Closed stevenengland closed 7 years ago
joachimmetz
commented
8 years ago Thanks for the report. If you can provide me with debug output (see: https://github.com/libyal/libbde/wiki/Troubleshooting#verbose-and-debug-output) I might be able to determine the reason behind this error message.
stevenengland
commented
8 years ago Hi Joachim,
here is a copy of a standard and a new built verbose output attached. It seems there is at least one more person out there with the same scenario :) http://www.heise.de/forum/heise-Security/Themen-Hilfe/Desinfect/Re-Desinfec-t-und-BitLocker-HowTo/posting-28802219/show/ http://www.heise.de/forum/heise-Security/Themen-Hilfe/Desinfect/Re-Desinfec-t-und-BitLocker-HowTo/posting-28802219/show/
Here is the parted output: Festplatte /dev/sda: 128GB Sektorgröße (logisch/physisch): 512B/512B Partitionstabelle: msdos
Nummer Anfang Ende Größe Typ Dateisystem Flags 1 524kB 2149MB 2149MB primary ntfs boot, diag 2 2149MB 128GB 125GB primary 3 128GB 128GB 530MB primary ntfs diag
Kind regards,
Steven
-----Original-Nachricht----- Betreff: Re: [libyal/libbde] libcaes_crypt_set_key: unsupported key bit size (#11) Datum: 2016-09-03T09:47:34+0200 Von: "Joachim Metz" notifications@github.com An: "libyal/libbde" libbde@noreply.github.com
Thanks for the report. If you can provide me with debug output (see: https://github.com/libyal/libbde/wiki/Troubleshooting#verbose-and-debug-output https://github.com/libyal/libbde/wiki/Troubleshooting#verbose-and-debug-output ) I might be able to determine the reason behind this error message. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/libyal/libbde/issues/11#issuecomment-244532962 , or mute the thread https://github.com/notifications/unsubscribe-auth/ALPerfrtbY2ryEXOxhZiq4yJUwHINENmks5qmSYSgaJpZM4JztGE .
{"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/libyal/libbde","title":"libyal/libbde","subtitle":"GitHub repository","main_image_url":"https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in GitHub","url":"https://github.com/libyal/libbde"}},"updates":{"snippets":[{"icon":"PERSON","message":"@joachimmetz in #11: Thanks for the report. If you can provide me with debug output (see: https://github.com/libyal/libbde/wiki/Troubleshooting#verbose-and-debug-output) I might be able to determine the reason behind this error message."}],"action":{"name":"View Issue","url":"https://github.com/libyal/libbde/issues/11#issuecomment-244532962"}}} output of standard-configuration build:
desinfect@desinfect:~/libbde$ sudo bdemount -p **** /dev/sda2 /mnt/sda2 bdemount 20160731
Unable to open: /dev/sda2. libcaes_crypt_set_key: unsupported key bit size. libbde_encryption_set_keys: unable to set full volume encryption key in decryption context. libbde_volume_open_read_keys_from_metadata: unable to set keys in encryption context. libbde_volume_open_read: unable to read keys from primary metadata. libbde_volume_open_file_io_handle: unable to read from file IO handle. mount_handle_open_input: unable to open input volume.
output of verbose build:
desinfect@desinfect:~/libbde$ sudo bdetools/bdemount -v -p ****\ /dev/sda2 /mnt/sda2 > /home/desinfect/bdeverboseoutput.txt 2>&1
bdemount 20160731
libbde_utf8_password_calculatehash: password: 00000000: ff fe 79 00 78 00 77 00 65 00 72 00 74 00 38 00 ..... *.... 00000010: 37 00 2b 00 ._.
libcfile_file_get_size: device media size: 125354586624
Reading BitLocker volume header:
libbde_io_handle_read_volume_header: reading volume header at offset: 0 (0x00000000)
libbde_io_handle_read_volume_header: volume header data:
00000000: eb 58 90 2d 46 56 45 2d 46 53 2d 00 02 08 00 00 .X.-FVE- FS-.....
00000010: 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 0c 40 00 ........ ?.....@.
00000020: 00 00 00 00 e0 1f 00 00 00 00 00 00 00 00 00 00 ........ ........
00000030: 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00000040: 80 00 29 00 00 00 00 4e 4f 20 4e 41 4d 45 20 20 ..)....N O NAME
00000050: 20 20 46 41 54 33 32 20 20 20 33 c9 8e d1 bc f4 FAT32 3.....
00000060: 7b 8e c1 8e d9 bd 00 7c a0 fb 7d b4 7d 8b f0 ac {......| ..}.}...
00000070: 98 40 74 0c 48 74 0e b4 0e bb 07 00 cd 10 eb ef .@t.Ht.. ........
00000080: a0 fd 7d eb e6 cd 16 cd 19 00 00 00 00 00 00 00 ..}..... ........
00000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
000000a0: 3b d6 67 49 29 2e d8 4a 83 99 f6 a3 39 e3 d0 01 ;.gI)..J ....9...
000000b0: 00 c0 f5 02 00 00 00 00 00 20 f5 42 00 00 00 00 ........ . .B....
000000c0: 00 30 0c 83 00 00 00 00 00 00 00 00 00 00 00 00 .0...... ........
000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00000100: 0d 0a 52 65 6d 6f 76 65 20 64 69 73 6b 73 20 6f ..Remove disks o
00000110: 72 20 6f 74 68 65 72 20 6d 65 64 69 61 2e ff 0d r other media...
00000120: 0a 44 69 73 6b 20 65 72 72 6f 72 ff 0d 0a 50 72 .Disk er ror...Pr
00000130: 65 73 73 20 61 6e 79 20 6b 65 79 20 74 6f 20 72 ess any key to r
00000140: 65 73 74 61 72 74 0d 0a 00 00 00 00 00 00 00 00 estart.. ........
00000150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00000160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00000170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00000180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00000190: 00 00 00 00 00 00 00 00 78 78 78 78 78 78 78 78 ........ xxxxxxxx
000001a0: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx
000001b0: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx
000001c0: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx
000001d0: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx
000001e0: 78 78 78 78 78 78 78 78 ff ff ff ff ff ff ff ff xxxxxxxx ........
000001f0: ff ff ff ff ff ff ff ff ff ff ff 00 1f 2c 55 aa ........ .....,U.
libbde_io_handle_read_volume_header: boot entry point: 00000000: eb 58 90 .X.
libbde_io_handle_read_volume_header: signature : -FVE-FS- libbde_io_handle_read_volume_header: bytes per sector : 512 libbde_io_handle_read_volume_header: sectors per cluster block : 8 libbde_io_handle_read_volume_header: unknown1 00000000: 00 00 00 00 00 .....
libbde_io_handle_read_volume_header: total number of sectors (16-bit) : 0 libbde_io_handle_read_volume_header: media descriptor : 0xf8 libbde_io_handle_read_volume_header: unknown2 : 0 libbde_io_handle_read_volume_header: sectors per track : 63 libbde_io_handle_read_volume_header: number of heads : 255 libbde_io_handle_read_volume_header: number of hidden sectors : 4197376 libbde_io_handle_read_volume_header: total number of sectors (32-bit) : 0 libbde_io_handle_read_volume_header: unknown4: 00000000: e0 1f 00 00 00 00 00 00 00 00 00 00 01 00 06 00 ........ ........ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 80 00 29 ........ ......)
libbde_io_handle_read_volume_header: volume serial number : 0x00000000
libbde_io_handle_read_volume_header: volume label : NO NAME
libbde_io_handle_read_volume_header: file system signature : FAT32
libbde_io_handle_read_volume_header: bootcode
00000000: 33 c9 8e d1 bc f4 7b 8e c1 8e d9 bd 00 7c a0 fb 3.....{. .....|..
00000010: 7d b4 7d 8b f0 ac 98 40 74 0c 48 74 0e b4 0e bb }.}....@ t.Ht....
00000020: 07 00 cd 10 eb ef a0 fd 7d eb e6 cd 16 cd 19 ........ }......
libbde_io_handle_read_volume_header: identifier : 4967d63b-2e29-4ad8-8399-f6a339e3d001 libbde_io_handle_read_volume_header: first metadata offset : 0x02f5c000 libbde_io_handle_read_volume_header: second metadata offset : 0x42f52000 libbde_io_handle_read_volume_header: third metadata offset : 0x830c3000 libbde_io_handle_read_volume_header: unknown5: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00000030: 00 00 00 00 00 00 00 00 0d 0a 52 65 6d 6f 76 65 ........ ..Remove 00000040: 20 64 69 73 6b 73 20 6f 72 20 6f 74 68 65 72 20 disks o r other 00000050: 6d 65 64 69 61 2e ff 0d 0a 44 69 73 6b 20 65 72 media... .Disk er 00000060: 72 6f 72 ff 0d 0a 50 72 65 73 73 20 61 6e 79 20 ror...Pr ess any 00000070: 6b 65 79 20 74 6f 20 72 65 73 74 61 72 74 0d 0a key to r estart.. 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 000000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 000000d0: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx 000000e0: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx 000000f0: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx 00000100: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx 00000110: 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxx xxxxxxxx 00000120: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ........ ........ 00000130: ff ff ff 00 1f 2c .....,
libbde_io_handle_read_volume_header: sector signature : 0xaa55
Reading BitLocker primary metadata block: libbde_metadata_read_block: reading metadata at offset: 49659904 (0x02f5c000) libbde_metadata_read_block: FVE metadata block header: 00000000: 2d 46 56 45 2d 46 53 2d 3a 00 02 00 04 00 04 00 -FVE-FS- :....... 00000010: 00 32 b7 2f 1d 00 00 00 00 00 00 00 10 00 00 00 .2./.... ........ 00000020: 00 c0 f5 02 00 00 00 00 00 20 f5 42 00 00 00 00 ........ . .B.... 00000030: 00 30 0c 83 00 00 00 00 00 90 a2 5a 00 00 00 00 .0...... ...Z....
libbde_metadata_read_block: signature : -FVE-FS- libbde_metadata_read_block: size : 58 libbde_metadata_read_block: version : 2 libbde_metadata_read_block: unknown1 : 4 libbde_metadata_read_block: unknown2 : 4 libbde_metadata_read_block: encrypted volume size : 125354586624 libbde_metadata_read_block: unknown3 : 0 libbde_metadata_read_block: number of volume header sectors : 16 libbde_metadata_read_block: first metadata offset : 0x02f5c000 libbde_metadata_read_block: second metadata offset : 0x42f52000 libbde_metadata_read_block: third metadata offset : 0x830c3000 libbde_metadata_read_block: volume header offset : 0x5aa29000
libbde_metadata_read_header: FVE metadata header: 00000000: 56 03 00 00 01 00 00 00 30 00 00 00 56 03 00 00 V....... 0...V... 00000010: 98 3e 10 12 84 03 1c 48 b9 a4 07 eb 7c 2f 7b 57 .>.....H ....|/{W 00000020: 0b 00 00 00 04 80 04 80 8d 67 ef b5 c9 72 d1 01 ........ .g...r..
libbde_metadata_read_header: metadata size : 854 libbde_metadata_read_header: version : 1 libbde_metadata_read_header: metadata header size : 48 libbde_metadata_read_header: metadata size copy : 854 libbde_metadata_read_header: volume identifier : 12103e98-0384-481c-b9a4-07eb7c2f7b57 libbde_metadata_read_header: next nonce counter : 0x0000000b libbde_metadata_read_header: encryption method : 0x00008004 (AES-XTS 128-bit encryption) libbde_metadata_read_header: encryption method copy : 0x00008004 (AES-XTS 128-bit encryption) libbde_metadata_read_header: creation time : Feb 29, 2016 08:18:03.681370900 UTC
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 0b 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x000b (UNKNOWN) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 02 00 00 00 8f 7d 33 c8 .b...r.. .....}3. 00000010: 9a 8b 9d 8a 7f b7 87 1e 9b fb 03 8c 22 8f 33 3d ........ ....".3= 00000020: 65 e0 a5 a9 06 f3 54 75 14 45 ce 37 28 30 4d 47 e.....Tu .E.7(0MG 00000030: 99 df 02 4c 33 b9 fe 6f 73 ef fb 6c d5 26 8b f0 ...L3..o s..l.&.. 00000040: 83 dd ea 67 e7 15 d5 91 ...g....
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 2 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 8f 7d 33 c8 9a 8b 9d 8a 7f b7 87 1e 9b fb 03 8c .}3..... ........ 00000010: 22 8f 33 3d 65 e0 a5 a9 06 f3 54 75 14 45 ce 37 ".3=e... ..Tu.E.7 00000020: 28 30 4d 47 99 df 02 4c 33 b9 fe 6f 73 ef fb 6c (0MG...L 3..os..l 00000030: d5 26 8b f0 83 dd ea 67 e7 15 d5 91 .&.....g ....
libbde_metadata_entry_read: FVE metadata entry: 00000000: 32 00 07 00 02 00 01 00 2.......
libbde_metadata_entry_read: entry size : 50 libbde_metadata_entry_read: entry type : 0x0007 (Description) libbde_metadata_entry_read: value type : 0x0002 (Unicode string (UTF-16 little-endian)) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 4c 00 41 00 50 00 54 00 4f 00 50 00 20 00 43 00 L.A.P.T. O.P. .C. 00000010: 3a 00 20 00 32 00 39 00 2e 00 30 00 32 00 2e 00 :. .2.9. ..0.2... 00000020: 32 00 30 00 31 00 36 00 00 00 2.0.1.6. ..
libbde_metadata_entry_read_string: string : LAPTOP C: 29.02.2016
libbde_metadata_entry_read: FVE metadata entry: 00000000: e0 00 02 00 08 00 01 00 ........
libbde_metadata_entry_read: entry size : 224 libbde_metadata_entry_read: entry type : 0x0002 (Volume master key (VMK)) libbde_metadata_entry_read: value type : 0x0008 (Volume master key) libbde_metadata_entry_read: version : 1 libbde_metadata_entryread: FVE metadata entry data: 00000000: 7b 31 8b 86 19 b0 aa 4f b1 36 ea c9 5f bc 62 1e {1.....O .6...b. 00000010: 70 f9 5a c2 c9 72 d1 01 00 00 00 20 6c 00 00 00 p.Z..r.. ... l... 00000020: 03 00 01 00 01 10 00 00 85 d6 2c 69 85 c9 3d ec ........ ..,i..=. 00000030: b2 1d 50 ca 29 08 76 60 50 00 00 00 05 00 01 00 ..P.).v` P....... 00000040: f0 62 c2 c1 c9 72 d1 01 03 00 00 00 22 30 0c 5a .b...r.. ...."0.Z 00000050: c0 a1 aa 10 09 b4 6c 77 83 08 90 ac 98 46 3a 46 ......lw .....F:F 00000060: a5 40 46 48 1d a2 91 b0 26 9c 4e c1 49 11 b6 9b .@FH.... &.N.I... 00000070: 42 00 a6 af 55 03 1c e3 f1 e6 2d 11 a0 1f bd 01 B...U... ..-..... 00000080: c7 c6 c7 40 4f c1 d8 3f 50 00 00 00 05 00 01 00 ...@O..? P....... 00000090: f0 62 c2 c1 c9 72 d1 01 04 00 00 00 80 3b 8f ba .b...r.. .....;.. 000000a0: 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b bb da 43 ff .B1...X. ^..{..C. 000000b0: 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 f0 75 b5 c3 g.....f. .....u.. 000000c0: d5 f3 e3 bb 69 de a6 64 35 70 63 a1 ff 79 a2 01 ....i..d 5pc..y.. 000000d0: 73 af 41 90 c6 3a 9a cb s.A..:..
libbde_volume_master_key_read: identifier : 868b317b-b019-4faa-b136-eac95fbc621e libbde_volume_master_key_read: modification time : Feb 29, 2016 08:18:24.519000000 UTC libbde_volume_master_key_read: unknown1 : 0 libbde_volume_master_key_read: protection type : 0x2000 (password protected)
libbde_metadata_entry_read: FVE metadata entry: 00000000: 6c 00 00 00 03 00 01 00 l.......
libbde_metadata_entry_read: entry size : 108 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0003 (Stretch key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 01 10 00 00 85 d6 2c 69 85 c9 3d ec b2 1d 50 ca ......,i ..=...P. 00000010: 29 08 76 60 50 00 00 00 05 00 01 00 f0 62 c2 c1 ).v`P... .....b.. 00000020: c9 72 d1 01 03 00 00 00 22 30 0c 5a c0 a1 aa 10 .r...... "0.Z.... 00000030: 09 b4 6c 77 83 08 90 ac 98 46 3a 46 a5 40 46 48 ..lw.... .F:F.@FH 00000040: 1d a2 91 b0 26 9c 4e c1 49 11 b6 9b 42 00 a6 af ....&.N. I...B... 00000050: 55 03 1c e3 f1 e6 2d 11 a0 1f bd 01 c7 c6 c7 40 U.....-. .......@ 00000060: 4f c1 d8 3f O..?
libbde_stretch_key_read: encryption method : 0x00001001 (UNKNOWN) libbde_stretch_key_read: salt: 00000000: 85 d6 2c 69 85 c9 3d ec b2 1d 50 ca 29 08 76 60 ..,i..=. ..P.).v`
libbde_stretch_key_read: encrypted data: 00000000: 50 00 00 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 P....... .b...r.. 00000010: 03 00 00 00 22 30 0c 5a c0 a1 aa 10 09 b4 6c 77 ...."0.Z ......lw 00000020: 83 08 90 ac 98 46 3a 46 a5 40 46 48 1d a2 91 b0 .....F:F .@FH.... 00000030: 26 9c 4e c1 49 11 b6 9b 42 00 a6 af 55 03 1c e3 &.N.I... B...U... 00000040: f1 e6 2d 11 a0 1f bd 01 c7 c6 c7 40 4f c1 d8 3f ..-..... ...@O..?
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 00 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 04 00 00 00 80 3b 8f ba .b...r.. .....;.. 00000010: 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b bb da 43 ff .B1...X. ^..{..C. 00000020: 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 f0 75 b5 c3 g.....f. .....u.. 00000030: d5 f3 e3 bb 69 de a6 64 35 70 63 a1 ff 79 a2 01 ....i..d 5pc..y.. 00000040: 73 af 41 90 c6 3a 9a cb s.A..:..
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 4 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 80 3b 8f ba 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b .;...B1. ..X.^..{ 00000010: bb da 43 ff 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 ..C.g... ..f..... 00000020: f0 75 b5 c3 d5 f3 e3 bb 69 de a6 64 35 70 63 a1 .u...... i..d5pc. 00000030: ff 79 a2 01 73 af 41 90 c6 3a 9a cb .y..s.A. .:..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 20 01 02 00 08 00 01 00 .......
libbde_metadata_entry_read: entry size : 288
libbde_metadata_entry_read: entry type : 0x0002 (Volume master key (VMK))
libbde_metadata_entry_read: value type : 0x0008 (Volume master key)
libbde_metadata_entry_read: version : 1
libbde_metadata_entry_read: FVE metadata entry data:
00000000: bc 76 22 ca e9 93 ea 49 94 02 fb 62 18 29 bc 9c .v"....I ...b.)..
00000010: 50 e7 c1 c4 c9 72 d1 01 00 00 00 08 ac 00 00 00 P....r.. ........
00000020: 03 00 01 00 00 10 00 00 4f 21 c6 74 53 55 33 72 ........ O!.tSU3r
00000030: 14 19 f1 f6 23 aa 07 02 40 00 12 00 05 00 01 00 ....#... @.......
00000040: f0 62 c2 c1 c9 72 d1 01 05 00 00 00 dd 3b b2 4b .b...r.. .....;.K
00000050: 8b a9 e0 04 d9 a1 81 89 df 63 12 e8 c5 ce 07 9e ........ .c......
00000060: 22 cf 9f 31 a3 a8 5c 35 6d 3f 21 e0 f5 cb f0 19 "..1..\5 m?!.....
00000070: 07 a1 e3 c7 5b 1f b8 c7 50 00 13 00 05 00 01 00 ....[... P.......
00000080: f0 62 c2 c1 c9 72 d1 01 06 00 00 00 60 76 7f 75 .b...r.. ....v.u 00000090: 41 63 49 16 17 7d 93 a4 04 0f 2e 34 1b 18 63 84 AcI..}.. ...4..c. 000000a0: b6 60 e4 ca 35 71 98 88 79 54 a4 47 81 7e 46 06 ...5q.. yT.G.~F.
000000b0: 66 fd e9 19 08 24 38 d5 d3 ab d8 80 e7 b5 8f 9f f....$8. ........
000000c0: 88 11 db 42 51 34 d9 c5 50 00 00 00 05 00 01 00 ...BQ4.. P.......
000000d0: f0 62 c2 c1 c9 72 d1 01 07 00 00 00 9b 61 62 88 .b...r.. .....ab.
000000e0: ca f8 be 97 22 ae 86 61 98 92 28 05 8c a7 e3 8c ...."..a ..(.....
000000f0: 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d a8 4a 7a 84 ....... .....Jz.
00000100: fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 01 55 f6 8c ...*..-. .....U..
00000110: 3d 52 ee 12 81 40 15 99 =R...@..
libbde_volume_master_key_read: identifier : ca2276bc-93e9-49ea-9402-fb621829bc9c libbde_volume_master_key_read: modification time : Feb 29, 2016 08:18:28.549000000 UTC libbde_volume_master_key_read: unknown1 : 0 libbde_volume_master_key_read: protection type : 0x0800 (recovery password protected)
libbde_metadata_entry_read: FVE metadata entry: 00000000: ac 00 00 00 03 00 01 00 ........
libbde_metadata_entry_read: entry size : 172
libbde_metadata_entry_read: entry type : 0x0000 (Property)
libbde_metadata_entry_read: value type : 0x0003 (Stretch key)
libbde_metadata_entry_read: version : 1
libbde_metadata_entry_read: FVE metadata entry data:
00000000: 00 10 00 00 4f 21 c6 74 53 55 33 72 14 19 f1 f6 ....O!.t SU3r....
00000010: 23 aa 07 02 40 00 12 00 05 00 01 00 f0 62 c2 c1 #...@... .....b..
00000020: c9 72 d1 01 05 00 00 00 dd 3b b2 4b 8b a9 e0 04 .r...... .;.K....
00000030: d9 a1 81 89 df 63 12 e8 c5 ce 07 9e 22 cf 9f 31 .....c.. ...."..1
00000040: a3 a8 5c 35 6d 3f 21 e0 f5 cb f0 19 07 a1 e3 c7 ..\5m?!. ........
00000050: 5b 1f b8 c7 50 00 13 00 05 00 01 00 f0 62 c2 c1 [...P... .....b..
00000060: c9 72 d1 01 06 00 00 00 60 76 7f 75 41 63 49 16 .r...... v.uAcI. 00000070: 17 7d 93 a4 04 0f 2e 34 1b 18 63 84 b6 60 e4 ca .}.....4 ..c....
00000080: 35 71 98 88 79 54 a4 47 81 7e 46 06 66 fd e9 19 5q..yT.G .~F.f...
00000090: 08 24 38 d5 d3 ab d8 80 e7 b5 8f 9f 88 11 db 42 .$8..... .......B
000000a0: 51 34 d9 c5 Q4..
libbde_stretch_key_read: encryption method : 0x00001000 (UNKNOWN) libbde_stretch_key_read: salt: 00000000: 4f 21 c6 74 53 55 33 72 14 19 f1 f6 23 aa 07 02 O!.tSU3r ....#...
libbde_stretch_key_read: encrypted data:
00000000: 40 00 12 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 @....... .b...r..
00000010: 05 00 00 00 dd 3b b2 4b 8b a9 e0 04 d9 a1 81 89 .....;.K ........
00000020: df 63 12 e8 c5 ce 07 9e 22 cf 9f 31 a3 a8 5c 35 .c...... "..1..\5
00000030: 6d 3f 21 e0 f5 cb f0 19 07 a1 e3 c7 5b 1f b8 c7 m?!..... ....[...
00000040: 50 00 13 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 P....... .b...r..
00000050: 06 00 00 00 60 76 7f 75 41 63 49 16 17 7d 93 a4 ....v.u AcI..}.. 00000060: 04 0f 2e 34 1b 18 63 84 b6 60 e4 ca 35 71 98 88 ...4..c. ...5q..
00000070: 79 54 a4 47 81 7e 46 06 66 fd e9 19 08 24 38 d5 yT.G.~F. f....$8.
00000080: d3 ab d8 80 e7 b5 8f 9f 88 11 db 42 51 34 d9 c5 ........ ...BQ4..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 00 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 07 00 00 00 9b 61 62 88 .b...r.. .....ab. 00000010: ca f8 be 97 22 ae 86 61 98 92 28 05 8c a7 e3 8c ...."..a ..(..... 00000020: 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d a8 4a 7a 84 ....... .....Jz. 00000030: fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 01 55 f6 8c ...*..-. .....U.. 00000040: 3d 52 ee 12 81 40 15 99 =R...@..
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 7 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 9b 61 62 88 ca f8 be 97 22 ae 86 61 98 92 28 05 .ab..... "..a..(. 00000010: 8c a7 e3 8c 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d .... ... ........ 00000020: a8 4a 7a 84 fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 .Jz....* ..-..... 00000030: 01 55 f6 8c 3d 52 ee 12 81 40 15 99 .U..=R.. .@..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 03 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0003 (Full volume encryption key (FVEK)) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 09 00 00 00 c4 aa e9 50 .b...r.. .......P 00000010: d4 14 7b 19 36 b8 2a f6 c1 79 cb 9b df 89 26 3e ..{.6.*. .y....&> 00000020: f4 8a 15 48 c6 2f 98 97 8a 50 9d fc 8e b5 76 5a ...H./.. .P....vZ 00000030: a3 7e f2 1e 31 fd ce 10 a4 c5 cb 93 00 ec c9 99 .~..1... ........ 00000040: 64 bf 88 b4 d5 fb 9b 24 d......$
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 9 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: c4 aa e9 50 d4 14 7b 19 36 b8 2a f6 c1 79 cb 9b ...P..{. 6.*..y.. 00000010: df 89 26 3e f4 8a 15 48 c6 2f 98 97 8a 50 9d fc ..&>...H ./...P.. 00000020: 8e b5 76 5a a3 7e f2 1e 31 fd ce 10 a4 c5 cb 93 ..vZ.~.. 1....... 00000030: 00 ec c9 99 64 bf 88 b4 d5 fb 9b 24 ....d... ...$
libbde_metadata_entry_read: FVE metadata entry: 00000000: 54 00 0f 00 0f 00 01 00 T.......
libbde_metadata_entry_read: entry size : 84 libbde_metadata_entry_read: entry type : 0x000f (Volume header block) libbde_metadata_entry_read: value type : 0x000f (Offset and size) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 00 90 a2 5a 00 00 00 00 00 20 00 00 00 00 00 00 ...Z.... . ...... 00000010: 04 00 3c 00 00 00 00 00 05 00 00 00 00 00 00 00 ..<..... ........ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ 00000030: 00 02 00 00 0a 00 00 00 00 00 00 00 5a 29 00 00 ........ ....Z).. 00000040: 02 00 00 00 00 00 00 00 10 01 01 02 ........ ....
libbde_metadata_read_entries: offset : 0x5aa29000 libbde_metadata_read_entries: size : 8192 libbde_metadata_read_entries: unknown1: 00000000: 04 00 3c 00 00 00 00 00 05 00 00 00 00 00 00 00 ..<..... ........ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ 00000020: 00 02 00 00 0a 00 00 00 00 00 00 00 5a 29 00 00 ........ ....Z).. 00000030: 02 00 00 00 00 00 00 00 10 01 01 02 ........ ....
Reading BitLocker secondary metadata block: libbde_metadata_read_block: reading metadata at offset: 1123360768 (0x42f52000) libbde_metadata_read_block: FVE metadata block header: 00000000: 2d 46 56 45 2d 46 53 2d 3a 00 02 00 04 00 04 00 -FVE-FS- :....... 00000010: 00 32 b7 2f 1d 00 00 00 00 00 00 00 10 00 00 00 .2./.... ........ 00000020: 00 c0 f5 02 00 00 00 00 00 20 f5 42 00 00 00 00 ........ . .B.... 00000030: 00 30 0c 83 00 00 00 00 00 90 a2 5a 00 00 00 00 .0...... ...Z....
libbde_metadata_read_block: signature : -FVE-FS- libbde_metadata_read_block: size : 58 libbde_metadata_read_block: version : 2 libbde_metadata_read_block: unknown1 : 4 libbde_metadata_read_block: unknown2 : 4 libbde_metadata_read_block: encrypted volume size : 125354586624 libbde_metadata_read_block: unknown3 : 0 libbde_metadata_read_block: number of volume header sectors : 16 libbde_metadata_read_block: first metadata offset : 0x02f5c000 libbde_metadata_read_block: second metadata offset : 0x42f52000 libbde_metadata_read_block: third metadata offset : 0x830c3000 libbde_metadata_read_block: volume header offset : 0x5aa29000
libbde_metadata_read_header: FVE metadata header: 00000000: 56 03 00 00 01 00 00 00 30 00 00 00 56 03 00 00 V....... 0...V... 00000010: 98 3e 10 12 84 03 1c 48 b9 a4 07 eb 7c 2f 7b 57 .>.....H ....|/{W 00000020: 0b 00 00 00 04 80 04 80 8d 67 ef b5 c9 72 d1 01 ........ .g...r..
libbde_metadata_read_header: metadata size : 854 libbde_metadata_read_header: version : 1 libbde_metadata_read_header: metadata header size : 48 libbde_metadata_read_header: metadata size copy : 854 libbde_metadata_read_header: volume identifier : 12103e98-0384-481c-b9a4-07eb7c2f7b57 libbde_metadata_read_header: next nonce counter : 0x0000000b libbde_metadata_read_header: encryption method : 0x00008004 (AES-XTS 128-bit encryption) libbde_metadata_read_header: encryption method copy : 0x00008004 (AES-XTS 128-bit encryption) libbde_metadata_read_header: creation time : Feb 29, 2016 08:18:03.681370900 UTC
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 0b 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x000b (UNKNOWN) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 02 00 00 00 8f 7d 33 c8 .b...r.. .....}3. 00000010: 9a 8b 9d 8a 7f b7 87 1e 9b fb 03 8c 22 8f 33 3d ........ ....".3= 00000020: 65 e0 a5 a9 06 f3 54 75 14 45 ce 37 28 30 4d 47 e.....Tu .E.7(0MG 00000030: 99 df 02 4c 33 b9 fe 6f 73 ef fb 6c d5 26 8b f0 ...L3..o s..l.&.. 00000040: 83 dd ea 67 e7 15 d5 91 ...g....
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 2 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 8f 7d 33 c8 9a 8b 9d 8a 7f b7 87 1e 9b fb 03 8c .}3..... ........ 00000010: 22 8f 33 3d 65 e0 a5 a9 06 f3 54 75 14 45 ce 37 ".3=e... ..Tu.E.7 00000020: 28 30 4d 47 99 df 02 4c 33 b9 fe 6f 73 ef fb 6c (0MG...L 3..os..l 00000030: d5 26 8b f0 83 dd ea 67 e7 15 d5 91 .&.....g ....
libbde_metadata_entry_read: FVE metadata entry: 00000000: 32 00 07 00 02 00 01 00 2.......
libbde_metadata_entry_read: entry size : 50 libbde_metadata_entry_read: entry type : 0x0007 (Description) libbde_metadata_entry_read: value type : 0x0002 (Unicode string (UTF-16 little-endian)) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 4c 00 41 00 50 00 54 00 4f 00 50 00 20 00 43 00 L.A.P.T. O.P. .C. 00000010: 3a 00 20 00 32 00 39 00 2e 00 30 00 32 00 2e 00 :. .2.9. ..0.2... 00000020: 32 00 30 00 31 00 36 00 00 00 2.0.1.6. ..
libbde_metadata_entry_read_string: string : LAPTOP C: 29.02.2016
libbde_metadata_entry_read: FVE metadata entry: 00000000: e0 00 02 00 08 00 01 00 ........
libbde_metadata_entry_read: entry size : 224 libbde_metadata_entry_read: entry type : 0x0002 (Volume master key (VMK)) libbde_metadata_entry_read: value type : 0x0008 (Volume master key) libbde_metadata_entry_read: version : 1 libbde_metadata_entryread: FVE metadata entry data: 00000000: 7b 31 8b 86 19 b0 aa 4f b1 36 ea c9 5f bc 62 1e {1.....O .6...b. 00000010: 70 f9 5a c2 c9 72 d1 01 00 00 00 20 6c 00 00 00 p.Z..r.. ... l... 00000020: 03 00 01 00 01 10 00 00 85 d6 2c 69 85 c9 3d ec ........ ..,i..=. 00000030: b2 1d 50 ca 29 08 76 60 50 00 00 00 05 00 01 00 ..P.).v` P....... 00000040: f0 62 c2 c1 c9 72 d1 01 03 00 00 00 22 30 0c 5a .b...r.. ...."0.Z 00000050: c0 a1 aa 10 09 b4 6c 77 83 08 90 ac 98 46 3a 46 ......lw .....F:F 00000060: a5 40 46 48 1d a2 91 b0 26 9c 4e c1 49 11 b6 9b .@FH.... &.N.I... 00000070: 42 00 a6 af 55 03 1c e3 f1 e6 2d 11 a0 1f bd 01 B...U... ..-..... 00000080: c7 c6 c7 40 4f c1 d8 3f 50 00 00 00 05 00 01 00 ...@O..? P....... 00000090: f0 62 c2 c1 c9 72 d1 01 04 00 00 00 80 3b 8f ba .b...r.. .....;.. 000000a0: 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b bb da 43 ff .B1...X. ^..{..C. 000000b0: 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 f0 75 b5 c3 g.....f. .....u.. 000000c0: d5 f3 e3 bb 69 de a6 64 35 70 63 a1 ff 79 a2 01 ....i..d 5pc..y.. 000000d0: 73 af 41 90 c6 3a 9a cb s.A..:..
libbde_volume_master_key_read: identifier : 868b317b-b019-4faa-b136-eac95fbc621e libbde_volume_master_key_read: modification time : Feb 29, 2016 08:18:24.519000000 UTC libbde_volume_master_key_read: unknown1 : 0 libbde_volume_master_key_read: protection type : 0x2000 (password protected)
libbde_metadata_entry_read: FVE metadata entry: 00000000: 6c 00 00 00 03 00 01 00 l.......
libbde_metadata_entry_read: entry size : 108 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0003 (Stretch key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 01 10 00 00 85 d6 2c 69 85 c9 3d ec b2 1d 50 ca ......,i ..=...P. 00000010: 29 08 76 60 50 00 00 00 05 00 01 00 f0 62 c2 c1 ).v`P... .....b.. 00000020: c9 72 d1 01 03 00 00 00 22 30 0c 5a c0 a1 aa 10 .r...... "0.Z.... 00000030: 09 b4 6c 77 83 08 90 ac 98 46 3a 46 a5 40 46 48 ..lw.... .F:F.@FH 00000040: 1d a2 91 b0 26 9c 4e c1 49 11 b6 9b 42 00 a6 af ....&.N. I...B... 00000050: 55 03 1c e3 f1 e6 2d 11 a0 1f bd 01 c7 c6 c7 40 U.....-. .......@ 00000060: 4f c1 d8 3f O..?
libbde_stretch_key_read: encryption method : 0x00001001 (UNKNOWN) libbde_stretch_key_read: salt: 00000000: 85 d6 2c 69 85 c9 3d ec b2 1d 50 ca 29 08 76 60 ..,i..=. ..P.).v`
libbde_stretch_key_read: encrypted data: 00000000: 50 00 00 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 P....... .b...r.. 00000010: 03 00 00 00 22 30 0c 5a c0 a1 aa 10 09 b4 6c 77 ...."0.Z ......lw 00000020: 83 08 90 ac 98 46 3a 46 a5 40 46 48 1d a2 91 b0 .....F:F .@FH.... 00000030: 26 9c 4e c1 49 11 b6 9b 42 00 a6 af 55 03 1c e3 &.N.I... B...U... 00000040: f1 e6 2d 11 a0 1f bd 01 c7 c6 c7 40 4f c1 d8 3f ..-..... ...@O..?
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 00 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 04 00 00 00 80 3b 8f ba .b...r.. .....;.. 00000010: 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b bb da 43 ff .B1...X. ^..{..C. 00000020: 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 f0 75 b5 c3 g.....f. .....u.. 00000030: d5 f3 e3 bb 69 de a6 64 35 70 63 a1 ff 79 a2 01 ....i..d 5pc..y.. 00000040: 73 af 41 90 c6 3a 9a cb s.A..:..
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 4 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 80 3b 8f ba 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b .;...B1. ..X.^..{ 00000010: bb da 43 ff 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 ..C.g... ..f..... 00000020: f0 75 b5 c3 d5 f3 e3 bb 69 de a6 64 35 70 63 a1 .u...... i..d5pc. 00000030: ff 79 a2 01 73 af 41 90 c6 3a 9a cb .y..s.A. .:..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 20 01 02 00 08 00 01 00 .......
libbde_metadata_entry_read: entry size : 288
libbde_metadata_entry_read: entry type : 0x0002 (Volume master key (VMK))
libbde_metadata_entry_read: value type : 0x0008 (Volume master key)
libbde_metadata_entry_read: version : 1
libbde_metadata_entry_read: FVE metadata entry data:
00000000: bc 76 22 ca e9 93 ea 49 94 02 fb 62 18 29 bc 9c .v"....I ...b.)..
00000010: 50 e7 c1 c4 c9 72 d1 01 00 00 00 08 ac 00 00 00 P....r.. ........
00000020: 03 00 01 00 00 10 00 00 4f 21 c6 74 53 55 33 72 ........ O!.tSU3r
00000030: 14 19 f1 f6 23 aa 07 02 40 00 12 00 05 00 01 00 ....#... @.......
00000040: f0 62 c2 c1 c9 72 d1 01 05 00 00 00 dd 3b b2 4b .b...r.. .....;.K
00000050: 8b a9 e0 04 d9 a1 81 89 df 63 12 e8 c5 ce 07 9e ........ .c......
00000060: 22 cf 9f 31 a3 a8 5c 35 6d 3f 21 e0 f5 cb f0 19 "..1..\5 m?!.....
00000070: 07 a1 e3 c7 5b 1f b8 c7 50 00 13 00 05 00 01 00 ....[... P.......
00000080: f0 62 c2 c1 c9 72 d1 01 06 00 00 00 60 76 7f 75 .b...r.. ....v.u 00000090: 41 63 49 16 17 7d 93 a4 04 0f 2e 34 1b 18 63 84 AcI..}.. ...4..c. 000000a0: b6 60 e4 ca 35 71 98 88 79 54 a4 47 81 7e 46 06 ...5q.. yT.G.~F.
000000b0: 66 fd e9 19 08 24 38 d5 d3 ab d8 80 e7 b5 8f 9f f....$8. ........
000000c0: 88 11 db 42 51 34 d9 c5 50 00 00 00 05 00 01 00 ...BQ4.. P.......
000000d0: f0 62 c2 c1 c9 72 d1 01 07 00 00 00 9b 61 62 88 .b...r.. .....ab.
000000e0: ca f8 be 97 22 ae 86 61 98 92 28 05 8c a7 e3 8c ...."..a ..(.....
000000f0: 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d a8 4a 7a 84 ....... .....Jz.
00000100: fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 01 55 f6 8c ...*..-. .....U..
00000110: 3d 52 ee 12 81 40 15 99 =R...@..
libbde_volume_master_key_read: identifier : ca2276bc-93e9-49ea-9402-fb621829bc9c libbde_volume_master_key_read: modification time : Feb 29, 2016 08:18:28.549000000 UTC libbde_volume_master_key_read: unknown1 : 0 libbde_volume_master_key_read: protection type : 0x0800 (recovery password protected)
libbde_metadata_entry_read: FVE metadata entry: 00000000: ac 00 00 00 03 00 01 00 ........
libbde_metadata_entry_read: entry size : 172
libbde_metadata_entry_read: entry type : 0x0000 (Property)
libbde_metadata_entry_read: value type : 0x0003 (Stretch key)
libbde_metadata_entry_read: version : 1
libbde_metadata_entry_read: FVE metadata entry data:
00000000: 00 10 00 00 4f 21 c6 74 53 55 33 72 14 19 f1 f6 ....O!.t SU3r....
00000010: 23 aa 07 02 40 00 12 00 05 00 01 00 f0 62 c2 c1 #...@... .....b..
00000020: c9 72 d1 01 05 00 00 00 dd 3b b2 4b 8b a9 e0 04 .r...... .;.K....
00000030: d9 a1 81 89 df 63 12 e8 c5 ce 07 9e 22 cf 9f 31 .....c.. ...."..1
00000040: a3 a8 5c 35 6d 3f 21 e0 f5 cb f0 19 07 a1 e3 c7 ..\5m?!. ........
00000050: 5b 1f b8 c7 50 00 13 00 05 00 01 00 f0 62 c2 c1 [...P... .....b..
00000060: c9 72 d1 01 06 00 00 00 60 76 7f 75 41 63 49 16 .r...... v.uAcI. 00000070: 17 7d 93 a4 04 0f 2e 34 1b 18 63 84 b6 60 e4 ca .}.....4 ..c....
00000080: 35 71 98 88 79 54 a4 47 81 7e 46 06 66 fd e9 19 5q..yT.G .~F.f...
00000090: 08 24 38 d5 d3 ab d8 80 e7 b5 8f 9f 88 11 db 42 .$8..... .......B
000000a0: 51 34 d9 c5 Q4..
libbde_stretch_key_read: encryption method : 0x00001000 (UNKNOWN) libbde_stretch_key_read: salt: 00000000: 4f 21 c6 74 53 55 33 72 14 19 f1 f6 23 aa 07 02 O!.tSU3r ....#...
libbde_stretch_key_read: encrypted data:
00000000: 40 00 12 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 @....... .b...r..
00000010: 05 00 00 00 dd 3b b2 4b 8b a9 e0 04 d9 a1 81 89 .....;.K ........
00000020: df 63 12 e8 c5 ce 07 9e 22 cf 9f 31 a3 a8 5c 35 .c...... "..1..\5
00000030: 6d 3f 21 e0 f5 cb f0 19 07 a1 e3 c7 5b 1f b8 c7 m?!..... ....[...
00000040: 50 00 13 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 P....... .b...r..
00000050: 06 00 00 00 60 76 7f 75 41 63 49 16 17 7d 93 a4 ....v.u AcI..}.. 00000060: 04 0f 2e 34 1b 18 63 84 b6 60 e4 ca 35 71 98 88 ...4..c. ...5q..
00000070: 79 54 a4 47 81 7e 46 06 66 fd e9 19 08 24 38 d5 yT.G.~F. f....$8.
00000080: d3 ab d8 80 e7 b5 8f 9f 88 11 db 42 51 34 d9 c5 ........ ...BQ4..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 00 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 07 00 00 00 9b 61 62 88 .b...r.. .....ab. 00000010: ca f8 be 97 22 ae 86 61 98 92 28 05 8c a7 e3 8c ...."..a ..(..... 00000020: 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d a8 4a 7a 84 ....... .....Jz. 00000030: fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 01 55 f6 8c ...*..-. .....U.. 00000040: 3d 52 ee 12 81 40 15 99 =R...@..
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 7 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 9b 61 62 88 ca f8 be 97 22 ae 86 61 98 92 28 05 .ab..... "..a..(. 00000010: 8c a7 e3 8c 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d .... ... ........ 00000020: a8 4a 7a 84 fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 .Jz....* ..-..... 00000030: 01 55 f6 8c 3d 52 ee 12 81 40 15 99 .U..=R.. .@..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 03 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0003 (Full volume encryption key (FVEK)) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 09 00 00 00 c4 aa e9 50 .b...r.. .......P 00000010: d4 14 7b 19 36 b8 2a f6 c1 79 cb 9b df 89 26 3e ..{.6.*. .y....&> 00000020: f4 8a 15 48 c6 2f 98 97 8a 50 9d fc 8e b5 76 5a ...H./.. .P....vZ 00000030: a3 7e f2 1e 31 fd ce 10 a4 c5 cb 93 00 ec c9 99 .~..1... ........ 00000040: 64 bf 88 b4 d5 fb 9b 24 d......$
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 9 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: c4 aa e9 50 d4 14 7b 19 36 b8 2a f6 c1 79 cb 9b ...P..{. 6.*..y.. 00000010: df 89 26 3e f4 8a 15 48 c6 2f 98 97 8a 50 9d fc ..&>...H ./...P.. 00000020: 8e b5 76 5a a3 7e f2 1e 31 fd ce 10 a4 c5 cb 93 ..vZ.~.. 1....... 00000030: 00 ec c9 99 64 bf 88 b4 d5 fb 9b 24 ....d... ...$
libbde_metadata_entry_read: FVE metadata entry: 00000000: 54 00 0f 00 0f 00 01 00 T.......
libbde_metadata_entry_read: entry size : 84 libbde_metadata_entry_read: entry type : 0x000f (Volume header block) libbde_metadata_entry_read: value type : 0x000f (Offset and size) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 00 90 a2 5a 00 00 00 00 00 20 00 00 00 00 00 00 ...Z.... . ...... 00000010: 04 00 3c 00 00 00 00 00 05 00 00 00 00 00 00 00 ..<..... ........ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ 00000030: 00 02 00 00 0a 00 00 00 00 00 00 00 5a 29 00 00 ........ ....Z).. 00000040: 02 00 00 00 00 00 00 00 10 01 01 02 ........ ....
libbde_metadata_read_entries: offset : 0x5aa29000 libbde_metadata_read_entries: size : 8192 libbde_metadata_read_entries: unknown1: 00000000: 04 00 3c 00 00 00 00 00 05 00 00 00 00 00 00 00 ..<..... ........ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ 00000020: 00 02 00 00 0a 00 00 00 00 00 00 00 5a 29 00 00 ........ ....Z).. 00000030: 02 00 00 00 00 00 00 00 10 01 01 02 ........ ....
Reading BitLocker tertiary metadata block: libbde_metadata_read_block: reading metadata at offset: 2198614016 (0x830c3000) libbde_metadata_read_block: FVE metadata block header: 00000000: 2d 46 56 45 2d 46 53 2d 3a 00 02 00 04 00 04 00 -FVE-FS- :....... 00000010: 00 32 b7 2f 1d 00 00 00 00 00 00 00 10 00 00 00 .2./.... ........ 00000020: 00 c0 f5 02 00 00 00 00 00 20 f5 42 00 00 00 00 ........ . .B.... 00000030: 00 30 0c 83 00 00 00 00 00 90 a2 5a 00 00 00 00 .0...... ...Z....
libbde_metadata_read_block: signature : -FVE-FS- libbde_metadata_read_block: size : 58 libbde_metadata_read_block: version : 2 libbde_metadata_read_block: unknown1 : 4 libbde_metadata_read_block: unknown2 : 4 libbde_metadata_read_block: encrypted volume size : 125354586624 libbde_metadata_read_block: unknown3 : 0 libbde_metadata_read_block: number of volume header sectors : 16 libbde_metadata_read_block: first metadata offset : 0x02f5c000 libbde_metadata_read_block: second metadata offset : 0x42f52000 libbde_metadata_read_block: third metadata offset : 0x830c3000 libbde_metadata_read_block: volume header offset : 0x5aa29000
libbde_metadata_read_header: FVE metadata header: 00000000: 56 03 00 00 01 00 00 00 30 00 00 00 56 03 00 00 V....... 0...V... 00000010: 98 3e 10 12 84 03 1c 48 b9 a4 07 eb 7c 2f 7b 57 .>.....H ....|/{W 00000020: 0b 00 00 00 04 80 04 80 8d 67 ef b5 c9 72 d1 01 ........ .g...r..
libbde_metadata_read_header: metadata size : 854 libbde_metadata_read_header: version : 1 libbde_metadata_read_header: metadata header size : 48 libbde_metadata_read_header: metadata size copy : 854 libbde_metadata_read_header: volume identifier : 12103e98-0384-481c-b9a4-07eb7c2f7b57 libbde_metadata_read_header: next nonce counter : 0x0000000b libbde_metadata_read_header: encryption method : 0x00008004 (AES-XTS 128-bit encryption) libbde_metadata_read_header: encryption method copy : 0x00008004 (AES-XTS 128-bit encryption) libbde_metadata_read_header: creation time : Feb 29, 2016 08:18:03.681370900 UTC
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 0b 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x000b (UNKNOWN) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 02 00 00 00 8f 7d 33 c8 .b...r.. .....}3. 00000010: 9a 8b 9d 8a 7f b7 87 1e 9b fb 03 8c 22 8f 33 3d ........ ....".3= 00000020: 65 e0 a5 a9 06 f3 54 75 14 45 ce 37 28 30 4d 47 e.....Tu .E.7(0MG 00000030: 99 df 02 4c 33 b9 fe 6f 73 ef fb 6c d5 26 8b f0 ...L3..o s..l.&.. 00000040: 83 dd ea 67 e7 15 d5 91 ...g....
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 2 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 8f 7d 33 c8 9a 8b 9d 8a 7f b7 87 1e 9b fb 03 8c .}3..... ........ 00000010: 22 8f 33 3d 65 e0 a5 a9 06 f3 54 75 14 45 ce 37 ".3=e... ..Tu.E.7 00000020: 28 30 4d 47 99 df 02 4c 33 b9 fe 6f 73 ef fb 6c (0MG...L 3..os..l 00000030: d5 26 8b f0 83 dd ea 67 e7 15 d5 91 .&.....g ....
libbde_metadata_entry_read: FVE metadata entry: 00000000: 32 00 07 00 02 00 01 00 2.......
libbde_metadata_entry_read: entry size : 50 libbde_metadata_entry_read: entry type : 0x0007 (Description) libbde_metadata_entry_read: value type : 0x0002 (Unicode string (UTF-16 little-endian)) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 4c 00 41 00 50 00 54 00 4f 00 50 00 20 00 43 00 L.A.P.T. O.P. .C. 00000010: 3a 00 20 00 32 00 39 00 2e 00 30 00 32 00 2e 00 :. .2.9. ..0.2... 00000020: 32 00 30 00 31 00 36 00 00 00 2.0.1.6. ..
libbde_metadata_entry_read_string: string : LAPTOP C: 29.02.2016
libbde_metadata_entry_read: FVE metadata entry: 00000000: e0 00 02 00 08 00 01 00 ........
libbde_metadata_entry_read: entry size : 224 libbde_metadata_entry_read: entry type : 0x0002 (Volume master key (VMK)) libbde_metadata_entry_read: value type : 0x0008 (Volume master key) libbde_metadata_entry_read: version : 1 libbde_metadata_entryread: FVE metadata entry data: 00000000: 7b 31 8b 86 19 b0 aa 4f b1 36 ea c9 5f bc 62 1e {1.....O .6...b. 00000010: 70 f9 5a c2 c9 72 d1 01 00 00 00 20 6c 00 00 00 p.Z..r.. ... l... 00000020: 03 00 01 00 01 10 00 00 85 d6 2c 69 85 c9 3d ec ........ ..,i..=. 00000030: b2 1d 50 ca 29 08 76 60 50 00 00 00 05 00 01 00 ..P.).v` P....... 00000040: f0 62 c2 c1 c9 72 d1 01 03 00 00 00 22 30 0c 5a .b...r.. ...."0.Z 00000050: c0 a1 aa 10 09 b4 6c 77 83 08 90 ac 98 46 3a 46 ......lw .....F:F 00000060: a5 40 46 48 1d a2 91 b0 26 9c 4e c1 49 11 b6 9b .@FH.... &.N.I... 00000070: 42 00 a6 af 55 03 1c e3 f1 e6 2d 11 a0 1f bd 01 B...U... ..-..... 00000080: c7 c6 c7 40 4f c1 d8 3f 50 00 00 00 05 00 01 00 ...@O..? P....... 00000090: f0 62 c2 c1 c9 72 d1 01 04 00 00 00 80 3b 8f ba .b...r.. .....;.. 000000a0: 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b bb da 43 ff .B1...X. ^..{..C. 000000b0: 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 f0 75 b5 c3 g.....f. .....u.. 000000c0: d5 f3 e3 bb 69 de a6 64 35 70 63 a1 ff 79 a2 01 ....i..d 5pc..y.. 000000d0: 73 af 41 90 c6 3a 9a cb s.A..:..
libbde_volume_master_key_read: identifier : 868b317b-b019-4faa-b136-eac95fbc621e libbde_volume_master_key_read: modification time : Feb 29, 2016 08:18:24.519000000 UTC libbde_volume_master_key_read: unknown1 : 0 libbde_volume_master_key_read: protection type : 0x2000 (password protected)
libbde_metadata_entry_read: FVE metadata entry: 00000000: 6c 00 00 00 03 00 01 00 l.......
libbde_metadata_entry_read: entry size : 108 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0003 (Stretch key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 01 10 00 00 85 d6 2c 69 85 c9 3d ec b2 1d 50 ca ......,i ..=...P. 00000010: 29 08 76 60 50 00 00 00 05 00 01 00 f0 62 c2 c1 ).v`P... .....b.. 00000020: c9 72 d1 01 03 00 00 00 22 30 0c 5a c0 a1 aa 10 .r...... "0.Z.... 00000030: 09 b4 6c 77 83 08 90 ac 98 46 3a 46 a5 40 46 48 ..lw.... .F:F.@FH 00000040: 1d a2 91 b0 26 9c 4e c1 49 11 b6 9b 42 00 a6 af ....&.N. I...B... 00000050: 55 03 1c e3 f1 e6 2d 11 a0 1f bd 01 c7 c6 c7 40 U.....-. .......@ 00000060: 4f c1 d8 3f O..?
libbde_stretch_key_read: encryption method : 0x00001001 (UNKNOWN) libbde_stretch_key_read: salt: 00000000: 85 d6 2c 69 85 c9 3d ec b2 1d 50 ca 29 08 76 60 ..,i..=. ..P.).v`
libbde_stretch_key_read: encrypted data: 00000000: 50 00 00 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 P....... .b...r.. 00000010: 03 00 00 00 22 30 0c 5a c0 a1 aa 10 09 b4 6c 77 ...."0.Z ......lw 00000020: 83 08 90 ac 98 46 3a 46 a5 40 46 48 1d a2 91 b0 .....F:F .@FH.... 00000030: 26 9c 4e c1 49 11 b6 9b 42 00 a6 af 55 03 1c e3 &.N.I... B...U... 00000040: f1 e6 2d 11 a0 1f bd 01 c7 c6 c7 40 4f c1 d8 3f ..-..... ...@O..?
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 00 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 04 00 00 00 80 3b 8f ba .b...r.. .....;.. 00000010: 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b bb da 43 ff .B1...X. ^..{..C. 00000020: 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 f0 75 b5 c3 g.....f. .....u.. 00000030: d5 f3 e3 bb 69 de a6 64 35 70 63 a1 ff 79 a2 01 ....i..d 5pc..y.. 00000040: 73 af 41 90 c6 3a 9a cb s.A..:..
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 4 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 80 3b 8f ba 03 42 31 94 ec 8b 58 ce 5e c8 c2 7b .;...B1. ..X.^..{ 00000010: bb da 43 ff 67 f6 96 88 d4 c2 66 f1 ee a9 0a 00 ..C.g... ..f..... 00000020: f0 75 b5 c3 d5 f3 e3 bb 69 de a6 64 35 70 63 a1 .u...... i..d5pc. 00000030: ff 79 a2 01 73 af 41 90 c6 3a 9a cb .y..s.A. .:..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 20 01 02 00 08 00 01 00 .......
libbde_metadata_entry_read: entry size : 288
libbde_metadata_entry_read: entry type : 0x0002 (Volume master key (VMK))
libbde_metadata_entry_read: value type : 0x0008 (Volume master key)
libbde_metadata_entry_read: version : 1
libbde_metadata_entry_read: FVE metadata entry data:
00000000: bc 76 22 ca e9 93 ea 49 94 02 fb 62 18 29 bc 9c .v"....I ...b.)..
00000010: 50 e7 c1 c4 c9 72 d1 01 00 00 00 08 ac 00 00 00 P....r.. ........
00000020: 03 00 01 00 00 10 00 00 4f 21 c6 74 53 55 33 72 ........ O!.tSU3r
00000030: 14 19 f1 f6 23 aa 07 02 40 00 12 00 05 00 01 00 ....#... @.......
00000040: f0 62 c2 c1 c9 72 d1 01 05 00 00 00 dd 3b b2 4b .b...r.. .....;.K
00000050: 8b a9 e0 04 d9 a1 81 89 df 63 12 e8 c5 ce 07 9e ........ .c......
00000060: 22 cf 9f 31 a3 a8 5c 35 6d 3f 21 e0 f5 cb f0 19 "..1..\5 m?!.....
00000070: 07 a1 e3 c7 5b 1f b8 c7 50 00 13 00 05 00 01 00 ....[... P.......
00000080: f0 62 c2 c1 c9 72 d1 01 06 00 00 00 60 76 7f 75 .b...r.. ....v.u 00000090: 41 63 49 16 17 7d 93 a4 04 0f 2e 34 1b 18 63 84 AcI..}.. ...4..c. 000000a0: b6 60 e4 ca 35 71 98 88 79 54 a4 47 81 7e 46 06 ...5q.. yT.G.~F.
000000b0: 66 fd e9 19 08 24 38 d5 d3 ab d8 80 e7 b5 8f 9f f....$8. ........
000000c0: 88 11 db 42 51 34 d9 c5 50 00 00 00 05 00 01 00 ...BQ4.. P.......
000000d0: f0 62 c2 c1 c9 72 d1 01 07 00 00 00 9b 61 62 88 .b...r.. .....ab.
000000e0: ca f8 be 97 22 ae 86 61 98 92 28 05 8c a7 e3 8c ...."..a ..(.....
000000f0: 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d a8 4a 7a 84 ....... .....Jz.
00000100: fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 01 55 f6 8c ...*..-. .....U..
00000110: 3d 52 ee 12 81 40 15 99 =R...@..
libbde_volume_master_key_read: identifier : ca2276bc-93e9-49ea-9402-fb621829bc9c libbde_volume_master_key_read: modification time : Feb 29, 2016 08:18:28.549000000 UTC libbde_volume_master_key_read: unknown1 : 0 libbde_volume_master_key_read: protection type : 0x0800 (recovery password protected)
libbde_metadata_entry_read: FVE metadata entry: 00000000: ac 00 00 00 03 00 01 00 ........
libbde_metadata_entry_read: entry size : 172
libbde_metadata_entry_read: entry type : 0x0000 (Property)
libbde_metadata_entry_read: value type : 0x0003 (Stretch key)
libbde_metadata_entry_read: version : 1
libbde_metadata_entry_read: FVE metadata entry data:
00000000: 00 10 00 00 4f 21 c6 74 53 55 33 72 14 19 f1 f6 ....O!.t SU3r....
00000010: 23 aa 07 02 40 00 12 00 05 00 01 00 f0 62 c2 c1 #...@... .....b..
00000020: c9 72 d1 01 05 00 00 00 dd 3b b2 4b 8b a9 e0 04 .r...... .;.K....
00000030: d9 a1 81 89 df 63 12 e8 c5 ce 07 9e 22 cf 9f 31 .....c.. ...."..1
00000040: a3 a8 5c 35 6d 3f 21 e0 f5 cb f0 19 07 a1 e3 c7 ..\5m?!. ........
00000050: 5b 1f b8 c7 50 00 13 00 05 00 01 00 f0 62 c2 c1 [...P... .....b..
00000060: c9 72 d1 01 06 00 00 00 60 76 7f 75 41 63 49 16 .r...... v.uAcI. 00000070: 17 7d 93 a4 04 0f 2e 34 1b 18 63 84 b6 60 e4 ca .}.....4 ..c....
00000080: 35 71 98 88 79 54 a4 47 81 7e 46 06 66 fd e9 19 5q..yT.G .~F.f...
00000090: 08 24 38 d5 d3 ab d8 80 e7 b5 8f 9f 88 11 db 42 .$8..... .......B
000000a0: 51 34 d9 c5 Q4..
libbde_stretch_key_read: encryption method : 0x00001000 (UNKNOWN) libbde_stretch_key_read: salt: 00000000: 4f 21 c6 74 53 55 33 72 14 19 f1 f6 23 aa 07 02 O!.tSU3r ....#...
libbde_stretch_key_read: encrypted data:
00000000: 40 00 12 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 @....... .b...r..
00000010: 05 00 00 00 dd 3b b2 4b 8b a9 e0 04 d9 a1 81 89 .....;.K ........
00000020: df 63 12 e8 c5 ce 07 9e 22 cf 9f 31 a3 a8 5c 35 .c...... "..1..\5
00000030: 6d 3f 21 e0 f5 cb f0 19 07 a1 e3 c7 5b 1f b8 c7 m?!..... ....[...
00000040: 50 00 13 00 05 00 01 00 f0 62 c2 c1 c9 72 d1 01 P....... .b...r..
00000050: 06 00 00 00 60 76 7f 75 41 63 49 16 17 7d 93 a4 ....v.u AcI..}.. 00000060: 04 0f 2e 34 1b 18 63 84 b6 60 e4 ca 35 71 98 88 ...4..c. ...5q..
00000070: 79 54 a4 47 81 7e 46 06 66 fd e9 19 08 24 38 d5 yT.G.~F. f....$8.
00000080: d3 ab d8 80 e7 b5 8f 9f 88 11 db 42 51 34 d9 c5 ........ ...BQ4..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 00 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0000 (Property) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 07 00 00 00 9b 61 62 88 .b...r.. .....ab. 00000010: ca f8 be 97 22 ae 86 61 98 92 28 05 8c a7 e3 8c ...."..a ..(..... 00000020: 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d a8 4a 7a 84 ....... .....Jz. 00000030: fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 01 55 f6 8c ...*..-. .....U.. 00000040: 3d 52 ee 12 81 40 15 99 =R...@..
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 7 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: 9b 61 62 88 ca f8 be 97 22 ae 86 61 98 92 28 05 .ab..... "..a..(. 00000010: 8c a7 e3 8c 20 7f eb 19 9d 80 d6 c6 1e cb 1a 9d .... ... ........ 00000020: a8 4a 7a 84 fa 2e 12 2a e2 d3 2d 91 b3 aa b9 a7 .Jz....* ..-..... 00000030: 01 55 f6 8c 3d 52 ee 12 81 40 15 99 .U..=R.. .@..
libbde_metadata_entry_read: FVE metadata entry: 00000000: 50 00 03 00 05 00 01 00 P.......
libbde_metadata_entry_read: entry size : 80 libbde_metadata_entry_read: entry type : 0x0003 (Full volume encryption key (FVEK)) libbde_metadata_entry_read: value type : 0x0005 (AES-CCM encrypted key) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: f0 62 c2 c1 c9 72 d1 01 09 00 00 00 c4 aa e9 50 .b...r.. .......P 00000010: d4 14 7b 19 36 b8 2a f6 c1 79 cb 9b df 89 26 3e ..{.6.*. .y....&> 00000020: f4 8a 15 48 c6 2f 98 97 8a 50 9d fc 8e b5 76 5a ...H./.. .P....vZ 00000030: a3 7e f2 1e 31 fd ce 10 a4 c5 cb 93 00 ec c9 99 .~..1... ........ 00000040: 64 bf 88 b4 d5 fb 9b 24 d......$
libbde_aes_ccm_encrypted_key_read: nonce time : Feb 29, 2016 08:18:23.519000000 UTC libbde_aes_ccm_encrypted_key_read: nonce counter : 9 libbde_aes_ccm_encrypted_key_read: encrypted data: 00000000: c4 aa e9 50 d4 14 7b 19 36 b8 2a f6 c1 79 cb 9b ...P..{. 6.*..y.. 00000010: df 89 26 3e f4 8a 15 48 c6 2f 98 97 8a 50 9d fc ..&>...H ./...P.. 00000020: 8e b5 76 5a a3 7e f2 1e 31 fd ce 10 a4 c5 cb 93 ..vZ.~.. 1....... 00000030: 00 ec c9 99 64 bf 88 b4 d5 fb 9b 24 ....d... ...$
libbde_metadata_entry_read: FVE metadata entry: 00000000: 54 00 0f 00 0f 00 01 00 T.......
libbde_metadata_entry_read: entry size : 84 libbde_metadata_entry_read: entry type : 0x000f (Volume header block) libbde_metadata_entry_read: value type : 0x000f (Offset and size) libbde_metadata_entry_read: version : 1 libbde_metadata_entry_read: FVE metadata entry data: 00000000: 00 90 a2 5a 00 00 00 00 00 20 00 00 00 00 00 00 ...Z.... . ...... 00000010: 04 00 3c 00 00 00 00 00 05 00 00 00 00 00 00 00 ..<..... ........ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ 00000030: 00 02 00 00 0a 00 00 00 00 00 00 00 5a 29 00 00 ........ ....Z).. 00000040: 02 00 00 00 00 00 00 00 10 01 01 02 ........ ....
libbde_metadata_read_entries: offset : 0x5aa29000 libbde_metadata_read_entries: size : 8192 libbde_metadata_read_entries: unknown1: 00000000: 04 00 3c 00 00 00 00 00 05 00 00 00 00 00 00 00 ..<..... ........ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ 00000020: 00 02 00 00 0a 00 00 00 00 00 00 00 5a 29 00 00 ........ ....Z).. 00000030: 02 00 00 00 00 00 00 00 10 01 01 02 ........ ....
libbde_metadata_read_volume_master_key: AES-CCM key: 00000000: e9 36 77 1d ad 60 c4 a1 06 31 bc 90 e6 fb 6b 4c .6w..`.. .1....kL 00000010: 77 1d f1 6d e3 40 40 d2 28 13 c8 51 fb 3b 98 ec w..m.@@. (..Q.;..
libbde_metadata_read_volume_master_key: unencrypted data: 00000000: 91 d2 09 ae 94 e2 39 85 7d 57 68 13 9f 56 aa 57 ......9. }Wh..V.W 00000010: 2c 00 00 00 01 00 00 00 03 20 00 00 be e8 31 09 ,....... . ....1. 00000020: 97 0c 6c 75 b6 18 5f 74 91 fd 34 15 a6 e6 c9 09 ..lu.._t ..4..... 00000030: 77 12 5b 26 e0 3f 95 2d 9e 8d ae 25 w.[&.?.- ...%
libbde_metadata_read_full_volume_encryption_key: unencrypted data: 00000000: 8e 4c 30 29 41 2e 9c 9b e3 98 cf 02 22 52 82 ba .L0)A... ...."R.. 00000010: 2c 00 00 00 01 00 00 00 04 80 00 00 78 ea 4c ca ,....... ....x.L. 00000020: 59 15 3d 1c 84 cb 10 b9 c9 58 69 ec c5 9a 9b 60 Y.=..... .Xi....` 00000030: f4 07 77 e2 7b 26 22 40 e7 c6 13 a0 ..w.{&"@ ....
libbde_volume_open_read_keys_from_metadata: volume master key: 00000000: be e8 31 09 97 0c 6c 75 b6 18 5f 74 91 fd 34 15 ..1...lu .._t..4. 00000010: a6 e6 c9 09 77 12 5b 26 e0 3f 95 2d 9e 8d ae 25 ....w.[& .?.-...%
libbde_volume_open_read_keys_from_metadata: full volume encryption key: 00000000: 78 ea 4c ca 59 15 3d 1c 84 cb 10 b9 c9 58 69 ec x.L.Y.=. .....Xi. 00000010: c5 9a 9b 60 f4 07 77 e2 7b 26 22 40 e7 c6 13 a0 ...`..w. {&"@.... 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
libbde_volume_open_read_keys_from_metadata: tweak key: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
Reading unencrypted volume header: libbde_io_handle_read_unencrypted_volume_header: reading unencrypted volume header at offset: 1520603136 (0x5aa29000) libbde_sector_data_read: reading sector data at offset: 1520603136 (0x5aa29000) libbde_sector_dataread: encrypted sector data: 00000000: c6 b8 d6 40 3b 15 1f 1b 77 2b 7f 49 1c 9a 6c a4 ...@;... w+.I..l. 00000010: ed 44 21 26 6d da c3 3b 59 7c 52 0b b9 17 d2 a8 .D!&m..; Y|R..... 00000020: bb ef a1 f3 d3 59 20 a0 75 3c 28 02 25 9e bd 39 .....Y . u<(.%..9 00000030: 96 0d 83 69 e5 e9 86 4a a3 7f 56 d1 b0 f5 1f 0c ...i...J ..V..... 00000040: 1b 16 84 3d a5 6f 20 c4 3d ba a3 0a 6f b1 1f c9 ...=.o . =...o... 00000050: 81 d1 7b 80 bb db 2a 96 6a 7d 42 58 2c 32 74 9e ..{.... j}BX,2t. 00000060: 3a e3 47 93 51 7f 18 b6 df 0a 3a 2f cc 3d fc ad :.G.Q... ..:/.=.. 00000070: 26 93 59 bc ad 29 65 63 bf b0 27 3b 85 da 3f 48 &.Y..)ec ..';..?H 00000080: e6 ab 5f 0c fc 29 34 06 60 f1 27 4b 26 51 c3 bc ....)4. `.'K&Q.. 00000090: 04 b1 49 89 46 13 8f a6 fd 1a 9e 43 6b 83 c8 a7 ..I.F... ...Ck... 000000a0: 15 ad 0c 3c ce 55 9c db a4 e4 14 22 ca 35 e7 6d ...<.U.. ...".5.m 000000b0: a3 9f aa b6 d3 8e 6a 82 23 90 0c 52 69 df cc 03 ......j. #..Ri... 000000c0: b0 91 ec 11 6a c4 56 63 de 8f eb 62 53 24 6d 9c ....j.Vc ...bS$m. 000000d0: 30 fe 2f b0 5a a0 3d ee c6 a4 fe 9c 27 34 36 c1 0./.Z.=. ....'46. 000000e0: 05 0c 8b cb f7 70 f7 ff a6 66 21 a9 b2 09 ac 6d .....p.. .f!....m 000000f0: 5f a0 8c 21 4f 42 94 86 45 4e af fb f1 71 0f 1d ..!OB.. EN...q.. 00000100: 1b 3d 9e f8 38 d8 ae 3e c5 da 4a b3 93 ea 82 ea .=..8..> ..J..... 00000110: 9f e2 bc 06 92 29 06 10 3c 30 2a 88 c6 b8 76 a6 .....).. <0_...v. 00000120: 06 20 e4 db 1f b1 1d 60 cb cb ac ec 7a 40 30 ec . .....` ....z@0. 00000130: 55 8c f7 0f 52 a2 09 85 62 07 5c 5a 8f d7 32 c0 U...R... b.\Z..2. 00000140: 10 42 1f 05 30 2c 82 80 80 1c 24 03 0c 1b 05 0c .B..0,.. ..$..... 00000150: c2 bb d7 17 52 c3 de b4 53 d4 dd 9e 8e bc 02 10 ....R... S....... 00000160: c1 70 ae 0f 14 32 77 64 c2 96 fe 04 d9 3f ee 91 .p...2wd .....?.. 00000170: 2c 54 27 a2 f1 ab 56 81 b6 0d d6 da 9f 08 fe bf ,T'...V. ........ 00000180: 78 66 2a c7 f4 31 ae b5 c7 87 17 07 af d1 4b 93 xf*..1.. ......K. 00000190: 9f 10 34 b5 4d 99 bd c7 e7 af 50 3b d0 f0 5c 27 ..4.M... ..P;..\' 000001a0: b6 0e 82 ec f7 cb 1b 4b 80 2f 14 de f5 19 dd 75 .......K ./.....u 000001b0: 96 80 cc 43 10 7c 00 e7 3e 9f 92 bc b5 77 d3 ec ...C.|.. >....w.. 000001c0: 3e 5c 97 7f 0f 38 9b 62 18 e7 66 40 81 72 35 b7 >...8.b ..f@.r5. 000001d0: e6 c1 ce 7d d6 de 11 f7 40 fb 05 97 c5 9e 78 3a ...}.... @.....x: 000001e0: dd ea 04 98 49 f6 df 25 18 4d ae 30 dc af 52 57 ....I..% .M.0..RW 000001f0: cd 1c ad ba a2 24 3f 62 fb d4 08 7e 90 61 c9 c0 .....$?b ...~.a..
libbde_encryption_crypt: initializatio
joachimmetz
commented
8 years ago thanks for the debug output but it seems to be truncated can you please mail me the full file. Thx in advance.
joachimmetz
commented
7 years ago Based on the error this is likely a duplicate of #6. Should be fixed now.
![https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open](https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open){kind=link}
Hi developers,
although it seems to be no bug in the proper sense, I would like you to have an eye on this case: I have a Windows 10 SD, system partition, I am not able to mount because of the above error. Does anyone know if this is Microsofts fault? The second disc (hdd) can be decrypted just fine with this great tool. Does Microsoft use different key sizes??? For what reasons? Thanks a lot!