BitLocker Fundamentals
Understand BitLocker encryption, its relationship with TPM technologies and the forensic challenges associated with protected storage.
Specialist Digital Forensics Training
TPM Sniffing & BitLocker Key Extraction
From Chip to Key: BitLocker Decryption via TPM
BitLocker encryption can present a significant challenge during digital forensic investigations, particularly where conventional access methods are unavailable.
This specialist three-day course provides practical training in examining Trusted Platform Module (TPM) technologies, capturing relevant communications and understanding methods used to recover key material in suitable technical circumstances.
Working with real hardware, delegates develop the knowledge and practical skills required to investigate supported TPM implementations and assess potential forensic acquisition opportunities.
- Duration
- 3 days
- Delivery
- In person, West Yorkshire
- Group size
- Maximum 6 delegates
- Price
- £3,000 excluding VAT
01 — The Challenge
When Encryption Becomes an Investigative Obstacle
BitLocker is widely used to protect information stored on Windows devices.
During a forensic investigation, access to encrypted data may be restricted where appropriate recovery information, credentials or decryption keys are unavailable.
Certain TPM configurations and system behaviours may provide opportunities to examine relevant communications and identify key material during normal cryptographic operations.
Understanding these opportunities requires knowledge of electronic hardware, TPM architecture, communication protocols and practical acquisition techniques.
This course introduces delegates to these technologies and provides supervised practical experience using appropriate hardware and examination methods.
Understanding the hardware can open up investigative opportunities that conventional forensic software alone may not provide.
02 — Practical Capabilities
Understand the Technology. Apply the Techniques.
The course combines technical explanation with practical exercises, allowing delegates to understand the purpose of each examination stage and develop confidence working with physical hardware.
TPM Architecture
Examine TPM 1.2 and TPM 2.0 implementations, identify relevant components and understand how the technologies interact with the host system.
Hardware Identification
Develop practical skills in laptop disassembly, circuit board examination and identification of components and communication interfaces.
Logic Analysers & Protocols
Learn how logic analysers are used to examine digital communications, including relevant SPI and LPC interfaces.
TPM Traffic & Key Material
Understand how captured TPM communications can be examined and interpreted, including the potential identification of BitLocker-related key material.
Forensic Application
Apply the training techniques in supervised practical exercises and understand the considerations involved in accessing encrypted volumes using recovered key material.
03 — The Course
Three Days of Specialist Practical Training
The course follows a structured programme covering BitLocker fundamentals, TPM technology, hardware examination, logic analyser operation, communications capture and forensic interpretation.
The emphasis is on understanding the technical processes and applying them through practical exercises.
- BitLocker Fundamentals
- Laptop Disassembly & Component Identification
- Researching TPM (1.2 & 2.0 covered)
- Acquisition 1
- Logic Analysers Explained
- Capture VMK & Traffic
- Explore & Decode VMK
- Dislocker
- Acquisition 2
04 — Practical Learning
Real Hardware. Real Techniques. Practical Understanding.
This is a practical training course, not simply a series of classroom presentations.
Delegates work with physical hardware and relevant forensic equipment under the guidance of experienced instructors.
The course introduces the underlying electronic principles before progressing through hardware examination, acquisition methods and interpretation of captured communications.
Training equipment and laptops are provided, allowing delegates to concentrate on understanding the techniques and developing their practical skills.
Small class sizes support individual guidance and opportunities to ask questions throughout the exercises.
Not one-button forensics. This course requires patience, practical effort and an appetite to learn.
05 — Student Experience
What Investigators Say About the Training
Our training is developed around practical forensic challenges and delivered in small groups, allowing delegates to develop their understanding through direct experience.
It's rare to find training that combines this level of technical expertise, practical application, and genuine investment in the people attending.
The reviewer travelled from Alaska to attend the course in person in West Yorkshire.
“The course provided straightforward, practical, and manageable methods for acquiring data from the TPM.”
Read the Original LinkedIn Review
These quotations are extracts from one genuine LinkedIn review, not two independent student testimonials.
“Thanks again for the course the past few days — I don't think I've ever been on a course that has made me that motivated to get back to the office and get cracking.”
“Thanks for explaining the hardware as you did — I understand this much better and have become more confident with hardware.”
06 — Delegate Information
Designed for Digital Forensic & Security Practitioners
This course is suitable for professionals seeking to develop their understanding of TPM technology and practical techniques relevant to BitLocker investigations.
It is particularly relevant to those encountering encrypted devices as part of forensic examinations, technical investigations and security research.
Intended audience
- Police officers and staff responsible for digital investigations
- Digital forensic practitioners
- Investigation professionals
- IT security and compliance specialists
- Security professionals and penetration testers
- Ethical hackers and security researchers
Prerequisites
No prior experience of TPM sniffing is required. The course introduces the relevant techniques from the ground up. Delegates should be comfortable undertaking detailed practical hardware work and should appreciate that the exercises require patience, care and attention.
Equipment
All training hardware, equipment and course materials required for the practical exercises are provided. Delegates may bring their own laptops if preferred.
Completion
There is no final examination. Delegates receive a certificate of attendance.
07 — Practical Information
Frequently Asked Questions
Do I need to pay for food / lunches?
No — we are based in Yorkshire, where we have an eyt all, sup all and pay nowt (Eat Everything, Drink Everything and pay nothing) policy for our students.
Can I bring and use my own laptop?
Yes. We provide laptops for all training, but you're welcome to bring your own if you'd rather work in an environment closer to what you use day-to-day.
Do you cover both versions of TPM?
Yes. We have two laptops to train on — one with TPM version 1.2 and the other running 2.0.
Will I need my own logic analyser for the course?
No. All equipment, including a logic analyser, is provided for training. For ongoing use in the workplace you'll need to source your own — you're welcome to bring one if you've already purchased it. We explain what to look for during the course and recommend reliable models and suppliers; if you're thinking of buying in advance, feel free to ask us for recommendations.
Can I pay extra for you to provide me with a logic analyser to take away?
Yes — we have a supply of them, and if you prefer for us to supply one then no problem. Speak to us at time of booking for the additional cost of this service.
Will I need any other equipment or incur extra costs after the course?
Just a logic analyser and a laptop. You might also choose to buy spare laptops to practise on, but that's optional. No other costs or equipment are required.
Is there an exam?
No. There's no final exam. You'll receive a certificate of attendance, and the course is delivered in a practical, no-pressure environment focused on skill-building.
08 — Course Information
Book Your Place
Our TPM Sniffing & BitLocker Key Extraction course is delivered in person at Harper Shaw Investigation Consultants in West Yorkshire.
Delegate numbers are limited to a maximum of six to provide appropriate supervision and practical learning opportunities.
- Course
- TPM Sniffing & BitLocker Key Extraction
- Duration
- 3 days
- Delivery
- In person
- Location
- Liversedge, West Yorkshire, UK
- Maximum delegates
- 6
- Price
- £3,000 excluding VAT
- Equipment
- Provided
- Assessment
- No final examination
- Completion
- Certificate of attendance
Confirmed upcoming dates and availability are shown on the Harper Shaw booking site.
09 — Organisational Training
Training for Your Digital Forensic Team
If your organisation has several practitioners who require training in TPM examination and BitLocker key recovery techniques, contact Harper Shaw to discuss your requirements.
We can consider departmental training arrangements, delegate numbers and the practical requirements associated with delivering specialist hardware-based training.
05 — Get in touch
Discuss Your Investigation or Training Requirements
Contact Harper Shaw to discuss a vehicle forensic examination, independent technical review, specialist training requirement or enquiry relating to The Vehicle Network. We can assess the information provided and discuss the appropriate next steps.