Forum Discussion
Digital Forensics: BitLocker Encrypted Drive
I have correctly calculated the offset and have no trouble using the bdemount command however I would appreciate some help with troubleshooting the error recieved when using the mount command.
All my commands executed in the lab so far
Thanks
Thanks ChrisKershaw 🙂
User can you try running your first bdemount command as root? I'd also recommend mounting to the /mnt folder on the host, rather than trying to manage mountpoints on the Desktop.
13 Replies
- AzMM
Bronze I
ChrisKershaw NyePrior - I have got stuck on this step, where it doesn't give output.
- AzMM
Bronze I
Hi NyePrior ChrisKershaw , i would like to provide feedback on the labs which is taking more time on completion on some labs were we could not see some hints or error or mandatory information like credentials which is needed for Linux labs and for troubleshooting. Can you please inform lab author to provide more information on hints section, Credentials section. We are seeing the most of the time going with troubleshooting and finding mandatory information like linux root user credentials. We need your support on adding those information to the labs which will help to complete soon.
- KieranRowley
Community Manager
Hi AzMM thank you for the valuable feedback. I will discuss it with the relevant team and lab author 🙂
- altmanoi
Bronze II
Hi
I've tried following the instructions in this thread and running all of the commands as root, yet I get the same error message and when I use bdemount, the folder I have mounted to (/mnt/usb, where i have created usb with mkdir /mnt/usb) is empty- altmanoi
Bronze II
I've also tried just mounting directly to /mnt, the same issue persists however
- KieranRowley
Community Manager
Hi User and OmarAlRashdi
I will ask our support team to take a look at this lab and make sure it is functioning properly
- OmarAlRashdi
Bronze I
I am having same issue with same error I have tried to mount to /mnt/usb (I had to create usb folder using sudo mkdir /mnt/usb as mount point) and also I have used full path for both bde1 and mount point but still no luck,
- ChrisKershaw
Community Support
Hi there 👋🏻,
Welcome to the Human Connection!
I'm Chris, I work in the Customer Support Team at Immersive, and I'll be happy to help you with your lab issue 😊.
I see you've used the correct sudo mount command, this should trigger a token that can be located within the /mnt/windows_mount directory. The second token is the deleted file.
Does this help at all?- User
Bronze II
nothing shows despite me having used both full and incomplete file paths
- ChrisKershaw
Community Support
Hi there 👋🏻
Thank you for getting back to me, I'm sorry that you are still having difficulties with the lab.
I'm going to tag my colleague, Nye, who works in our Content Team, to see if they can advise any further, so we can help you continue with your attempt.
NyePrior do you have any other suggestions, that can help the user progress on this one?