---
title: "Reading a BitLocker drive on Linux"
date: "2025-01-30"
path: "/225-reading-a-bitlocker-drive-on-linux.html"
section: "/ramblings"
description: "Using dislocker to unlock a BitLocker-encrypted NTFS volume on Linux and mount it read only."
---

Sometimes you need to get at the files on a BitLocker-encrypted Windows disk from Linux: a laptop that will not boot, a drive pulled for forensics, or just a Windows volume attached to a Linux box. `dislocker` decrypts the BitLocker layer into a virtual file that you can then mount as ordinary NTFS. You need one of the usual BitLocker secrets to unlock it, the user password, the 48-digit recovery key, or a BEK file.

This was done on a recent Debian/Ubuntu. Work read only unless you specifically need to write, especially if the drive matters.

## Install and prepare mount points

```bash
sudo apt install dislocker
sudo mkdir -p /media/decrypt /media/windows-mount
```

I run the whole thing inside `screen` when it is on a remote box, so a dropped SSH session does not interrupt a long decrypt:

```bash
screen
```

## Find the partition

List the block devices and identify the BitLocker partition. It is normally the large NTFS one:

```bash
sudo lsblk
```

```text
sda           8:0    0 931.5G  0 disk
└─sda1        8:1    0 931.5G  0 part
```

## Unlock it

Point `dislocker` at the partition with the right unlock flag, and give it the decrypt directory as the target. The flags pick which secret you are using:

- `-u` with a user password
- `-p` with the 48-digit recovery password
- `-f` with a BEK file

```bash
sudo dislocker -V /dev/sda1 -u<password> -- /media/decrypt
```

If the command succeeds there is now a `dislocker-file` inside `/media/decrypt`. That file is the decrypted NTFS volume.

## Mount the decrypted volume

Mount the `dislocker-file` as a loop device. Read only first:

```bash
sudo mount -r -o loop /media/decrypt/dislocker-file /media/windows-mount
```

If you genuinely need to write to it, use `ntfs-3g` instead so NTFS is handled properly:

```bash
sudo mount -t ntfs-3g -o loop /media/decrypt/dislocker-file /media/windows-mount
```

The Windows files are now under `/media/windows-mount`.

## Unmount cleanly

Order matters on the way out: unmount the NTFS mount first, then the dislocker layer underneath it:

```bash
sudo umount /media/windows-mount
sudo umount /media/decrypt
```

That is the whole job. `dislocker` turns a BitLocker volume into a plain file, and everything after that is ordinary loopback NTFS mounting.