So the last thing that we want to talk about in this video is essentially how to
get our Windows bit locker encryption keys. So
we're again going to want you pull up a command prompt,
and then from here, we're going to type in the following commands.
So if we wanted to see if the system had bit locker on it,
we would essentially type the command manage
Then it's going to run.
We have to run. This is an administrator.
So on your victim machine would want to run that it's an administrator. So little pipe it over again,
and then it will provide you the status of all of the devices on the system so we can see our operating system.
Uh, Dr C. It is split decrypted. The protection status. It was turned off.
Block status is unlocked.
If we did have a bit locker on our system,
essentially type another command.
I'll go ahead and show you that it's not going to return anything, though.
So that's what it would look like.
And we don't have any protectors because we don't have met locker
if it did return encryption keys, you would essentially want to copy this.
And then you would want to
forensic thumb drive.
Okay, so that process finally finished. It is a rather large file. But essentially, we could take this.
We could have actually
essentially had it right to a text file.
Well, instead of just copying it, we could create
And that is the hash of our memory files.
So now we have our consolidated list of evidence that we obtained.
We got the bit locker and kit encryption keys.
We have the memory file for the volatile memory. We have our physical image,
and then we have the hash
the volatile memory that we were able to obtain and than anything that we got from red line. So that's a consolidated list of the evidence and artifacts that she would have from your forensic investigation.
And then from here, we can go into the analysis portion.
So again, like, uh, all of the tools to capture this data, there are a plethora of analysis tools out there for you to use.
So just like in case an f g K make their free versions of the
tools to acquire the memory, they do have paid versions essentially of in case and F k that you can use to essentially examine the evidence that you drink.