dislocker VS CyberChef

It seems that there is a project named dislocker that is able to mount bit locker encrypted NTFS partitions. I'm not sure how you would use it on unRAID directly has I don't know which dependency it needs in addition to fuse but you could always try to download the binaries and test it. Otherwise, you can install it easily on any Linux VM if you already got one

Linux can open bitlocker devices, there are tools for that, such as Dislocker, which works on Linux and Mac OS.

Even if he does have it, there are tools for linux that can unencrypt the drive if they have the key, which is easy to get from your MS account.

You won't be able to access your files unless you use a tool like dislocker and know the password for the bitlocker partition.

just a warning to anyone using this tool: it sometimes miscalculated the size of the bitlocker partition when mounting it, which caused my to corrupt my filesystem when trying to modify my windows filesystem size from linux. recompiling with https://github.com/Aorimn/dislocker/pull/252 merged fixed the issue for me

If you want to access bitlocked files from arch, check out dislocker

You should be able to access Windows encrypted drives on Linux using dislocker. It used to work flawlessly last time I needed it, few years ago.

There's also an open implementation of Bitlocker that should allow you to mount the image (or disk) on Linux.

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...