From BitLocker-Suspended to Virtual Machine

This report outlines a red-team technique for turning a BitLocker-suspended Windows laptop into a virtual machine to facilitate stealthier operations. By decrypting the drive with Windows Setup (manage-bde), imaging it (dd), and converting to VMDK for VirtualBox, the operator preserves system and user certificates, enables snapshots, and simplifies tooling while avoiding direct tampering on the physical device. It highlights operational safeguards such as disabling NAT to prevent EDR callouts and mitigating domain machine password updates that could invalidate snapshots.