Bypassing BitLocker Drive Encryption

Picture this: You've received a hard drive that has evidence on it... you can't access it because it's BitLocker encrypted. What do you do?

This was completed on the device the drive was installed on - I haven't attempted outside of that playbox. Let me know how it works for you!

1. Get the BitLocker screen

2. Let's press Esc for the more recovery options as it offers below.

3. Navigate to Troubleshoot > Advanced Options > Command Prompt

4. Type

bcdedit /set {default} safeboot minimal

then press Enter

5. Close the command prompt window by clicking the X in the top right. This will return you back to the blue screen (WinRE main menu)

6. Select Continue. Your PC will now reboot; it may cycle 2-3 times. Your PC should now boot into safe mode.

Assuming you know the admin password (or have modified it from a boot tool that edits the local SAM database containing this password - see USB Booting | Hiren's BootCD PE (hirensbootcd.org)) you now have access to the drive and user folders.

To reverse and re-enable encryption:

1. Open command prompt (as administrator)

2. Type
   

bcdedit /deletevalue {default} safeboot

3. then press Enter

4. Restart as normal, confirm normal behaviour