Windows: Read Bitlocker encrypted drive in Windows PE

Hi,

in WinPE it is possible to read bitlocker encrypted drives.

Check state
manage-bde -status c:

If the drive is only protected by a password use
manage-bde -unlock c: -pw
Continue reading Windows: Read Bitlocker encrypted drive in Windows PE →

Advertisment to support michlstechblog.info

Windows: Recover lost passwords from memory

Hi,

if a User is logged on and forget it’s password you can dump to lsa process and recover the password from a dump file.

Two tools are needed:

Microsoft’s sysinternals procdump
mimikatz. A tool to play with windows security. Take care when download precompiled binaries. Better get the source code from github and compile it yourself. Its very easy

Lets start. Login as a User with administrator permissions and dump the lsass process
Continue reading Windows: Recover lost passwords from memory →