The process is dead simple: grab any USB stick, get write access to the “System Volume Information,” and copy into it the “FsTx” folder and its contents. Shift+click Restart to get Windows to the recovery environment, but then switch to holding down the Control key and don’t let go. The machine will reboot, and without asking any questions or showing any menus, will drop you in an elevated command line with full access to the formerly Bitlocked drive, without asking for any keys.
Its dead simple to get write access to System Volume Information! 😉
By exploit standards, that’s not especially hard. I don’t think there’s really anything blocking accessing it at all if an NTFS volume is mounted on a typical desktop Linux distro, as it’s just NTFS permissions blocking it, and they’re not typically obeyed by Linux in the first place.
I’ll copy the bit here that I just edited into my reply after you edited the first post:
In the face of your edit, I see that you’ve misunderstood the exploit. You need write access to the System Volume Information directory of your own USB stick, not anything on the target machine. It’s much easier to get access to things on a computer than it is to get access on one particular computer, and this exploit lets you jump from one to the other.
Its whole-volume encryption, not file encryption. Most modern CPUs have built-in AES-NI instructions so its not much of a performance penalty (as long as AES is used for encryption).
Its dead simple to get write access to System Volume Information! 😉
By exploit standards, that’s not especially hard. I don’t think there’s really anything blocking accessing it at all if an NTFS volume is mounted on a typical desktop Linux distro, as it’s just NTFS permissions blocking it, and they’re not typically obeyed by Linux in the first place.
Its bitlocker encrypted. You need to unlock the disk to see System Volume Information in Linux.
I’ll copy the bit here that I just edited into my reply after you edited the first post:
Ah yeah, I misunderstood. Thanks for the clarification.
does bitlocker encrypt whole volume, or userdata folders? It’s a performance issue to encrypt anything that doesn’t need to be.
Its whole-volume encryption, not file encryption. Most modern CPUs have built-in AES-NI instructions so its not much of a performance penalty (as long as AES is used for encryption).
You can do full disk or folders
Your strike-through didn’t work somehow.
I know! I cant figure it out 😂
It’s the spaces, I think
I tried without spaces too unfortunately
I think it’s three tildas.
Its two. It didn’t like the exclamation mark. I removed it and it started working.
Oh nice work!