In this paper, the authors aimed at analyzing the efficiency of decrypting the bit locked volumes in PIN only mode. Based on the findings this paper considers the issue of decrypting the bit locked volumes in PIN only mode. The main drawback of the full volume encryption application is that it leaves several copies of the key used for encrypting the drive in the physical memory. This paper deals with the recovery of encryption key from the physical memory in case of live system.