[jcole]

I used john2bitlocker against a 520gb image I made and it came up with this hash

---

$bitlocker$0$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$1$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$2$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d
$bitlocker$3$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d
$bitlocker$0$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$1$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$2$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d
$bitlocker$3$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d

---

I’m pretty sure I set the password as either

MySuperSecretDrive10@

ThisIsMySuperSecretDrive10@

Or

Mydrive10@

Unlocking the Core VRAM (2 H/s to 1,017 H/s)

With a healthy executable, restored dependencies, and a constant icy blast from the external box fan.. I initiated a broad Structural Mask Attack (-a 3) targeting specific camel-case variants like Mydrive?d?d?d?d.

By switching from text-file dictionaries to a pure hardware mask, Hashcat applied its native Brute-Force optimizer. Instead of forcing the card to wait on data streams from the storage drive (which limits speeds to 2 H/s), the engine began generating all permutations directly inside the GPU's hardware cores.

The RTX 3060 working overtime. It skyrocketed from its baseline speeds to 1,017 hashes per second executing a full 10,000-combination numerical sweep in exactly 9 seconds flat while sitting at 63°C.

Current Status:

Every single exact phrase, direct typo, geometric capitalization toggle, and 4-digit trailing sequence (years, pins, numbers) attached to the core memory blocks has been systematically chewed through and officially Exhausted.

The underlying password wasn't in the immediate perimeter, but the infrastructure we built to find it is completely bulletproof. The graphics card is running cold, Windows permissions have been bypassed, and the system is primed to run high speed, and without breaking a sweat. I will keep trying.

[CL1B]

I'm curious to see how this plays out, good luck everyone.

This is for sure my vote for thread of the month on https://hackforums.net/showthread.php?tid=6322700

[jcole]

I’m pretty sure I set the password as either

MySuperSecretDrive10@

ThisIsMySuperSecretDrive10@

Or

Mydrive10@

The special character separators are officially exhausted. The 1,600 combinations finished in 5 seconds with a 324 H/s pace.
At this point, we have systematically eliminated:
All 10 raw, exact-match memory words.
Every straight, back-to-back word combo (WordWord).
Every single-digit numerical middle separator (Word[0-9]Word).
Every common special character middle separator (Word[!]Word).

[5chn4pp]

I have sent you a PM to verify the hashes of the images and if they match to the physical drive.

Let me know the output.

[JustSomeN00B]

Tried it with the shared passwords, no luck. Trying the ?a mask with hashcat, 8 chars. Should have an update today/tomorrow depending on Hash Rate (currently 15kH/s, since bitlocker. MD5 is 100GH/s)

Alright, so I tried the hashcat mask for awhile and was making no progress, so I called it. I tried all variations of your passwords, are you forgetting to tell us any?

[Unknown]

Best of luck OP, this definitely has the potential to turn into a fairly notable thread.
I'll keep an eye on it for further developments

[trippybiz]

Following... best of luck with this

[possessed-client]

I used john2bitlocker against a 520gb image I made and it came up with this hash

---

$bitlocker$0$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$1$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$2$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d
$bitlocker$3$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d
$bitlocker$0$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$1$16$eac7b3ac70197dfe91505abae28e6556$1048576$12$c0fbafa6000fdc0103000000$60$55f8db1043db29d4b2dce30384440ef20b6cb2f9244e0d9d90f91b74144b22de4a4b3a02641dc3bb73f96a71683b6a4959dbe2d98a5089dd5ac7723f
$bitlocker$2$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d
$bitlocker$3$16$1f3f1d6e0c8ca9d5551911940c4eb7c0$1048576$12$c0fbafa6000fdc0106000000$60$e6345665d2e653b114260c6cf22dc0a70571d571e13d2e2fbe454a41f6bb6e090d4317e5d1b1684d8e85ec9a490091cec6b3a59643870747f493329d

---

I’m pretty sure I set the password as either

MySuperSecretDrive10@

ThisIsMySuperSecretDrive10@

Or

Mydrive10@

I tried some variations for a couple hours, no luck. Any other clues or common password making patterns you use that you might've used in this case as well?

[JustSomeN00B]

I tried some variations for a couple hours, no luck. Any other clues or common password making patterns you use that you might've used in this case as well?

I've tried every variation of the shared passwords and had no luck with 4 GPUs since OP posted, I can guarantee it's not any of the shared passwords or variants unless I'm either unlucky or dumb (or both)

[5chn4pp]

I've tried every variation of the shared passwords and had no luck with 4 GPUs since OP posted, I can guarantee it's not any of the shared passwords or variants unless I'm either unlucky or dumb (or both)

It's not a problem with you.

I tried getting OP to actually verify the hash, but no response back.

[Ivanov_1]

OP i am going to send you a private message ok.

[XtremeDiscount]

I have sent you a convo regarding this! :)

Thanks! I responded

[5chn4pp]

OP has responded to my PM and given me valuable information.

For anybody that cares, I have now sent this to OP:

Thank you for the output, this is valuable.

The first clue is here:

Code

Backup type:
Saved to file

This means the BitLocker process saved the recovery key to a file. Usually this means it generated a file that looks like:

Code

BitLocker Recovery Key XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.txt

Open PowerShell as administrator, then run the following 3 searches for the file:

Code

Get-ChildItem -Path C:\Users -Recurse -ErrorAction SilentlyContinue -Filter "BitLocker Recovery Key*.txt" | Select-Object FullName,LastWriteTime,Length

Get-ChildItem -Path C:\Users -Recurse -ErrorAction SilentlyContinue -Filter "*.txt" | Select-String -Pattern "65917A4D-411E-41EB-9530-BC479C120596" -List | Select-Object Path,LineNumber,Line

Get-ChildItem -Path C:\Users -Recurse -ErrorAction SilentlyContinue -Filter "*.txt" | Select-String -Pattern "65917A4D" -List | Select-Object Path,LineNumber,Line

If it finds the file, please send it to me, it may be able to unlock the BitLocker volume.

If it does not find the file, open PowerShell as administrator, then try the following commands.

First, go to the John folder:

Code

cd C:\john-1.9.0-jumbo-1-win64\run

Then check which physical disk and partition D: actually maps to:

Code

Get-Partition -DriveLetter D | Format-List DiskNumber,PartitionNumber,DriveLetter,Offset,Size,Type

This is important because if D: is not actually on PhysicalDrive1, then the previous command was pointed at the wrong disk.

After that, try this corrected bitlocker2john command:

Code

py -3 .\bitlocker2john.py "\\.\PhysicalDrive1" -o 1048576 > current_hashes.txt 2> current_log.txt

Important: do not use single quotes around \\.\PhysicalDrive1.

The previous error:

Code

FileNotFoundError: [Errno 2] No such file or directory: "'\\\\.\\PhysicalDrive1'"

means Python tried to open a path that literally included the apostrophe characters. So it never actually read the drive. The empty current_hashes.txt file does not mean there is no hash; it means the command failed before extraction.

If the Get-Partition command shows a different disk number, change PhysicalDrive1 to the correct number.

Example:

Code

py -3 .\bitlocker2john.py "\\.\PhysicalDrive2" -o 1048576 > current_hashes.txt 2> current_log.txt

If the Offset value from Get-Partition is not 1048576, use the actual Offset value it shows.

Example:

Code

py -3 .\bitlocker2john.py "\\.\PhysicalDrive1" -o ACTUAL_OFFSET_HERE > current_hashes.txt 2> current_log.txt

If that still does not work, try reading the locked BitLocker volume directly:

Code

py -3 .\bitlocker2john.py "\\.\D:" > current_hashes_D.txt 2> current_log_D.txt

Do not use -o with \\.\D:, because \\.\D: should already start at the BitLocker volume.

If that also fails, try the raw partition path:

Code

$part = Get-Partition -DriveLetter D
$path = "\\?\GLOBALROOT\Device\Harddisk$($part.DiskNumber)\Partition$($part.PartitionNumber)"
py -3 .\bitlocker2john.py $path > current_hashes_partition.txt 2> current_log_partition.txt

Then check the output files:

Code

Get-Content .\current_hashes.txt
Get-Content .\current_log.txt

Get-Content .\current_hashes_D.txt
Get-Content .\current_log_D.txt

Get-Content .\current_hashes_partition.txt
Get-Content .\current_log_partition.txt

If any of those current_hashes files contain lines beginning with:

Code

$bitlocker$0$
$bitlocker$1$

then send those hash lines and the matching log file.

The main thing I want to compare is whether the current live-drive $bitlocker$1$ hash matches the image hash. If it matches, then the cracking work already done was against the right current volume. If it differs, we should stop attacking the image hash and switch to the new current-drive hash.

Also, your manage-bde output is actually encouraging:

Code

Key Protectors:
Password
Numerical Password

That means the current D: volume really does have both a normal password protector and a 48-digit recovery-password protector. So there should be a valid BitLocker password/recovery hash to extract from the current drive.

The recovery-key file is the best lead right now. The hash extraction is still useful, but “Backup type: Saved to file” means the real recovery key may already exist somewhere on the computer.

[XtremeDiscount]

Tried it with the shared passwords, no luck. Trying the ?a mask with hashcat, 8 chars. Should have an update today/tomorrow depending on Hash Rate (currently 15kH/s, since bitlocker. MD5 is 100GH/s)

I only have a 1tb ssd in my computer and my drive that I'm locked out of is 4tb. I ordered a 5tb external hard drive so I can make a full image. DO you think maybe those hashes are wrong and it's a different hash that will be found in the full image? I wonder why it has multiple hashes

---

It's not a problem with you.

I tried getting OP to actually verify the hash, but no response back.

I ran

py -3 .\bitlocker2john.py '\\.\PhysicalDrive1' -o 0x100000 > current_hashes.txt 2> current_log.txt

and it generated a current_hashes.txt file that's empty.

It also generated a current_log.txt file that says

Traceback (most recent call last):
File "C:\john-1.9.0-jumbo-1-win64\run\bitlocker2john.py", line 273, in <module>
main()
^^
File "C:\john-1.9.0-jumbo-1-win64\run\bitlocker2john.py", line 218, in main
with open(bitlocker_partition, 'rb') as fp:
^^^^^^^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: "'\\\\.\\PhysicalDrive1'"

I ran

manage-bde -status D:

and it says

BitLocker Drive Encryption: Configuration Tool version 10.0.26100
Copyright © 2013 Microsoft Corporation. All rights reserved.

Volume D: [Label Unknown]
[Data Volume]

Size: Unknown GB
BitLocker Version: 2.0
Conversion Status: Unknown
Percentage Encrypted: Unknown%
Encryption Method: AES 128
Protection Status: Unknown
Lock Status: Locked
Identification Field: Unknown
Automatic Unlock: Disabled
Key Protectors:
Password
Numerical Password

I also ran manage-bde -protectors -get D:

and I got

BitLocker Drive Encryption: Configuration Tool version 10.0.26100
Copyright © 2013 Microsoft Corporation. All rights reserved.

Volume D: [Label Unknown]
All Key Protectors

Password:
ID: {0A7D466F-A2DE-4989-B388-F9EB635502B6}

Numerical Password:
ID: {65917A4D-411E-41EB-9530-BC479C120596}
Backup type:
Saved to file

[JustSomeN00B]

I only have a 1tb ssd in my computer and my drive that I'm locked out of is 4tb. I ordered a 5tb external hard drive so I can make a full image. DO you think maybe those hashes are wrong and it's a different hash that will be found in the full image? I wonder why it has multiple hashes

Bitlocker can gen multiple hashes for various reasons (passwords, recovery key, TPM key, etc.)

Try making a full copy and reextracting the hashes, then update us please.