for your interest
poc/pow
encrypted a 1 gb usb-drive with bitlocker in compatibility mode (old mode, pre win 10 1511)
imaged ftk/dd
bitlocker2john gives 4 hashes, 2 password ( $0, $1, same), 2 recovery ( $2,$3, same)
attacking password with known plain password length and style (10 digits bruteforce attack)
not working an a cracking rig but i think you will get the point
Time.Estimated...: Fri Sep 10 21:41:43 2021 (178 days, 10 hours)
attacking password hash with known password -> success
attacking recovery key hash with known recovery key not working on hashcat (i edited the recovery hash with $1 and used known recovery key with and without (-) as password resulting in not found
maybe i will also try the new bitlocker version but not now
conclusion for short
hashcat is able to crack the password $0 $1 (same hash) from bitlocker2john
hahscat is not able to attack the recovery key $2 $3 even when knowing the recovery key
if you have no clue about your own password, then you will crack till our universe collapse
edit:
for fun purpose only:
Integer overflow detected in keyspace of mask: ?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d
edit2:
john seems to be able to attack with mask but yeah gone with the blastwave
poc/pow
encrypted a 1 gb usb-drive with bitlocker in compatibility mode (old mode, pre win 10 1511)
imaged ftk/dd
bitlocker2john gives 4 hashes, 2 password ( $0, $1, same), 2 recovery ( $2,$3, same)
attacking password with known plain password length and style (10 digits bruteforce attack)
not working an a cracking rig but i think you will get the point
Time.Estimated...: Fri Sep 10 21:41:43 2021 (178 days, 10 hours)
attacking password hash with known password -> success
attacking recovery key hash with known recovery key not working on hashcat (i edited the recovery hash with $1 and used known recovery key with and without (-) as password resulting in not found
maybe i will also try the new bitlocker version but not now
conclusion for short
hashcat is able to crack the password $0 $1 (same hash) from bitlocker2john
hahscat is not able to attack the recovery key $2 $3 even when knowing the recovery key
if you have no clue about your own password, then you will crack till our universe collapse
edit:
for fun purpose only:
Integer overflow detected in keyspace of mask: ?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d-?d?d?d?d?d?d
edit2:
john seems to be able to attack with mask but yeah gone with the blastwave