[Solved] How to access BitLocker encrypted drive in Linux?
I have a laptop running Windows 7 Ultimate. I have encrypted my drives using BitLocker. Now I have also installed Linux along with Windows. But my encrypted drives are not visible in Linux. How can I access BitLocker encrypted drive in Linux?
Linux doesn't have the ability to access BitLocker encrypted drive, but there are two tools: M3 BitLocker Loader for Linux and Dislocker which can access BitLocker encrypted drive in Linux/Ubuntu.
Solution 1: M3 BitLocker Loader for Linux
M3 BitLocker Loader for Linux, is a command line tool which can create, mount, access, read, write BitLocker encrypted drive under Linux/Ubuntu. After mounting BitLocker encrypted drive, we can read/write BitLocker encrypted drive in Linux.
Tutorial to mount BitLocker encrypted drive in Linux
Step 1: Download M3 BitLocker Loader for Linux installation package.
Step 2: tar -xvf m3.bitlocker.linux.tar ./
Step 3: cd m3.bitlocker.linux
Step 4: ./install.sh
Step 5: Enter the command to mount BitLocker encrypted drive in Linux: m3.BitLocker [device name] [mount path] [volume name] [password]
Solution 2: Dislocker
Dislocker is a free utility which can mount BitLocker encrypted volume in Linux. Here is a quick guide how to use it:
Please download dislocker from: http://www.hsc.fr/ressources/outils/dislocker/download/
Once downloaded extract the file: root@kali:~# tar -xvf dislocker.tar.gz, we have the options for comiling: w/ or w/o FUSE. Basically if we use FUSE , we will be able to mount it, and browse it, if not, then the only way to check the contents is to decrypt the full drive, which is not that efficient. So let's go for FUSE here. Edit the Makefile, and set __RUN_FUSE to 1 and __RUN_FILE to 0:
dislocker/src/Makefile
# Choose between one of them (done automatically by using `make fuse' or `make file')
__RUN_FUSE = 1
Then compile the app:
root@kali:~/dislocker/src# make
gcc -Wall -Werror -Wextra -Wconversion -DPROGNAME=\"dislocker\" -DVERSION=\"0.3\" -D_FILE_OFFSET_BITS=64 -I/usr/include -I. -L/usr/lib64 -D__ARCH_X86_64 -D__RUN_FUSE -DFUSE_USE_VERSION=26 -c -o outputs/fuse/fuse.o outputs/fuse/fuse.c
In file included from ./dislocker.h:28:0,
from outputs/fuse/fuse.c:33:
./outputs/fuse/fuse.h:32:19: fatal error: fuse.h: No such file or directory
compilation terminated.
make: *** [outputs/fuse/fuse.o] Error 1
If you get the error above you will need the FUSE header files, to install those run:
apt-get install libfuse-dev
and then compile dislocker, it should be good now.
root@kali:~/dislocker/src# make
root@kali:~/dislocker/src# make install
Once it's installed, you can use the recovery key to decrypt BitLocker encrypted drive. The steps are to read the volume, and then mount it with fuse. When we first read in the volume (decrypt) we will get a single file, called "dislocker-file", which can be mounted later.
Tutorial to access BitLocker encrypted drive in Linux with dislocker
Step 1: Copy the BitLocker encrypted volume.
% dd if=/dev/sda2 of = encrypted.bitlocker
This will copy the entire volume located into /dev/sda2 to encrypted.bitlocker
Step 2: Unlock BitLocker encrypted drive.
% dislocker-file -V encrypted.BitLocker -p563200-557084-108284-218900-019151-415437-694144-239976 -- decrypted.ntfs
This will decrypt BitLocker encrypted drive into decrypted.ntfs using the recovery key.
% dislocker-fuse -V encrypted.BitLocker -f /path/to/usb/file.BEK -- /mnt/ntfs
This will create a file into /mnt/ntfs named dislocker-file if the encrypted volume has a clear key enabled.
Step 3: Mount BitLocker encrypted drive once it is decrypted.
% mount -o loop ntfs/dislocker-file /mnt
Then mount it on a file into /Volumes for instance:
% mkdir /Volumes/blah && mount -t ntfs /dev/disk1 /Volumes/blah
BitLocker for Mac - M3 BitLocker Loader for Mac
Although Microsoft only developed and released BitLocker for Windows version, so Mac OSX cannot open BitLocker encrypted drive, but with the help of M3 BitLocker Loader for Mac, you can easily open/access BitLocker encrypted drive on macOS 10.14/10.13/10.12 and Mac OSX 10.11/10.10/10.9/10.8/10.7 Operating Systems.