Dislocker - FUSE driver to read/write BitLocker encrypted volume in Mac OSX/Linux. Dislocker is a tool to decrypt BitLocker encrypted volume from OSX or Linux developed by Romain Coltel. Dislocker uses a fuse based mechanism to decrypt the volume and mount it so that the user can access (read or write) the files within the volume. Note that this is not a brute force mechanism or hack; the user still needs to provide a valid BEK file (startup key) or numerical key or FVEK (Full Volume Encryption Key) or recovery password or user password for the decryption. Dislocker requires the PolarSSL library to work.
How to use dislocker in Mac OSX?
- Headers for FUSE;
- Headers for PolarSSL;
- A partition encrypted with BitLocker, from Windows Vista, 7, 8 or 10.
aptitude install libfuse-dev libpolarssl-dev
yum install fuse-devel polarssl-devel
First thing to do is to cd into the src/ directory. Then, just install Homebrew (http://brew.sh/) and run the
$ brew install dislocker.rb
This will install dislocker.
Dislocker is a command tool, so it is very complex for general users who don't have technical knowledge, but there is a alternative tool for dislocker: M3 Bitlocker Loader for Mac, it provides easy-to-use UI makes operations very simple in macOS 10.13 (High Sierra), 10.12 (Sierra) and Mac OSX 10.11/10.10/10.9/10.8/10.7.
Tutorial to read/access/mount Bitlocker encrypted volume in Mac OSX with M3 Bitlocker Loader for Mac
Step 1: Download, install and launch M3 Bitlocker Loader for Mac in Mac OSX computer.
Step 2: Insert a Bitlocker encrypted drive
Step 3: Select Bitlocker encrypted volume and then click "Open" icon to continue.
Step 4: Enter the password (or 48-digit recovery key).
And then click "Unlock" to open/mount Bitlocker encrypted volume.
Step 5: Select the files in Bitlocker encrypted volume and then copy them out.