Using dislocker to mount BitLocker encrypted devices on Ubuntu Linux

If you have a BitLocker encrypted USB drive, and need to access it on a GNU/Linux machine, you're in luck. There is an utility called Dislocker which can be found at http://www.hsc.fr/ressources/outils/dislocker/ You can install it on Ubuntu with out much effort. [wpdm_file id=8 title=“true” desc=“true” ] The procedure in short (w/o command output):

tplecko@ubuntu-test: /tmp$ http://www.hsc.fr/ressources/outils/dislocker/download/dislocker.tar.gz
tplecko@ubuntu-test: /tmp$ tar -xvf dislocker.tar.gz

If we use FUSE we will be able to mount it and browse it. So let's edit the MakeFile, and set RUN_FUSE to 1 and RUN_FILE to 0

tplecko@ubuntu-test: /tmp$ vim dislocker/src/MakeFile
# Choose between one of them (done automatically by using `make fuse' or `make file')
__RUN_FUSE      =       1
__RUN_FILE      =       0
# NOTE: __RUN_FILE can be a veeeeeeeery long process to complete

Then install FUSE and compile the application:

tplecko@ubuntu-test: /tmp/dislocker/src$ sudo apt-get install libfuse-dev
tplecko@ubuntu-test: /tmp/dislocker/src$ sudo make
tplecko@ubuntu-test: /tmp/dislocker/src$ sudo make install

For decryption you can use the recovery key (decryption key), the user supplied password or the bek file. Here is my fdisk output:

tplecko@ubuntu-test: /tmp/dislocker/src$ sudo fdisk -l
[sudo] password for tplecko: 

Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0000ed70

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048   616957951   308477952   83  Linux
/dev/sda2       616959998   625141759     4090881    5  Extended
/dev/sda5       616960000   625141759     4090880   82  Linux swap / Solaris

Disk /dev/sdb: 64.0 GB, 63954747392 bytes
5 heads, 5 sectors/track, 4996464 cylinders, total 124911616 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x64d7cf12

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1            8064   124911615    62451776    7  HPFS/NTFS/exFAT

When we first read the volume we will get a single file, called “dislocker-file”, which can be mounted later. The steps are to read the volume, and then mount it with fuse.

tplecko@ubuntu-test: /tmp$ sudo dislocker -v -V /dev/sdb1 -p275374-090651-082764-392205-130460-581966-062942-402083 -- /mnt/tmp
tplecko@ubuntu-test: /tmp$ ls /mnt/tmp
dislocker-file
tplecko@ubuntu-test: /tmp$ sudo mount -o loop,ro /mnt/tmp/dislocker-file /mnt/disk
tplecko@ubuntu-test: /tmp$ ls /mnt/disk/
SecretFiles  $RECYCLE.BIN  System Volume Information

tplecko@ubuntu-test: /tmp$ sudo dislocker -v -V /dev/sdb1 -uMyPassword -- /mnt/tmp
tplecko@ubuntu-test: /tmp$ ls /mnt/tmp
dislocker-file
tplecko@ubuntu-test: /tmp$ sudo mount -o loop,ro /mnt/tmp/dislocker-file /mnt/disk
tplecko@ubuntu-test: /tmp$ ls /mnt/disk/
SecretFiles  $RECYCLE.BIN  System Volume Information