Attempting to examine a surface pro 8 without bitlocker keys or admin privilege
I want to extract a physical image, and analyze it with autopsy ideally. No Bitlocker key, 2024-12-29 03:0:48 Author: www.reddit.com(查看原文) 阅读量:5 收藏

I want to extract a physical image, and analyze it with autopsy ideally. No Bitlocker key, no admin.

I know, it sounds doomed. I have physical access to the device, it can't be impossible. I am able to log in as a standard user.

I can already get an encrypted physical image with WinFE, but cant analyze.

I'm not looking for an official or clean solution to this, I know if there is something out there I can do, that its going to be hard and very technical. But id like to try. Anyone know anything that can help me out? Maybe a forensic tool that can achieve this (paid or not)?

Some solutions I've explored:

Get key from TPM using logic analyzer (I can't because TPM on surface pro is not a chip but rather integrated into motherboard chipset or CPU from what I have read. Correct me if I am wrong though).

Get key from cloud account (checked, not there).

Get key from RAM dump (requires admin from what I have read).

My leading solution to this is hope that I can DMA attack the device, because if I can get the memory dump and a physical image of the drive, then passware can unlock the drive as shown here: https://www.youtube.com/watch?v=2KZRJRDh8Ws&t=326s I know DMA is hard but if I disable hyperV in UEFI and use PCILeech via thunderbolt maybe its possible?

EDIT: A solution to grant me elevated privilege/admin would work too, but most have been patched.


文章来源: https://www.reddit.com/r/computerforensics/comments/1homiww/attempting_to_examine_a_surface_pro_8_without/
如有侵权请联系:admin#unsafe.sh