June 28, 2022, 1:33 a.m. | /u/Mufassa810

Computer Forensics www.reddit.com

I'm trying to carve for files from a system that was BitLocker encrypted. However, the free space still appears to be encrypted. Is this what everyone else typically sees?

I did some testing on a VM where I enabled BitLocker, took a image and decrypted it using the recovery key and the free space appears to be still encrypted as well.

bitlocker computerforensics space

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Security Audit and Compliance Technical Analyst

@ Accenture Federal Services | Washington, DC

ICS Cyber Threat Intelligence Analyst

@ STEMBoard | Arlington, Virginia, United States

Cyber Operations Analyst

@ Peraton | Arlington, VA, United States

Cybersecurity – Information System Security Officer (ISSO)

@ Boeing | USA - Annapolis Junction, MD

Network Security Engineer I - Weekday Afternoons

@ Deepwatch | Remote