Data recovery from BitLocker encrypted end devices.Verification of the operational effectiveness of deployed BitLocker encryption.The PenTest is useful in two customer requirements: Recovery through the recovery key is not provided for this hack.ĭata recovery or simulation of a cyber attack. Any TPM-only protected hardware: servers, workstations, notebooks, tablets.Īfter the attack, the FPGA is removed from the TPM chip and the system can be rebooted.All BitLocker versions of the operating systems: Windows 7, Windows 8, Windows 10 incl.

This key is used to decrypt the Full Volume Encryption Key ( FVEK) of the system drive. During Windows boot with Microsoft encryption enabled, the Volume Master Key ( VMK) is transmitted from the TPM to the Windows system, where it is intercepted and logged by the FPGA.

The attack requires physical access to the PC, with a specially prepared FPGA (a Field Programmable Gate Array) being attached to the TPM 1.2 or TPM 2.0 as part of the intrusion attempt.

The method used is the TPM sniffing attack on the TPM chip described in March 2019, here is the Link to the Exploit. As an extension of the SEC4YOU PenTest portfolio, we offer a standardized audit of Microsoft BitLocker encrypted systems (servers, workstations, notebooks, tablets) with the aim to bypass the BitLocker encryption and extract all data.

Bitlocker data recovery