BitCracker
An open-source GPU-accelerated password cracking tool for BitLocker-encrypted storage devices using dictionary attacks.
What is BitCracker?
BitCracker is an open-source password cracking tool specifically for storage devices encrypted with Microsoft BitLocker. It performs dictionary attacks to recover user passwords or recovery passwords, utilizing GPU acceleration via CUDA and OpenCL for speed. The tool extracts hashes from encrypted disk images and supports both fast attacks and MAC-verified modes to ensure accuracy.
Security researchers, forensic analysts, and penetration testers who need to assess or recover access to BitLocker-encrypted drives in legal or authorized testing scenarios.
BitCracker is unique as the first open-source tool focused on BitLocker encryption, offering GPU-accelerated performance and compatibility with John The Ripper. Its research-backed approach and support for multiple attack modes provide a specialized solution for a niche in digital forensics.
Overview
BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker
Use Cases
Best For
- Performing forensic analysis on BitLocker-encrypted drives
- Testing password strength of BitLocker-protected storage
- Recovering access to locked BitLocker volumes with forgotten passwords
- GPU-accelerated dictionary attacks for security assessments
- Researching BitLocker encryption vulnerabilities
- Integrating with John The Ripper for extended cracking capabilities
Not Ideal For
- Attempting to crack BitLocker drives encrypted with TPM for recovery passwords
- General-purpose password cracking across multiple encryption types like VeraCrypt or LUKS
- Situations requiring rapid recovery password brute-forcing without prior dictionary clues
- Environments lacking compatible NVIDIA or OpenCL GPU hardware for acceleration
Pros & Cons
Pros
Leverages CUDA and OpenCL to achieve high hash rates, such as 6.820 MH/s on Tesla V100, making dictionary attacks significantly faster than CPU-based methods.
Specifically designed for BitLocker encryption, supporting both user password (8-55 chars) and recovery password attacks, with integrated tools like bitcracker_hash for extraction.
Hash files are compatible with John The Ripper's OpenCL-BitLocker format, allowing seamless use within established forensic toolchains for extended cracking capabilities.
Offers a MAC verification option (-m flag) to eliminate false positives at the cost of speed, ensuring accuracy in critical forensic scenarios.
Cons
Cannot attack recovery passwords on BitLocker volumes encrypted with Trusted Platform Module (TPM), a common enterprise security feature, as explicitly admitted in the README.
Requires manual modification of Makefiles for specific GPU architectures and careful parameter adjustment (-t, -b flags) for optimal performance, which can be error-prone and time-consuming.
The recovery password search space is uniformly distributed and enormous, making brute-force attacks impractical without effective reduction strategies, as noted in the documentation.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.