Reverse Engineering of Bitlocker External Key Files and Meta Data- A Forensic Need

Abstract

Microsoft’s Bit locker tool has made the job of forensic analysts tougher. It’s full disk encryption feature enables users to encrypt their data. When operated in USB key mode, bit locker generates an external key file called .bek file[1]. This file must be needed for an investigator to unlock and decrypt any encrypted drive. If the investigator fails to obtain this .bek file, he cannot unlock the encrypted media and cannot proceed with the further analysis. In this paper we propose a solution to this problem which aims at reconstruction of a .bek file. We observe the metadata sector of the encrypted drive. The metadata sector gives information about the .bek file name. This can be used to reconstruct a file. This reconstructed .bek file can be used to unlock an encrypted media and proceed with further forensic analysis.