When you use Arsenal Image Mounter to mount a disk image containing BitLocker-protected volumes, Windows will recognize those volumes and either ask to unlock them with a key (assuming they were in a locked state) or it will begin real-time decryption without requiring any user input (assuming they were in a disabled or suspended state.) There are a variety of ways in which "BitLockered disk images" (how Arsenal refers to disk images containing one or more BitLocker-protected volumes) can be launched into virtual machines. Here are some examples of workflows to launch BitLockered disk images into virtual machines:
This workflow is what we recommend if you would like maximum performance from the virtual machine:
1.) Use AIM to mount the disk image containing one or more BitLocker-protected volumes in write-temporary mode
2.) Use AIM's "Fully decrypt BitLocker-protected volumes" feature*
3.) Use AIM’s Launch VM feature to launch a virtual machine
4.) Run AIM Virtual Machine Tools by selecting the Ease of Access icon and use password bypass, etc. as desired
* This feature turns BitLocker off - fully decrypting all the contents of the BitLocker-protected volume. This is a time-consuming process and you can check on the status of full BitLocker decryption by using "manage-bde -status Volume Letter:" at a command prompt. Unlocking (rather than fully decrypting) BitLocker only results in real-time decryption of the BitLocker-protected volume contents as necessary, rather than full decryption.
This workflow is what we recommend for fastest access to the virtual machine (as there is no wait for full decryption):
1.) Use AIM to mount the disk image containing one or more BitLocker-protected volumes in write-temporary mode
2.) Use AIM's "Unlock BitLocker-protected volumes" feature or Windows itself on your forensic workstation to unlock the BitLocker-protected volume(s)
3.) Use AIM’s Launch VM feature to launch a virtual machine and select disable/suspend* BitLocker-protected volumes
4.) Run AIM Virtual Machine Tools by selecting the Ease of Access icon and use password bypass, etc. as desired
* By disable/suspend, we are referring to exposing the BitLockered volume's encryption key in the clear (the equivalent of "manage-bde -protectors -disable (Volume Letter:)"), turning off any volume protection.
This workflow we do not recommend, because AIM Virtual Machine Tools will not be injected and you will be on your own in terms of logging in to any Windows accounts:
1.) Use AIM to mount the disk image containing one or more BitLockered-protected volumes in write-temporary mode
2.) Do not unlock BitLocker
3.) Use AIM’s Launch VM feature to launch a virtual machine (without allowing AIM to unlock and disable BitLocker protection)