Reading a BitLocker drive on Linux

30 January 2025

Sometimes you need to get at the files on a BitLocker-encrypted Windows disk from Linux: a laptop that will not boot, a drive pulled for forensics, or just a Windows volume attached to a Linux box. dislocker decrypts the BitLocker layer into a virtual file that you can then mount as ordinary NTFS. You need one of the usual BitLocker secrets to unlock it, the user password, the 48-digit recovery key, or a BEK file.

This was done on a recent Debian/Ubuntu. Work read only unless you specifically need to write, especially if the drive matters.

Install and prepare mount points

sudo apt install dislocker
sudo mkdir -p /media/decrypt /media/windows-mount

I run the whole thing inside screen when it is on a remote box, so a dropped SSH session does not interrupt a long decrypt:

screen

Find the partition

List the block devices and identify the BitLocker partition. It is normally the large NTFS one:

sudo lsblk

sda           8:0    0 931.5G  0 disk
└─sda1        8:1    0 931.5G  0 part

Unlock it

Point dislocker at the partition with the right unlock flag, and give it the decrypt directory as the target. The flags pick which secret you are using:

-u with a user password
-p with the 48-digit recovery password
-f with a BEK file

sudo dislocker -V /dev/sda1 -u<password> -- /media/decrypt

If the command succeeds there is now a dislocker-file inside /media/decrypt. That file is the decrypted NTFS volume.

Mount the decrypted volume

Mount the dislocker-file as a loop device. Read only first:

sudo mount -r -o loop /media/decrypt/dislocker-file /media/windows-mount

If you genuinely need to write to it, use ntfs-3g instead so NTFS is handled properly:

sudo mount -t ntfs-3g -o loop /media/decrypt/dislocker-file /media/windows-mount

The Windows files are now under /media/windows-mount.

Unmount cleanly

Order matters on the way out: unmount the NTFS mount first, then the dislocker layer underneath it:

sudo umount /media/windows-mount
sudo umount /media/decrypt

That is the whole job. dislocker turns a BitLocker volume into a plain file, and everything after that is ordinary loopback NTFS mounting.