0

I am an ongoing computer forensic student and I am working on taking an image on a bitlocker encrypted Windows 10 device.

Therefore I am creating a Version of Windows PE and mount it with FTK Imager 4.7.1.

The problem starts when I am trying to run the FTK Imager on the target machine. The programm will not start and it also does not throw any error. In the program files of the Imager is a program named adencrypt_gui.exe, which is working fine in the same setup.

Is it possible that I need to run the program with administrative rights? I tried that but found out that there is nothing like users or similar things in Windows PE.

Any help is appreciated and please let me know if you need more specs.

Thanks

overflodo
  • 1
  • 1

1 Answers1

0

Ok, I figured it out.
For anybody who has the same problem and is looking for an answer:
Windows PE is a minimalistic operating System, which misses many runtime and .dll files. You will need to install a dependency walker and run it on your target machine to determine the missing files.

overflodo
  • 1
  • 1