Aorimn / dislocker

FUSE driver to read/write Windows' BitLocker-ed volumes under Linux / Mac OSX
GNU General Public License v2.0
1.57k stars 195 forks source link

Block device required #119

Open saizai opened 7 years ago

saizai commented 7 years ago
$ sudo src/dislocker-fuse -u -V /dev/disk0s4 -- /Volumes/Windows
Enter the user password:
$ mount
[snip]
dislocker-fuse@osxfuse0 on /Volumes/Windows (osxfuse, synchronous)
$ sudo ls -l /Volumes/Windows
total 118514696
-rw-rw-rw-  1 root  wheel  60679524352 Jan  1  1970 dislocker-file
$ sudo file /Volumes/Windows/dislocker-file
/Volumes/Windows/dislocker-file: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 0, hidden sectors 857890816, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors 118514696, $MFT start cluster 4, $MFTMirror start cluster 7450879, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 034f5ee1202469ff7; containsMicrosoft Windows XP/VISTA bootloader BOOTMGR
$ sudo mount -o loop /Volumes/Windows/dislocker-file /Volumes/Win
mount: You must specify a filesystem type with -t.
$ sudo mount -t ntfs -o loop /Volumes/Windows/dislocker-file /Volumes/Win
mount_ntfs: -o loop: option not supported
$ sudo mount -t ntfs  /Volumes/Windows/dislocker-file /Volumes/Win
mount_ntfs: /Volumes/Windows/dislocker-file on /Volumes/Win: Block device required
$ sudo ntfs-3g  /Volumes/Windows/dislocker-file /Volumes/Win
mount_osxfuse: the file system is not available (16)

ETA:

$ ntfs-3g
ntfs-3g: No device is specified.

ntfs-3g 2015.3.14 external FUSE 29 - Third Generation NTFS Driver
[snip]
$ port search ntfs-3g
ntfs-3g @2015.3.14 (fuse)
    Safe read/write NTFS driver for FUSE
$ wget https://tuxera.com/opensource/ntfs-3g_ntfsprogs-2017.3.23.tgz
$ [config/make]
$  src/ntfs-3g
ntfs-3g: No device is specified.

ntfs-3g 2017.3.23 external FUSE 29 - Third Generation NTFS Driver
[snip]
$ sudo src/ntfs-3g  /Volumes/Windows/dislocker-file /Volumes/Win
$ mount
[snip]
dislocker-fuse@osxfuse0 on /Volumes/Windows (osxfuse, synchronous)
/Volumes/Windows/dislocker-file on /Volumes/Win (osxfuse, synchronous)
$ ls -l /Volumes/Win
total 10596784
drwxrwxrwx  1 root  wheel           0 Aug 27 20:38 $Recycle.Bin
-rwxrwxrwx  2 root  wheel         116 Aug 27 07:42 AppleBcInstaller.log
-rwxrwxrwx  1 root  wheel           1 Oct 30  2015 BOOTNXT
lrwxrwxrwx  2 root  wheel          18 Aug 27 20:32 Documents and Settings -> /Volumes/Win/Users
drwxrwxrwx  1 root  wheel           0 Aug 27 13:50 Intel
drwxrwxrwx  1 root  wheel           0 Oct 30  2015 PerfLogs
drwxrwxrwx  1 root  wheel        8192 Aug 28 16:41 Program Files
drwxrwxrwx  1 root  wheel        8192 Aug 29 12:18 Program Files (x86)
drwxrwxrwx  1 root  wheel        4096 Aug 29 12:18 ProgramData
drwxrwxrwx  1 root  wheel           0 Aug 27 14:13 Recovery
drwxrwxrwx  1 root  wheel        8192 Aug 28 05:21 System Volume Information
drwxrwxrwx  1 root  wheel        4096 Aug 27 13:51 Users
drwxrwxrwx  1 root  wheel       28672 Aug 30 06:07 Windows
-rwxrwxrwx  1 root  wheel      400228 Oct 30  2015 bootmgr
-rwxrwxrwx  1 root  wheel  3395035136 Aug 30 06:06 hiberfil.sys
-rwxrwxrwx  1 root  wheel  2013265920 Aug 30 19:12 pagefile.sys
-rwxrwxrwx  1 root  wheel    16777216 Aug 30 06:07 swapfile.sys

Huh.

mabentwickeltsich commented 7 years ago

Hey @saizai,

You need to read the man page of dislocker (man dislocker); you are missing important things.

But in short, these are the commands I use in OS X to decrypt and mount a Bitlocker encrypted partition:

#Creates a temporary directory for dislocker (name of your choice)
mkdir -p /tmp/dislocker_tmp

#Decrypts the partition (depends on the device and partition to decrypt)
dislocker -v -V /dev/disk1s1 -u -- /tmp/dislocker_tmp

#Creates the block device
hdiutil attach -imagekey diskimage-class=CRawDiskImage -nomount /tmp/dislocker_tmp/dislocker-file

#Mounts the decrypted partition using the block device (depends on the output of hdiutil attach)
diskutil mount /dev/disk2

#The mounting point will be /Volumes/something

Cheers Luis

Aorimn commented 6 years ago

@saizai : @mabentwickeltsich nailed it in the answer. Did it solve your issue?