Decrypt a USB flash drive encrypted with BitLocker

[16xypjnxlrew]

Hi everyone! I have a USB flash drive that contains a wallet.dat file. The flash drive is encrypted with BitLocker. Is there any way to brute‑force the 48‑digit recovery key? On the internet people say that BitLocker can’t be cracked, but if you don’t remember the long password it suggests entering the 48‑digit recovery key instead. Since there are only 10 digits (0–9), I’m wondering if there are programs that could brute‑force it at very high speed

[LoyceV]

On the internet people say that BitLocker can’t be cracked

Sometimes people on the internet are right. With 10^48 combinations, you can just as well try to brute-force the Bitcoin private key directly.

[DireWolfM14]

Is there any way to brute‑force the 48‑digit recovery key?

Mathematically speaking, you'd have better chances attempting to brute force Ana De Armas' phone number.

Microsoft allows you to back up BitLocker decryption keys on your OneDrive account.  If the USB stick yours, you have a Microsoft account, and you backed it up when you encrypted it, you should be able to find the decryption key on your account.  Is this your USB drive, or did you download an ISO from some ad-ridden site promising bitcoin for nothing?

[16xypjnxlrew]

Mathematically speaking, you'd have better chances attempting to brute force Ana De Armas' phone number.

Microsoft allows you to back up BitLocker decryption keys on your OneDrive account.  If the USB stick yours, you have a Microsoft account, and you backed it up when you encrypted it, you should be able to find the decryption key on your account.  Is this your USB drive, or did you download an ISO from some ad-ridden site promising bitcoin for nothing?

This is my USB flash drive. It was encrypted using Windows 7. The backup copy was on the desktop in a .txt file, but it was deleted along with other shortcuts

[Cricktor]

Why didn't you write down the complex and long decryption password/passphrase for your Bitlocker To Go encrypted storage device? Digital backup storage on the Windows desktop is probably the worst location, obviously.

Why didn't you additionally document and backup redundant copies of the 48-digits Bitlocker To Go recovery key? Seriously, the Bitlocker recovery key is your additional backup decryption method. It makes no sense to rely on a single-point-of-failure backup for a possibly significantly valuable Bitcoin wallet file.

Typically Bitlocker To Go uses AES-CBC encryption with 128-bit or 256-bit keys for removable storage drives. So, no feasible attack vector here.

What could possibly go wrong? Well...


Sorry to rub salt into your wound, but frankly the outcome of not saving any redundant physical backup for an encrypted device is exactly the misery you're facing. I'm highlighting the wrong-doing for others to avoid such mistakes.

[16xypjnxlrew]

Why didn't you write down the complex and long decryption password/passphrase for your Bitlocker To Go encrypted storage device? Digital backup storage on the Windows desktop is probably the worst location, obviously.

Why didn't you additionally document and backup redundant copies of the 48-digits Bitlocker To Go recovery key? Seriously, the Bitlocker recovery key is your additional backup decryption method. It makes no sense to rely on a single-point-of-failure backup for a possibly significantly valuable Bitcoin wallet file.

Typically Bitlocker To Go uses AES-CBC encryption with 128-bit or 256-bit keys for removable storage drives. So, no feasible attack vector here.

What could possibly go wrong? Well...


Sorry to rub salt into your wound, but frankly the outcome of not saving any redundant physical backup for an encrypted device is exactly the misery you're facing. I'm highlighting the wrong-doing for others to avoid such mistakes.

The password was generated using a website for generating passwords (numbers, lowercase and uppercase letters, as well as symbols). Shouldn’t it have been saved in the .txt file? I think that if the password consists of such a complex range (numbers, lowercase and uppercase letters, and symbols), then the 48-digit numeric code should be easier and faster to brute-force. Can someone say how long this might take? Is it possible to guess a 48-digit numeric code in a year or two?

[LoyceV]

Can someone say how long this might take?

Sure. If you have a really fast computer and can do 1 billion tries per second, it's going to take you 31709791983764586504312531709791 years.

Is it possible to guess a 48-digit numeric code in a year or two?

Now you're just trolling.

[16xypjnxlrew]

Sure. If you have a really fast computer and can do 1 billion tries per second, it's going to take you 31709791983764586504312531709791 years.

These are just ordinary numbers, there are no symbols or letters there. Moreover, somewhere on the forum I read that people used GPUs to crack private keys that consist of numbers and letters. How did they manage to do that? I think that if they were capable of that, then why is an ordinary 48-digit numeric code considered difficult and unrealistic? Considering that Google has already invented the Willow chip, does solving it remain realistic in the next five to twenty years?

[Cricktor]

There's absolutely no need for a full-quote of what I wrote. Please quote only what's specifically relevant for context. Full-quotes are annoying and commonly an exhibit of mindless lazyness.

It doesn't matter what all you have saved in that .txt file on your Windows desktop when you weren't able to prevent the file to be deleted. Of course, shit happens, occasionally I deleted files that I didn't want to delete, but that's what backups are for.

When was the file deleted? Recently or long time ago (the latter would be bad)?

I think the more expensive versions of Windows 7 had "Previous Versions" feature, where you could restore deleted files from the "Previous Versions" of the folder the file was located in. Have you tried to see if your Desktop folder has "Previous Versions" available (from Shadow Copies / System Restore points)?

Moreover, somewhere on the forum I read that people used GPUs to crack private keys that consist of numbers and letters.

Bitcoin private keys are 256-bit numbers. How you encode them to make them shorter is another story and in the cracking context only relevant if you're missing rather small portions of them, say in WIF format.

People were able to crack low-entropy private keys or when very bad PRNGs were used to create "bad" (less random) private keys (which would again be in the category of low-entropy private keys).

Provide sources of your claim when someone managed to crack a "good" Bitcoin private key!

I think that if they were capable of that, then why is an ordinary 48-digit numeric code considered difficult and unrealistic? Considering that Google has already invented the Willow chip, does solving it remain realistic in the next five to twenty years?

They weren't, do the math. You can't tackle a search space of magnitude 10⁴⁸, neither by time, nor by amount of energy needed, nor by expenses if you want to rent the required number of GPUs to be able to find a solution within your lifetime (you won't).

If we translate the problem to find a specific 48-digit decimal number to a binary number problem, we're dealing to find a 160-bit binary number. No. of bits is log₂(10⁴⁸) = 48*log₂(10) which is approx. 48*3.322, almost 160.

That could be equivalent to the puzzle #160 of the famous Bitcoin challenge puzzle (you can find the mega-thread to it in the Bitcoin Discussion board; search for yourself, I don't see the need to provide you a link, you might benefit from a little searching exercises).

Attempting solvers of the Bitcoin challenge puzzle struggle hard (for months) to solve puzzle #71 (with unknown public key) and that's a key search space in the order of 2⁷⁰, that's 1,237,940,039,285,380,274,899,124,224 easier than a 2¹⁶⁰ or 10⁴⁸ problem.

You have no idea of the magnitude of such numbers. Assume you have a rig that can try a billion or a trillion of numbers. Now, do the math how long it would take to search a specific number in the 10⁴⁸ space. DO the math...

[m2017]

The flash drive is encrypted with BitLocker.

First, people create their own problems, and then they try to solve them. Is it really worth bothering so much with bitcoin wallet encryption?

This is my USB flash drive.

If this were not the case, would anyone admit it on a forum where they are trying to get help with decrypting BitLocker?

Is it possible to guess a 48-digit numeric code in a year or two?

Come back with this question in 5-10 years. By then, computing power will have increased (and also the BTC-price - therefore, holding in your case will be beneficial).

[BitMaxz]

These are just ordinary numbers, there are no symbols or letters there. Moreover, somewhere on the forum I read that people used GPUs to crack private keys that consist of numbers and letters. How did they manage to do that? I think that if they were capable of that, then why is an ordinary 48-digit numeric code considered difficult and unrealistic? Considering that Google has already invented the Willow chip, does solving it remain realistic in the next five to twenty years?

If it's totally a numbers-only thing, then it is shortening the brute-force attack to exactly find the exact password, but it doesn't mean it can brute force within 1 to 2 years; it might be longer than that depending on the hardware you use CPU is slower than GPU.

The only tool that I know to crack BitLocker is the BitCracker developed by Eago, but I do not know if that tool supports newer GPUs for faster brute force attacks.

Are you planning to brute force your USB drive? Or are you just afraid someone could be able to hack it?

[ABCbits]

This is my USB flash drive. It was encrypted using Windows 7. The backup copy was on the desktop in a .txt file, but it was deleted along with other shortcuts

Is it deleted recently or long time ago? You could use file recovery software to recover that .txt file, although don't expect anything it it happened long time ago.

The password was generated using a website for generating passwords (numbers, lowercase and uppercase letters, as well as symbols).

In theory, if the website have known vulnerability when generating the password and you know it, it could be used to reduce the search space. But only expert who may find such vulnerability, even if it's exist in first place.

Is it possible to guess a 48-digit numeric code in a year or two?

Now you're just trolling.

Have you seen his trust feedback page?

[apogio]

Good luck OP!

Mathematically speaking, you'd have better chances attempting to brute force Ana De Armas' phone number.

Oh wow! And she gave me a wrong number on purpose when I asked her. Are you telling me I can brute force it now?

[bitbollo]

I am curious to know the real reason for cracking it. Did you store some bitcoin? Or at least did you know for it?
Or this is another way to ask solution for some corrupted dat file etc etc...?  
worst! it is a troll topic? yes. trust rating speaks by itself 

Cracking such a string of text is just impossible and without some clues (that of course are not provided) OP can just waste time.
It is absurd to estimates also any potential for this calculation  

[apogio]

I am curious to know the real reason for cracking it. Did you store some bitcoin? Or at least did you know for it?
Or this is another way to ask solution for some corrupted dat file etc etc...?  
worst! it is a troll topic? yes. trust rating speaks by itself  

I also believe it's a spam thread.

But in reality, some people buy random stuff from the internet, with fancy labels like "Selling a USB containing 1000BTC for only 0.1BTC because I don't remember the password".

You'll be surprised by the number of people who actually buy stuff like that.

[16xypjnxlrew]

When was the file deleted? Recently or long time ago (the latter would be bad)? I think the more expensive versions of Windows 7 had "Previous Versions" feature, where you could restore deleted files from the "Previous Versions" of the folder the file was located in. Have you tried to see if your Desktop folder has "Previous Versions" available (from Shadow Copies / System Restore points)?

The .txt file was deleted more than a year ago. The problem with recovering the .txt file is that Windows 10 was installed instead of Windows 7, and the OS was also reinstalled several times due to blue screen errors

Bitcoin private keys are 256-bit numbers. How you encode them to make them shorter is another story and in the cracking context only relevant if you're missing rather small portions of them, say in WIF format.

People were able to crack low-entropy private keys or when very bad PRNGs were used to create "bad" (less random) private keys (which would again be in the category of low-entropy private keys).

Provide sources of your claim when someone managed to crack a "good" Bitcoin private key!

They weren't, do the math. You can't tackle a search space of magnitude 10⁴⁸, neither by time, nor by amount of energy needed, nor by expenses if you want to rent the required number of GPUs to be able to find a solution within your lifetime (you won't).

If we translate the problem to find a specific 48-digit decimal number to a binary number problem, we're dealing to find a 160-bit binary number. No. of bits is log₂(10⁴⁸) = 48*log₂(10) which is approx. 48*3.322, almost 160.

That could be equivalent to the puzzle #160 of the famous Bitcoin challenge puzzle (you can find the mega-thread to it in the Bitcoin Discussion board; search for yourself, I don't see the need to provide you a link, you might benefit from a little searching exercises).

Attempting solvers of the Bitcoin challenge puzzle struggle hard (for months) to solve puzzle #71 (with unknown public key) and that's a key search space in the order of 2⁷⁰, that's 1,237,940,039,285,380,274,899,124,224 easier than a 2¹⁶⁰ or 10⁴⁸ problem.

You have no idea of the magnitude of such numbers. Assume you have a rig that can try a billion or a trillion of numbers. Now, do the math how long it would take to search a specific number in the 10⁴⁸ space. DO the math...

Thank you for the detailed explanation of all the technical aspects and difficulties. I must have been mistaken in thinking that numbers are easier to brute-force than hashes or the AES encryption itself

First, people create their own problems, and then they try to solve them. Is it really worth bothering so much with bitcoin wallet encryption? If this were not the case, would anyone admit it on a forum where they are trying to get help with decrypting BitLocker? Come back with this question in 5-10 years. By then, computing power will have increased (and also the BTC-price - therefore, holding in your case will be beneficial).

The flash drive really is mine. Yes, I agree with you—it was overly paranoid, and in this situation it ended up working against me

If it's totally a numbers-only thing, then it is shortening the brute-force attack to exactly find the exact password, but it doesn't mean it can brute force within 1 to 2 years; it might be longer than that depending on the hardware you use CPU is slower than GPU.

The only tool that I know to crack BitLocker is the BitCracker developed by Eago, but I do not know if that tool supports newer GPUs for faster brute force attacks.

Are you planning to brute force your USB drive? Or are you just afraid someone could be able to hack it?

So my theory was correct after all that if only numbers are used, the computational complexity drops from astronomical levels to much more realistic timeframes? Thank you very much for suggesting the BitCracker program. I hope it can help me. Yes, I was planning to decrypt my 8 GB flash drive before I realized that it might be technically almost impossible to do

Is it deleted recently or long time ago? You could use file recovery software to recover that .txt file, although don't expect anything it it happened long time ago.

I don’t know, but for some reason the Recuva data recovery program couldn’t find that .txt file

In theory, if the website have known vulnerability when generating the password and you know it, it could be used to reduce the search space. But only expert who may find such vulnerability, even if it's exist in first place.

I used this website to generate the password I don’t think it contains any vulnerabilities — https://lastpass.com

[ABCbits]

The password was generated using a website for generating passwords (numbers, lowercase and uppercase letters, as well as symbols).

In theory, if the website have known vulnerability when generating the password and you know it, it could be used to reduce the search space. But only expert who may find such vulnerability, even if it's exist in first place.

While i say "in theory", such thing happened at least once. See https://www.wired.com/story/roboform-password-3-million-dollar-crypto-wallet/.

Is it deleted recently or long time ago? You could use file recovery software to recover that .txt file, although don't expect anything it it happened long time ago.

I don’t know, but for some reason the Recuva data recovery program couldn’t find that .txt file

Have you tried the deep scan mode? It should find more file, although the scan take much longer. Personally i recommend TestDisk and PhotoRec, since both of them are open source and i've used both in past with better result.

In theory, if the website have known vulnerability when generating the password and you know it, it could be used to reduce the search space. But only expert who may find such vulnerability, even if it's exist in first place.

I used this website to generate the password I don’t think it contains any vulnerabilities — https://lastpass.com

FWIW lastpass is terrible password manager, they had many vulnerability in past. But from quick google search, i don't find one related with password generation.

[NotATether]

Have you made any "system image backup" of the C:\ drive? Not System Restore.

Have you ever imaged your system to an external drive using Macrium or Acronis or something like that?

Or have you ran a cloud backup program like Backblaze?

Those are pretty much your only hopes of finding the recovery key.

[philipma1957]

This thread gives me an idea.

I put 1 btc into a wallet.dat

Encrypt it with a long password.

And sell  ten copies for 0.11 btc

My profit .1 btc and whom ever cracks the usb first makes 1.0-0.1= 0.9 btc

I do not ship the usbs until all are sold.

[BitMaxz]

So my theory was correct after all that if only numbers are used, the computational complexity drops from astronomical levels to much more realistic timeframes? Thank you very much for suggesting the BitCracker program. I hope it can help me. Yes, I was planning to decrypt my 8 GB flash drive before I realized that it might be technically almost impossible to do

Yes, it should drop how long it would take to decrypt, but like I said, it still depends on your hardware specs.
Just a little advice: if you are going to touch the USB drive without a backup, it might destroy the data. You better make a clone first of your USB drive and use that clone instead when brute-forcing than use the original one.
So you will need some extra tools, like AOEMI backup tool or Lazesoft Disk Image and Clone (the one I use), or try Hirens there are many options there to clone a drive sector by sector.