Unlock Bilocker USB or NTFS Partition on Ubuntu 18.04

Quick procedure to unlock an USB stick or a NTFS partition encrypted using Bitlocker.

Preface

The first part of the article describes the boot procedure in case you want to access a compromised Windows installation. The second part also applies to those cases where you need to read an NTFS partition or a USB stick from Ubuntu. For rescue purpose a connection with the Internet must be provided.

Rescue Boot

You need a USB stick with at least 2GB of space. Download the last LTS Desktop image from Ubuntu.

From a Ubuntu desktop just plug in the USB stick and launch the Startup Disk Creator program. Using the program you have to find the image you downloaded and then press Make Startup Disk.

From a Windows Desktop (10) there are dozens of tools but nothing really easy provided with the operating system. A widespread and easy tool is Rufus. If you download it, make sure that it is the original and not a copy to which malware has been added. Once installed the procedure is similar to that on Ubuntu.

Remember that creating a bootable USB stick will delete all data already on it.

Booting a PC with a USB stick is not always easy. The Boot From USB option must exist and the USB source must be at the top of the boot sequence. This is often not enough due to other options. Usually the Secureboot and Fastboot options do block and must be disabled.

As soon as Ubuntu asks, select the Try Ubuntu option.

Once the desktop is ready, open a terminal (CTRL + ALT + T) and add the universe repository as shown below.

$ sudo add-apt-repository universe

Software

If it has not already been installed, it is necessary to install the dislocker package as follows:

$ sudo apt update
$ sudo apt install dislocker libfuse-dev

Mount a Bitlocker USB Stick

To mount the USB stick you need to create two folders:

sudo mkdir /media/bitlocker /media/mount

To proceed, you must find out the name of the device that Ubuntu assigns to the USB stick. Connect the key to the computer and wait a few seconds for Ubuntu to recognize it. Using the lsblk program it is possible to read the name of the device.

$ lsblk

NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
. . .
sdb      8:16   1    59G  0 disk 
└─sdb1   8:17   1  58.9G  0 part /media/daniele/585B-AAAC

In this example the device name is sdb1

The following snippet creates a script that allows you to easily mount the USB stick. Please remember to check/change the device name!

$ echo >bitunlock <<EOF
#!/bin/bash
PASSWORD=$1
if [ -z $PASSWORD ]
then
  echo "syntax: $0 password!"
  exit 1
fi

set USERNAME=${whoami}
if [ "$USERNAME" != "root" ]
then
  echo "Please run as root"
  exit 1
fi

dislocker -r -V /dev/sdb1 -u$PASSWORD -- /media/bitlocker

mount -r -o loop /media/bitlocker/dislocker-file /media/mount
EOF

Make the script executable

$ chmod 755 bitunlock

The following snippet creates a script to unmount the USB stick.

$ echo >bitlock <<EOF
#!/bin/bash
set USERNAME=${whoami}
if [ "$USERNAME" != "root" ]
then
  echo "Please run $0 as root"
  exit 1
fi

umount /media/mount
umount /media/bitlocker 
EOF

Make the script executable

$ chmod 755 bitlock

Mount a Bitlocker NTFS Partition

In the same way you can mount an encrypted NTFS HD partition using Bitlocker. However, in the bitunlocker script, the parameter -u$PASSWORD must be replaced with
-p$PASSSWORD. The PASSWORD is, in this case, the 48-character key that MSWindows generated when it encrypted the disk.