It requires administrators privileges and is still in beta test.

Bitlocker recovery information (recovery passwords key packages) stored in NTDS.dit.

For example, its not possible to parse Win 2008 NTDS.dit file from XP.

In fact, records checksum are computed in a different manner and database files appear corrupted for API functions.

Thats currently the main drawback of the tool, everything should be done on domain.

NTDS.dit file by the use of Microsoft VSS (Volume Shadow Copy Service).

Recovery password: its a 48-digits passphrase which allow a user to mount its partition even if its password has been lost.

It can be used with Microsoft tools, especially Bitlocker Repair Tool.

Recovery GUID: recovery password identifier, it could be the same for different encrypted volumes.

When ownership of the TPM is taken as part of turning on BitLocker, a hash of the ownership password can be taken and stored in AD directory service.

This information can then be used to reset ownership of the TPM.

In fact, we use native registry API, especially RegSaveKey() and RegLoadKey() functions which require SeBackup and SeRestore privileges.

Next we mount SAMREGISTRY hives on a different mount point and change all keys ACL in order to extend privileges to Administrator group and not LocalSystem only.

Thats why we choose to work on a backup to preserve system integrity.

However its an interesting project to understand strange Microsofts implementation and choices for each kind.

We can find exhaustively: RC4, MD5, MD4, SHA-256, AES-256, AES-128 and DES.

Finally, we would like to greet NTDS hash dump (Csaba Barta), libesedb and creddump authors for their excellent work.

Pwdump Windows