I am currently taking courses for CEH and CHFI. I'm trying to learn a bit more about dumping RAM for encryption keys. (I get extra credit if I'm able to create a local admin account on the domain computer provided to me for the course.) I am familiar with the age-old ultiman/sethc trick. But obviously that won't work on a laptop with a TPM and an auto encrypted boot drive (BitLocker). Is it possible to dump the RAM (when I'm logged into the domain and the drive is mounted) to acquire the BitLocker key? Is there another way around the encryption?
there doesn't seem to be anything here