-
Notifications
You must be signed in to change notification settings - Fork 52
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing identifier for Bitlocker Used Disk Space Only encryption #39
Comments
If we assume this is BDE ToGO from
If we assume this is BDE 7 offset 0xa0
92a84d3b-dd80-4d0e-9e4e-b1e3284eaed8 is different from known GUIDs.
Any more context about this volume? Also see: https://github.com/libyal/libbde/blob/master/documentation/BitLocker%20Drive%20Encryption%20(BDE)%20format.asciidoc#42-bitlocker-windows-7-and-later or https://github.com/libyal/libbde/blob/master/documentation/BitLocker%20Drive%20Encryption%20(BDE)%20format.asciidoc#43-bitlocker-to-go |
I will try to share everything I know: I still have the source PC available and I will try to image again. |
My initial guess is that the format was changed, I can add the identifier but without a reference image to confirm, this will be speculation at this point nothing else changed. Would it be possible to make a small test image that could be shared? |
Unfortunately, I can't reproduce it, but I can give you the initial image(raw or raw compressed by 7zip). The size of raw image is 29 Gb. I will upload the image(or 7z containing raw image, as you prefer) to Google Drive and grant you access(to the email address that you provided in profile info), if you are okay with that. |
@bulhakov-adf yes that sounds good to me, thx |
Cool. I have sent you an email message with a link. |
Thx, I received it, and as indicated will try to have a look shortly at format changes. |
I've added support for the identifier (locally and will push the changes later). This looks it could be an identifier for "BitLocker Used Disk Space Only encryption" also referred to as Encryption On Write (EOW). |
Preliminary support of the "Bitlocker Used Disk Space Only encryption" has been disabled for now. Will re-enable when time permits to ensure format behaves the same as Windows 7 BDE |
@joachimmetz I might be able to help with the testing in a couple of days or so, is the current status of the "Bitlocker Used Disk Space Only encryption" such that bdemount can work on Windows 8/8.1/10 drives, but unsure if it works the same on Windows 7 drives? Let me know what I can do to help. |
It technically does work Windows 8/8.1/10 BDE volumes. "Bitlocker Used Disk Space Only encryption" is a specific format edge case of BDE, different from "regular" BDE volumes. What helps would be to determine how to reproduce this edge case also have a look at https://github.com/dfirlabs/bde-specimens |
I know that at least on Windows 10, it may give an option to encrypt used space only. Is the edge case such that Vista/7 won't prompt for this kind of encryption, and instead choose for you? @joachimmetz |
the edge case is, that it looks like to be an intermediate format that is not present on all BDE volumes
I looked at this last time, but the resulting volume appeared to be normal BDE volumes to me, maybe it needs to be paused |
Okay, and just to make sure, @joachimmetz has testing already occurred with bitlocker'd drives that don't use the TPM? (e.g. https://www.groovypost.com/howto/enable-windows-8-full-disk-bitlocker-encryption-without-tpm) |
Why would that affect the "Bitlocker Used Disk Space Only encryption"? the TPM only introduces a new key protector, see the documentation of this project for more information. How/why do you conclude that? But to answer your question, yes I have a test BDE volume from a system without a TPM. |
Just curious, in the case that it could have an effect on Used Disk Space encryption on Vista/7 |
I have another thought though. If the disk is currently encrypting, but then there's an update to be installed, if the update starts commencing, it will have to pause and temporarily disable bitlocker... similar to pausing and disabling it manually, would a system-update-forced pause likely be the edge case? @joachimmetz |
Another idea... What about the condition of an encrypted Windows Vista/7 updating to a new major version while bitlocker has been turned on? It would be different from a normal update, and surely the way bitlocker needs to handle that would have to be different than normal. It would explain why such drive would be able to be decrypted with the LIBBDE_VERSION_WINDOWS_7, yet have issues detecting that, if it's coming from an updgrade of Vista -> 7, or in between an update from 7 -> 8/8.1/10 |
And away from those ideas, would a setup being on BIOS vs UEFI have an effect on the identifiers? |
Also I noticed in your documentation, there's no note about Network Unlock... https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq Is this the missing link? More info at: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock |
Also, at least from dislocker, you may be interested in this commit: Aorimn/dislocker@017ac72 |
And probably not helpful, but also related: Aorimn/dislocker#102 |
@TheAlienDrew thx for the suggestions but blindly copying the observations (hearsay) or work of others is not typically not a good approach from a forensics perspective. What will help is reproducible test data. |
Oh I'm not suggesting any copying of work, but yeah I understand what you mean about having test data. |
Did some tests (with latest Windows 10) full or used space only option in the UI to encrypted a volume with BDE did not alter the format as originally reported Unmounting/detaching a VHD before the volume is fully encrypted also did not alter the format as originally reported, but did surface another data format edge case It could be that the guess/assumption that the format changes are related to "Bitlocker Used Disk Space Only" is incorrect. |
That's kinda what I was trying to say. I was thinking the reason why it's not standard is because it's a mix of events. |
@joachimmetz I assume this edge case has yet another 'new' identifier? |
Also would the case of using encryption on an HDD vs an SSD contribute to a changed identifier? |
not sure yet, need to looking into this more closely, not sure if native BDE support likes the volume being abruptly unmounted.
Not from what I've observed, but we can speculate indefinitely about possible causes
Possibly, one method to go about this could be to extend scripts like https://github.com/dfirlabs/bde-specimens to cover various known scenarios and see where the format surfaces. |
Maybe that's what another identifier is, an "interrupted" state if you will. I could imagine that would likely be the case, and necessary for situations like when power abruptly goes out. I assume an "interrupted" identifier would aid in using the BitLocker Repair Tool ( |
I just was looking at some stuff on reddit until I came across this comment Is this likely the missing identifier? A sort of "BitLocker Lite" device encryption? |
Don't think that is related, for Vista and 7 you could only use BDE in combination with certain versions of Windows. This no longer seems to be a limit. |
Ah yeah, brain fart, my bad |
Please can I ask what the current status of support for "Bitlocker Used Disk Space Only encryption" is? Could this feature be re-enabled (perhaps experimentally) now? |
@datasynergyuk the feature is not supported, if you have test data that contains the feature and you can share it. It could help. |
@joachimmetz thank you. I did some more investigation because I wanted to be sure of my facts and not waste your time. After double checking, I found that my problem occurs when initial encryption is still in progress. Once encryption has completed, even with "Used Space Only Encrypted" mode, Libbde can successfully access the volume. In other words, the cause of my issue is not what I originally thought. I tried to make a test image. This was surprisingly difficult with "Used Space Only Encrypted" mode because the encryption will complete very quickly unless there is a lot of data. This means any test image must be reasonably large. In the end, I did it but the image is ~5GB compressed. Please, would you expect Libbde to work in these circumstances, when the volume is only partially encrypted? The problem occurs when the volume state is:
However, once the initial encryption has completed, Libbde works ok:
I have a test image that demonstrates the problem. This contains a volume that is still performing the initial encryption in the state above: https://drive.google.com/file/d/1zqN-J6SSboSbD4uJ8lMLMTFn_52uNAuK |
@datasynergyuk interesting find, I'll take a closer look as soon as time permits, but unfortunately multiple other priorities at the moment. |
Hi,
Currently I am experiencing the issue with Bitlocker image. Here is an output including debug info:
bitlocker output.txt
I noticed that the problem appears at libbde_io_handle_read_volume_header function in libbde_io_handle.c in Bitlocker identifier checking logic. I tried to ignore checks and set LIBBDE_VERSION_WINDOWS_7 version to io_handle->version. This helped to decrypt the partition. Is it just a new Bitlocker identifier that is stored in those 16 bytes or the problem is much deeper?
Thank you!
The text was updated successfully, but these errors were encountered: