• Bhushan D Ghode
• Akhlesh Kumar
• Dr. S. K. Jain

In this world of digital information and technology, everything is residing on electronic devices rather than on a piece of paper. It might be something as trivial as a birthday calendar to something as important as some confidential information, personal data or details regarding any intellectual property. It becomes an essential task to protect it, to make sure that it doesn’t fall into the wrong hands. Thus, every developer is embracing the technology of encryption. Encryption encodes the data with a key file, a password or a pin such that only the owner can access it. Bitlocker is an indigenous feature of Windows OS for the protection of portable storage devices such as hard disks and pen drives. The process of Bitlocker encryption and its decryption is shown in the present research paper. The research paper attempts to explain forensic examination of computer case where BitLocker is used and how memory forensic plays a vital role in decrypting it. The future of computer forensics is going to be challenging since Bitlocker is going to remain present in the latest and upcoming windows OS. The outcome of this research suggests a method that can be useful in forensic investigation wherever Bitlocker is used.

Bitlocker, Windows, Operating System, Encryption and Decryption, Forensic, Memory.

"Forensic Investigation Utilizing RAM Capture to Decrypt Bitlocker Volumes: A Case Study.", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.9, Issue 8, page no.c65-c72, August-2022, Available :http://www.jetir.org/papers/JETIR2208208.pdf

"Forensic Investigation Utilizing RAM Capture to Decrypt Bitlocker Volumes: A Case Study.", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.9, Issue 8, page no. ppc65-c72, August-2022, Available at : http://www.jetir.org/papers/JETIR2208208.pdf