YellowKey: Forensics After the BitLocker WinRE Bypass
26.07.2026 bitlockerdisk-encryptionwindows-forensicsanti-forensics
On May 12, 2026, a researcher operating under the handles “Chaotic Eclipse” and “Nightmare-Eclipse” released a proof-of-concept called YellowKey that bypasses BitLocker on Windows 11 and Windows Server 2022/2025 — no password, no cracking, no special hardware. Weeks later the flaw was assigned CVE-2026-45585. For DFIR practitioners, this is more than another CVE: YellowKey redraws the line around what a TPM-only-protected disk actually guarantees during a forensic acquisition.
The Mechanism: WinRE as the Gateway
By placing crafted ‘FsTx’ files in the System Volume Information directory of a USB stick and triggering the Windows Recovery Environment while holding the CTRL key, attackers can gain a command prompt with full access to encrypted drives. Timing is everything here: by the time the shell appears, the operating volume has already been transparently decrypted by the TPM, meaning the attacker inherits a fully readable filesystem with administrative tooling in hand. The root cause lies in Transactional NTFS behavior inside the recovery environment, abused to delete winpeshl.ini and expose an unintended command shell.
Independent researchers reproduced the finding quickly. Kevin Beaumont confirmed that the YellowKey exploit is valid and agreed that BitLocker has a backdoor, recommending a BitLocker PIN plus a BIOS password as mitigation. What makes this especially uncomfortable is that the triggering component exists in stock Windows installations — just without the context that activates it, fueling the ongoing “backdoor vs. bug” debate.
YellowKey is not an isolated incident but part of a growing family of WinRE-based bypasses. Its most direct ancestor, BitUnlocker, was a set of four WinRE zero-days disclosed by Microsoft’s own MORSE team in July 2025, affecting the full supported Windows 10, Windows 11, and Windows Server 2016 through 2025 product range. In parallel, French firm Intrinsec demonstrated a boot-manager downgrade chain leveraging CVE-2025-48804 to bypass the encryption protection on fully patched Windows 11 systems in under five minutes. Two distinct WinRE-driven bypass families surfacing within roughly eleven months is a structural trend, not a coincidence.
Forensic Artifacts and the Limits of Detection
For incident responders, the first question is what evidence survives. The System Volume Information\FsTx directory on the EFI partition has no legitimate reason to exist there, and modified timestamps on winpeshl.ini in the WinRE image are another signal. But detection has a hard ceiling: if the attacker boots from removable USB media, these detections will not work. That leaves the classic evil-maid scenario — brief, unsupervised physical access to an unattended device — essentially trace-free unless disk images are compared before and after the suspected window of access.
Monitoring is equally constrained. Because the exploit is local and pre-boot, there are no vendor-published IOCs, making asset review — identifying affected systems, checking for TPM-only configurations, and verifying WinRE mitigation status — the most realistic path to risk assessment. Microsoft’s response was a registry fix removing the triggering component from the recovery environment’s boot execution chain.
Implications for IR Playbooks
Three concrete actions follow for forensic practice. First, evidentiary reasoning about “encrypted but physically accessible” devices needs revisiting — TPM-only can no longer be treated as reliable proof of data integrity whenever an unsupervised access window existed. Second, asset inventories should mandatorily record BitLocker’s protection mode (TPM-only vs. TPM+PIN), since risk scoring and evidentiary weight both hinge on it. Third, for lawful forensic acquisition of seized TPM-only devices, this class of bug opens an additional, documentable extraction path — one that must be executed under strict chain-of-custody discipline to preserve integrity and reproducibility.
The takeaway for DFIR teams is simple: physical security and BitLocker configuration are inseparable. Without a PIN, disk encryption is a convenience feature, not a forensically defensible barrier.
← Back to overview