TPM Sniffing & BitLocker Key Extraction

Unlock hardware-based encryption with this comprehensive 3 day course for digital forensic and security professionals looking to expand their expertise. This specialised training gives you practical skills to extract BitLocker keys from TPM chips using protocols like SPI and LPC. These techniques are increasingly important in digital forensics and security environments.

You’ll learn how to use logic analysers to tap SPI and LPC lines, capture and decode TPM traffic in real-time, extract keys, and mount BitLocker-encrypted volumes. The course also covers how TPM protects those keys and how to bypass that protection in a forensic context.

• BitLocker Fundamentals
• Laptop Disassembly & Component Identification
• Researching TPM (1.2 & 2.0 covered)
• Acquisition 1
• Logic Analysers Explained
• Capture VMK & Traffic
• Explore & Decode VMK
• Dislocker
• Acquisition 2

Our expert instructors bring years of forensic experience to create an immersive learning environment. With a strict cap of 6 participants, we provide personalised attention and guidance throughout your learning. The course combines theoretical knowledge with extensive hands-on sessions, allowing you to immediately apply what you’ve learned in realistic scenarios.

Register today to secure your place in this exclusive training opportunity, which will enhance your security assessment capabilities and professional value. Early booking is recommended, as places are strictly limited to maintain the highest quality learning experience.

FAQ's

Can I bring and use my own laptop?
Yes. We provide laptops for all training, but you're welcome to bring your own if you'd rather work in an environment closer to what you use day-to-day.

Do you cover both versions of TPM?
Yes. We have two laptops to train on, one with one version 1.2 and the other running 2.0.

Will I need my own logic analyser for the course?
No. All equipment, including a logic analyser, is provided for training. For ongoing use in the workplace, you'll need to source your own. You’re welcome to bring one if you’ve already purchased it, or buy one afterwards. We will explain what to look for during the course and recommend reliable models and suppliers. If you're thinking of buying in advance, feel free to ask us for recommendations.

Will I need any other equipment or incur extra costs after the course?
Just a logic analyser and a laptop. You might also choose to buy spare laptops to practise on, but that’s optional. No other costs or equipment are required.

Is there an exam?
No. There’s no final exam. You’ll receive a certificate of attendance, and the course is delivered in a practical, no-pressure environment focused on skill-building.