As a forensic investigator, there will come a time when you will come across the occasional computer that is difficult to get to the HDD and it may be encrypted by default, such as the Microsoft Surface Pro. In this short video, you'll learn how to easily conduct a boot scan of a Microsoft Surface Pro with Bitlocker activated.
When using ADF digital forensic tools to conduct a boot scan you first need to prepare your Collection Key with the appropriate Search Profiles. You will also need a USB Hub sufficient for the task at hand. 1 port for the Collection Key, 1 port for the Authentication Key, and 1 port for a target device should imaging also be required.
The Surface Pro only has one USB port so a hub will be required. Connect the Collection Key to the USB hub and the USB hub to the Surface Pro. The Authentication Key can be connected as well or inserted when prompted when the scan is started.
In order to boot the Microsoft Surface Pro to the USB Device hold the volume-down button while pushing and releasing the power button. When the ADF Boot Screen appears, you can release the power-down button. When booting to the Collection Key, Digital Evidence Investigator (DEI) will automatically launch the ADF application to scan the computer. No user input is normally required within the Windows Boot Manager.
Once DEI has launched there are two options available:
- Scan Computer and Image Computer. To proceed with the boot scan, click on Scan Computer.
- If imaging is the task, select Image Computer and follow the on-screen instructions.
If the Surface Pro has BitLocker enabled you will be able to enter the credentials and continue on with a scan or imaging. If you do not have the credentials and want to image the drive, you can ignore entering the credentials and continue.
If you are conducting a scan the credentials will need to be entered and the Authentication Key inserted to continue. Once the scan has started you may remove the Authentication Key and continue to other devices with prepared Collection Keys.
