Chanh Vuong

I had a flash drive with important info that I needed to access. Unfortunately, I only had a Mac computer and the flash drive was protected by Windows BitLocker encryption.

A quick google pointed me at “M3 Bitlocker Loader for Mac”, which looked to be free. Unfortunately, it was not. The utility mounted the flash drive, prompted me for a password, and unencrypted the drive successfully. I was able to see the files but when I attempted to read or copy, the utility said that I needed to buy it for $40. Kinda expensive but if someone is desperate….

Thankfully there is a free solution called “Dislocker fuse”. Installation is easy using the HomeBrew package manager. Below are the steps I took to mount the flash drive.

Install “Dislocker fuse”

1. Install Xcode from the Mac App Store.
2. Install the “Xcode Command Line Tools” by running this command in the “Terminal.app”:
   xcode-select --install

   Note: If you skip this step, the Homebrew installation will install multiple versions of the “Xcode Command Line Tools” (for different OS and Xcode versions) and then hang.

3. Install Homebrew:
   /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
4. Install Fuse for macOS (which Dislocker requires):
   brew cask install osxfuse
5. Reboot the Mac to ensure that “Fuse for macOS” is fully installed.
6. Install Dislocker:
   brew install dislocker

Mount and Decrypt the Flash Drive

1. Plug your USB flash drive into the Mac. Click the Ignore button on the “The disk you inserted was not readable by this computer” dialog box.
2. Get the identifier for the BitLocker partition on the flash drive:
   diskutil list
   
   /dev/disk2 (external, physical):
      #:                       TYPE NAME                    SIZE       IDENTIFIER
      0:     FDisk_partition_scheme                        *61.9 GB    disk2
      1:               Windows_NTFS                         61.9 GB    disk2s1

   Note: The identifier for my flash drive partition (shown on far right above) is “disk2s1”. If you don’t use the correct identifier, you will get a “The signature of the volume (м) doesn’t match the BitLocker’s ones (-FVE-FS- or MSWIN4.1)” error when attempting to unlock the BitLocker partition below.

3. Unlock and mount the partition:
   # Unlock the BitLocker partition to a Dislocker virtual partition file
   sudo dislocker -v -V /dev/disk2s1 -r -uPASSWORD /tmp/mydrive
   
   # Mount the unlocked virtual partition
   sudo hdiutil attach /tmp/mydrive/dislocker-file -imagekey diskimage-class=CRawDiskImage -mountpoint /Volumes/mydrive

   Notes:
   – Replace PASSWORD with your password. Make sure to escape any special characters like exclamation mark with a backslash (ex: “secret\!”).
   – The “-r” flag passed to Dislocker allows only read-only access. When I omitted the flag to get read-write access, the dislocker command failed.

4. Later, unmount the drive by doing the following:
   # Unmount the unlocked virtual partition
   sudo hdiutil detach /Volumes/mydrive
   
   # Release the virtual partition
   sudo hdiutil detach /tmp/mydrive

Info above gotten from Open Bitlocker USB stick on OS X.