Daily Blog #410: Sunday Funday 7/1/18 - Bitlocker Encrypted Drive Challenge

Bitlocker Encrypted Drive Challenge by David Cowen - Hacking Exposed Computer Forensics Blog



Hello Reader,
             Another great week of reading your submissions. I'm loving how the extra time is really letting people push the 'most complete answer' portion of the rules. Every week I'm hard pressed to decide who should win but there is always one thing within the answer that pushes it over the top and makes it a winner. Last week it was not just testing the timezone's set but how the dates themselves are set for accuracy on a per operating system basis. Let's see what happens this week!


I taught a great FOR500 class in Canberra this week and when I teach I always get a new question that needs an answer. So here is this week's bitlocker based Sunday Funday.

The Prize:

$100 Amazon Giftcard


The Rules:

  1. You must post your answer before Friday 6/29/18 7PM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful 
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post



The Challenge:

A computer without TPM and has Windows 10 with a bitlocker encrypted drive is being upgraded. When it reboots in the upgrade process it does not prompt for the bitlocker password and it appears as though during the upgrade process the system is not protected. Your challenge is determine what level of access an examiner has during the upgrade process on a windows 10 system that is bitlocker encrypted during the reboot. 


1. Can you access the contents of the disk?
2. Can you boot to alternative media while it boots?
3. Can you access the drive if you prevent the reboot process from completing?
4. What is the mechanism that Windows is using to do this?
5. Can you force an update without logging in or while it is locked?
6. Can you reboot for an upgrade without logging in?

Also Read: Daily Blog #409

Post a Comment