For (mode 22100), you must convert:
Example:
1. What is bitlocker2john.exe? bitlocker2john.exe is a utility included in the John the Ripper (JtR) suite (community edition). Its purpose is to extract cryptographic hashes from BitLocker-encrypted volumes. These hashes can then be cracked using John the Ripper ( john ) or hashcat to recover the BitLocker recovery password or user passphrase. bitlocker2john.exe
$bitlocker$0$16$86a70c1a1c4a...$1048576$... $bitlocker$1$16$2b1f9e3a... : There may be multiple hashes (one for each key protector). You can crack any of them. Step 3: Prepare hash for cracking (John format) The output from bitlocker2john is already in John’s dynamic format. No conversion needed for john .
# Extract hash from image bitlocker2john.exe encrypted.dd > hash.txt john --format=bitlocker hash.txt Crack with hashcat (after converting) hashcat -m 22100 hash.txt rockyou.txt For (mode 22100), you must convert: Example: 1
dd if=/dev/sdb of=bitlocker_image.dd bs=512 status=progress bitlocker2john.exe bitlocker_image.dd > hash.txt Sample output (hash.txt):
:
cat hash.txt | grep -o '\$bitlocker\$0\$[^$]*\$[^$]*\$[^$]*\$[^$]*\$[^$]*\$[^$]*\$[^$]*' > hashcat_ready.txt Or use the --hashcat option if supported. john --format=bitlocker --wordlist=rockyou.txt hash.txt Step 5: Crack with hashcat (faster) hashcat -m 22100 -a 0 hashcat_ready.txt rockyou.txt 7. Options | Option | Description | |--------|-------------| | --extract | Extract recovery VMK (default) | | --nth | Nth key protector (0-based) | | --hashcat | Output hash in hashcat-compatible format | | --verbose | Show debug info |