During a forensic investigation, an examiner discovers that a suspect encrypted files using BitLocker. Which risk mitigation approach should be prioritized to access the data?
-
A
Brute-force the BitLocker password immediately
-
B
Seek the recovery key from Active Directory or Microsoft account
-
C
Reformat the drive to bypass encryption
-
D
Run a live memory acquisition to capture the decryption key