Extraction of BitLocker Volume Master Keys from TPM

Physical extraction of a TPM-unsealed BitLocker Volume Master Key (VMK) by either of two alternative methods: passive capture of an accessible TPM SPI bus during successful startup, or platform-specific Intel DCI debugging of the Windows Boot Manager to read the VMK from memory. Both require direct physical access. The SPI toolkit applies only when the TPM exchange is exposed on a compatible SPI bus. The DCI procedure requires platform-specific firmware support and analysis of the exact boot-manager build; the published demonstration is not a universal method. Neither method extracts a key from TPM storage.