Search datasets for Bitlocker recovery files and triage live systems for Bitlocker keys.

This tool shall provide 2 purposes. A) when executed, it gives option to check current running OS and extract BitLocker keys from live RAM or B) ask user to select partition. From selected partition, it search the BitLocker saved keys (may be data carving is required here) and print keys along with recovery key or additional information.

Forensic tool using Python to simulate extraction of BitLocker encryption keys from live memory. Integrated memory acquisition (winpmem), automated dependency setup, and Elcomsoft VMK extraction to aid forensic investigations of encrypted drives.

Tool to search for bitlocker recovery keys