a text file as well,
instead of just copying.
But we can create a new text file,
and that is the
[inaudible] memory hash.
We can take that,
and that is the hash of our memory file.
Now we have our consolidated list
of evidence that we obtained,
we got the BitLocker encryption keys,
we have the memory file for the volatile memory,
we have our physical image,
and then we have the hash of
the volatile memory that we were
able to obtain and then
anything that we got from red line.
That's a consolidated list of
the evidence and artifacts that
you would have from your forensic investigation.
Then from here, we can go into the analysis portion.
Again, like all of the tools to capture this data,
there are a plethora of
analysis tools out there for you to use.
Just like Encase and FTK make their free versions of
the tools to acquire the memory,
they do have paid versions of Encase and
FTK that you can use
to examine the evidence that you will create.