Get the latest tech news
Dumping Memory to Bypass BitLocker on Windows 11
A UEFI application for dumping the contents of RAM.
In my experience I have had the most success restarting the system while Windows is loading but before the login screen has appeared, at least in the case of finding FVEK keys. I recommend leaving any other USB storage devices unplugged during this step to avoid the program accidentally writing to the wrong drive. The content of the dump will consist of whatever raw data was inside memory at the time, so I recommend a tool like xxd to read it more easily.
Or read this on Hacker News
