Description
Jacky improved the BitLocker password, but you captured RAM while the drive was unlocked. Sift through the memory dump to recover the plaintext flag without brute-forcing the disk.
Setup
Decompress the RAM dump (it expands to several GB on disk). If space is tight, stream it instead: zcat memdump.mem.gz | strings | grep -oE 'picoCTF\{[^}]+\}' | sort -u.
strings + grep finds the flag in seconds because the drive was mounted when the dump was captured. The flag is cached in multiple memory locations (process, kernel FS cache, heap), so it appears many times - sort -u dedupes them.
Optional: Volatility 3's windows.bitlocker can also dump the FVEK directly from memory if you want the disk key instead of the flag plaintext. Install with pip install volatility3. If vol is not found or the image is unrecognized, sanity-check with hexdump -C memdump.mem | head to confirm you have a real memory image.
gunzip memdump.mem.gzls -lh memdump.memstrings memdump.mem | grep -oE 'picoCTF\{[^}]+\}' | sort -uzcat memdump.mem.gz | strings | grep -oE 'picoCTF\{[^}]+\}' | sort -u # streaming alternativeSolution
Want to try it yourself first?
The guided walkthrough reveals hints one step at a time.
Step 1Scan the memory image
ObservationThe challenge gives a disk image and a RAM dump taken while the drive was unlocked. The decrypted text is still in physical memory, so strings and grep beat cracking the password.Mounted-disk + RAM capture means decrypted file contents are sitting in physical memory.strings memdump.mem | grep -oE 'picoCTF\{[^}]+\}' | sort -uextracts every flag-shaped token and dedupes them. There's usually one true flag plus a couple of buffer-cache copies.What didn't work first
Tried: Trying to crack the BitLocker password by brute-forcing the disk image with hashcat or john.
The challenge says not to brute-force the disk, and a strong password could take hours or never finish. The RAM dump already holds the plaintext, so the password does not matter. Grep the memory image.
Tried: Running strings on the disk image (.dd file) instead of the memory dump (.mem file).
The disk holds encrypted sectors, so strings over it returns noise. The decrypted content is in the RAM dump, because the drive was mounted when memory was captured. Target the .mem file.
Learn more
Memory forensics exploits the fact that when an encrypted volume is mounted, the operating system keeps decrypted data in RAM. The encryption key itself, decrypted file contents, and recently accessed strings all reside in physical memory for as long as the system is running. A RAM dump captured while BitLocker is unlocked therefore contains the plaintext of whatever files were recently read - regardless of how strong the disk password is.
This is the basis of the cold boot attack, a technique where an attacker physically cools RAM chips (slowing the decay of stored data), removes them from the running machine, and reads the contents in another system to extract encryption keys. Cold boot attacks have been demonstrated against BitLocker, FileVault, and LUKS. The defense is to power off machines completely before leaving them unattended in physically insecure environments.
The
stringstool works on memory dumps exactly as it does on executables - it scans raw bytes for printable sequences. Because RAM contains all running process memory, heap data, stack frames, and kernel buffers, it is a rich source of artifacts: passwords typed into terminals, browser history, decrypted file content, and cryptographic keys. This makes live memory acquisition a high priority in digital forensics.Step 2Optional: use Volatility
ObservationThe dump came from a live Windows system with BitLocker active. Volatility 3's windows.bitlocker plugin can lift the Full Volume Encryption Key straight out of kernel memory, which is the other way in.Volatility 3 understands kernel structures so it can pull the FVEK (Full Volume Encryption Key) directly from RAM withvol -f memdump.mem windows.bitlocker. That key plus dislocker -k unlocks the disk image even if you never recover the user password.What didn't work first
Tried: Installing Volatility 2 instead of Volatility 3 and running vol.py with the same plugin names.
Volatility 2 and 3 use different plugin names and different profile systems. windows.bitlocker belongs to Volatility 3; the version 2 plugin has another name and interface. An unknown-plugin or missing-profile complaint usually means you are on the wrong version, so install volatility3 and use the vol command.
Tried: Using the FVEK recovered by Volatility directly with hashcat or as a password string.
The FVEK is a raw binary key, not a password. Pass it to dislocker with -k to mount the disk. Typing it into an unlock dialog does nothing, because the key sits below the password layer entirely.
Learn more
Volatility is the leading open-source memory forensics framework. Rather than treating a memory dump as a raw byte blob, Volatility understands Windows (and Linux/macOS) kernel structures and can reconstruct process lists, network connections, registry hives, loaded modules, and file artifacts from the dump. This structured approach is far more powerful than grep for complex investigations.
Key Volatility plugins for BitLocker investigations include
windows.bitlocker(a community plugin that extracts FVEK encryption keys directly from memory; drop it into your Volatility 3 plugins directory, it is not bundled by default),windows.pslist(lists running processes), andwindows.filescan(finds file objects cached in memory). Recovering the Full Volume Encryption Key (FVEK) from memory allows mounting the disk even without knowing the user password.Autopsy is a GUI-based digital forensics platform that integrates Volatility as a plugin. It provides timeline analysis, keyword search, hash lookup, and artifact extraction in a unified interface used by law enforcement and corporate incident responders worldwide. The combination of Autopsy for disk artifacts and Volatility for memory artifacts covers most digital forensics investigations. The Volatility 3 guide walks through the plugin catalog (pslist, filescan, hashdump, bitlocker) with real picoCTF artifacts.
Interactive tools
- Strings ExtractorPull printable text from any binary, library, or image. ASCII and UTF-16 detection, configurable minimum length, flag-like highlight, no command line needed.
- Hex ViewerView text or raw hex bytes as a xxd-style hex dump with byte offset, hex columns, and ASCII sidebar. Highlights printable characters and null bytes.
Flag
Reveal flag
picoCTF{B1tl0ck3r_dr1v3_d3crypt3d_902...}
No password cracking is necessary because the RAM capture already contains the decrypted flag.