Once booted into WinPE with the USB inserted:

| Feature | Description | |---------|-------------| | Disk decryption | BitLocker (TPM, PIN, USB key, recovery password), FileVault 2, VeraCrypt, LUKS | | Memory imaging | Capture RAM over FireWire, PCIe, or from hibernation files | | Password recovery | GPU-accelerated (NVIDIA/AMD) attacks on encrypted files (Office, PDF, ZIP, etc.) | | Boot media creation | Create WinPE USB or ISO from Passware interface | | Hash extraction | SAM, SYSTEM, NTDS.dit from offline system | | Cloud recovery | Decrypt BitLocker keys from Microsoft account (with legal authorization) |

Located under Start Menu → Passware → Tools. The interface shows:

When you boot the suspect machine from the USB, WinPE assigns drive letters differently than the original OS. The L: drive in your keyword could refer to:

To locate your target volume inside WinPE: