Open Bitlocker USB stick on OS X

Question

I have a USB stick encrypted by Windows 7 built-in tool (bitlocker). I would like to open it on my OS X El Capitan.

When I open it, all I get is a file "BitLockerToGo.exe" and another "Read Me.url"

I found some pieces here and there but no full procedure for mac.

Answer 1

Actually I asked after some success because I thought it would benefit everyone ;-)

Here is the complete process. Some links are missing because I don't have enough reputation to embed them all. Sorry about that.

High-level, we "just" need dislocker.

But to install it, there are some dependencies to resolve... we need:

1. "Fuse for OS X"
   • Simply download the .img on their site, open and run the .pkg installer

2. Xcode command-line developers tools

   • I'm not sure what's the generic answer.

   • Open a terminal, and type

     xcode-select --install
     

     • If you get an error "-bash: xcode-select: command not found", you need to install Xcode from the App store, then start again this command.
     • If an alert windows popup asking if you want to install, click on "install" button.
     • If it prints error "xcode-select: error: command line tools are already installed, [...]", you're all set.

3. "Homebrew"

   • Following instruction on their website, type following in terminal:

     /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
     

   • If you get an error about Xcode tools not being installed whereas you did install it, then change the path to Xcode:

     sudo xcode-select -switch /
     

4. and obviously dislocker !

   • Download ZIP (available in green button "Clone or Download" on the right)
   • Extract ZIP content
   • Open terminal and change directory to the dislocker-master directory

   • Compile and install dislocker:

     brew install src/dislocker.rb
     

     • If you get an error about Xcode tools not being installed whereas you did install it, then change the path like this:

       sudo xcode-select -switch /
       

---

Don't be desperate, it's now time to mount the USB stick !

But it's not gonna be trivial...

1. Identify the device of the USB stick, using Disk Utility:
   • Open Disk Utility and select the USB stick drive. Somewhere you should get something like "disk3s1". Replace this example with your actual value in following lines.
   • Keep Disk Utility open, it will be used in next steps
2. Eject the USB drive for example from Disk Utility (Unmount button)

3. Create a directory for the decrypted file

   sudo mkdir /tmp/mydrive
   

   Warning: this directory will have strange characteristics: it appears with "ls" but not with "ls -l" and not in the Finder wherever it is, moreover the content can't be listed, and trying to delete it often fails with strange error messages. That's why I put it in /tmp which is cleaned at every reboot.

4. Decrypt the USB stick with dislocker. If disk is "disk3s1" and the password is "MyPassword", the command will look like:

   sudo dislocker-file -V /dev/disk3s1 -v -uMyPassword -r -- /tmp/mydrive
   

5. Add the disk image to Disk Utility and mount it

   sudo hdiutil attach -imagekey diskimage-class=CRawDiskImage /tmp/mydrive/dislocker-file
   

   Note: Don't try to list "/tmp/mydrive/dislocker-file" by yourself. Just assume it is there and write the path as is.

Hourray !!!, the new drive is there !

---

Because really nothing is easy, to clean-up you need to do the following:

1. Unmount the drive
   • For example from your friend Disk Utility, select its icon and click on "Unmount" button
2. Get rid of the image
   • From "Disk Utility", select the greyed drive, and from the menu "File" select "Eject".

3. Detach the fuse volume

   sudo  hdiutil detach /tmp/mydrive/
   

Only now the directory /tmp/mydrive is a plain directory that can be deleted...

---

As you noticed the process is definitely complex and finally I just get a read-only drive. I'm interested by any better answer.

Answer 2

I'd like to share my experience on High Sierra, as it seems to be even simpler.

Installation

Homebrew

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Fuse for macOS

brew cask install osxfuse

Notes

• To install and/or use osxfuse you may need to enable their kernel extension in System Preferences → Security & Privacy → General

• Make sure to reboot before proceeding further (as osxfuse advises to do so).

dislocker

brew install dislocker

Operation

Mount

# to unlock the dislocker image
sudo dislocker -v -V /dev/disk3s1 -r -uPASSWORD ~/mydrive

# to mount the unlocked image
sudo hdiutil attach /tmp/mydrive/dislocker-file -imagekey diskimage-class=CRawDiskImage -mountpoint /Volumes/mydrive

Unmount

# unmount the unlocked image
sudo hdiutil detach /Volumes/mydrive

# release the unlocked bitlocker
sudo hdiutil detach /tmp/mydrive

Script

I've also created a gist to ease the mount/unmount procedure:

# mount, will be available at /Volumes/bitlocker.disk3s1
sudo mount-bitlocker /dev/disk3s1 PASSWORD

# unmount
sudo umount-bitlocker /dev/disk3s1

Answer 3

I can confirm this still works (October 2nd, 2018). However, both the dislocker unlock command and the gist mount the volume as read-only. When full access (read/write) is required, remove the "-r" option from the dislocker command and/or edit the gist mount-bitlocker by removing "-r".

Answer 4

Alternative solution

Use Windows in virtual machine. Pass through the USB device to the VM and share back to host macOS.

I haven't tried it but it should work theoretically.