By Sophia | Last Updated
If you forgot both BitLocker password and recover key for external hard drive or USB drive, what can you do? Is it possible to recover BitLocker password to unlock the drive without data loss? Yes, you can find two free ways and one paid method in this article. If the password is the simple combination of digits and characters, it will take a short time to recover it. If the password is the complicate combination, it will cost days to get back it. Besides, it is not 100% recovery rate by using the following methods.
When you lost the BitLocker recovery key and forgot the BitLocker password, you can utilize third party tool to recover the forgotten BitLocker password. But the process is complicated, time-wasting and requires skill. It always fails in the last step.
Tips: This way can apply to all BitLocker encryption hard disk, external hard drive, USB drive or virtual disk.
1. Download ddrelease64.exe on your computer. You can search it online or go to this webpage to get it: http://www.chrysocome.net/download .
2. Download John the Ripper on your computer. You can get it here: https://www.openwall.com/john/
3. Extract John the Ripper on your computer.
You can go to find the downloaded Zip file and choose it. Then click on the Extract all button on the top menu.
Here, you can choose the destination to extract the files. You can define it by yourself and put it on the same disk with ddrelease64.zip.
After that, go to check the extracted folder and open it.
You will see a folder named run and go to open it.
You will find bitlocker2jogn.exe and john.exe on the folder. Remember its path.
1. Search cmd on the search box and then choose to run Command Prompt as administrator.
2. Open diskpart utility on CMD by running the command: diskpart.
3. Input the command: list volume and press Enter to check all volumes in your computer.
4. Input the command: select volume 2 and press Enter to select the BitLocker drive. You can replace the number 2 with your BitLocker volume number from the listed details.
5. Execute the command: detail partition to check the property of the volume.
You can see that the offset in Bytes of this volume is 548358062080. After that, you can execute command: exit to close DiskPart utility.
1. Execute the command to select the drive where ddrelease64.exe stores.
2. Execute the command: ddrelease64-list to get all available volume information.
3. Select a partition of the hard disk to export. You should remember the disk 0 path: \\?\Device\Harddisk0\DR0
4. Input the command: ddrelease64 if=\\?\Device\Harddisk0\DR0 of=disk0.001 bs=512 skip=1071011840 count=204800 and press Enter key. This process will be finished in seconds.
(Tips: if=\\?\Device\Harddisk0\DR0 means you select the disk 0 as the source disk; of=disk0.001 means the image file is exported to the current program location with the name as disk0.001; bs=512 means the size of the image file: 512bytes; skip=1071011840 means skip the distance of the input file, you can get this by offset in Bytes: 548358062080 devided by 512 equals 1071011840; count=204800 means the number of blocks to export)
5. You can open the disk to check the disk0.001 image file.
1. Input the command: cd "john-1.9.0-jumbo-1-win64\run” and press the Enter key to reach bitlocker2john.exe.
2. Input the command : bitlocker2john -i "D:\disk0.001" > "D:\hash.txt" and press Enter to export the hash code of the image file and save it as text file in D drive.
3. Input the command: notepad "D:\hash.txt" and press Enter key to open hash.txt file.
You can check the hash code in the text file:
1. Enter the command: john "D:\hash.txt" -mask=12345?d?d?d and press the Enter key to recover the BitLocker password.
(-mask=12345?d?d?d means that the first 5 digits of the password is 12345, and the later is digits. You need to change this according to your situation. If you know nothing about the password, you can delete this code. But it will take a long time to retrieve the password.)
2. You can press any key to check the process.
3. The password is found.
You should have 7-Zip program and John the Ripper exe on your computer. Also, if you fails to get the hash code from the 100MB image file, you can get 200MB image file to find the hash code. Here the BitLocker encrypted USB drive is used for test.
1. Download John the Ripper on your computer. You can search it online.
2. Get 7-Zip on your computer and double click to open it.
3. Click Yes to allow this app to make changes to your device and then hit on the Install button.
When the process ends, hit on the Close button to end the installation process.
4. Search 7-Zip on the search box and choose 7-Zip File Manager. Then click on Run as administrator.
5. On 7-Zip window, double-click to open Computer.
6. Double click on D drive to open it.
7. Choose john-1.9.0-jumbo-win64.7z and hit on the Extract button on the top menu.
8. On the pop-out window, change the destination to D drive and uncheck the below option. After that, hit on the OK button.
When the process goes to an end, you can see the exe on D drive.
1. Insert the encrypted USB drive into your computer and then launch 7-Zip. On the homepage, double click \\ option.
2. Choose PhysicalDrive1 disk and right-click it to choose Split file… option.
3. In the pop-out window, change the destination to D drive and set the split volume to 100M. After that, hit on the OK button.
4. Hit on Yes to confirm splitting.
5. The splitting process begins and you can hit on the Cancel button when it reaches to PhysicalDrive1.003.
6. Click Yes to cancel the splitting.
You can check the splitting files on the D drive.
1. Open Command Prompt as the administrator.
2. Execute command line: D: to access D drive.
3. Execute command line: cd john-1.9.0-jumbo-1-win64\run to access D:\ john-1.9.0-jumbo-1-win64\run folder.
4. Execute command line: bitlocker2john -i "D:\PhysicalDrive1.001" > "D:\hash.txt" to save the hash code to a text file.
5. Execute the command line: john "D:\hash.txt" -mask=12345?d?d?d to recover the BitLocker password. (-mask=12345?d?d?d means that the first 5 digits of the password is 12345, and the later is digits. You need to change this according to your situation. If you know nothing about the password, you can delete this code. But it will take a long time to retrieve the password.)
At last, you will get the BitLocker password to unlock the drive.
There is a much easier way to find back the BitLocker password for your encrypted disk. iSunshare UBitkey, the professional BitLocker password recovery software, can help you to recover the forgotten BitLocker password in three methods: Brute Force, Mask and Dictionary. You can choose one of them according to your situations and then perform the password recovery process in clicks.
Step 1: Download and install iSunshare UBitkey on your computer. Then, run the program and choose your BitLocker password recovery method.
Brute Force: Nothing you can figure out about the password.
Mask: Several characters and the length about the password are remembered.
Dictionary: Your password is easy and common. It is necessary to get a Dictionary file with all possible passwords in advance.
Step 2: Select your encrypted drive in the first section of the right panel.
Step 3: Try to give more hints about the password. If the Dictionary method is selected, import the text file into the software. After that, click the Start button and wait for the process to end. It might take hours or days, which depends on the recovery method you choose and the hints you give.
Both methods above are based on the situation that you know some digits of the password. If you forgot the BitLocker password and provide no hints to recover it, it will take days and months to recover it. iSunshare UBitkey is recommeded to use for its interactive interface and easy operations.
Related Articles:
