search

libyal / libbde

Library and tools to access the BitLocker Drive Encryption (BDE) encrypted volumes
GNU Lesser General Public License v3.0
214 stars 52 forks source link

BDE spec: Didn't mention "COV 0001. ER", etc. #26

Closed Explorer09 closed 5 years ago

Explorer09 commented 6 years ago

Hello. My I suggest one improvement of the BDE spec? I have recently been experimenting with BitLocker encryption of FAT32 volumes, and I found my "discovery volume" contains "COV 0001. ER" and such for encrypted data.

For example, from an ls -l output when mounted in Linux:

...
-r--r--r-- 1 root root      32768 Mar 30  2018 COV\ 0000.\ BL*
-r--r--r-- 1 root root 4294934528 Mar 30  2018 COV\ 0000.\ ER*
-r--r--r-- 1 root root 4294934528 Mar 30  2018 COV\ 0001.\ ER*
-r--r--r-- 1 root root 4294934528 Mar 30  2018 COV\ 0002.\ ER*
-r--r--r-- 1 root root 3146153984 Mar 30  2018 COV\ 0003.\ ER*
...

It looks like each . ER file has a maximum size of 4294934528 bytes (4 GiB - 32768 bytes). The existence of multiple . ER files and their size limit it not mentioned in the specification.

By the way, I encrypted this drive in Windows 10 version 1703. It's a 16 GB USB flash drive with a single FAT32 volume; partition table is MBR.

Explorer09 commented 6 years ago

One more technical info:

From DIR /A /X command in Windows XP of the same volume

...
09/29/2017  07:42 AM          6,656 ZH-TW_~1.MUI zh-TW_BitLockerToGo.exe.mui
03/30/2018  03:51 AM         32,768 COV000~1.BL  COV 0000. BL
03/30/2018  03:51 AM      4,194,304              PAD 0000. PD
03/30/2018  03:51 AM  4,294,934,528              COV 0000. ER
03/30/2018  03:51 AM  4,294,934,528              COV 0001. ER
03/30/2018  03:51 AM  4,294,934,528              COV 0002. ER
03/30/2018  03:51 AM  3,146,153,984              COV 0003. ER
03/30/2018  03:51 AM              0              PAD 0000. NG
03/30/2018  03:51 AM              0              PAD 0001. NG
...

The total number of files in my volume is 906. The PAD <num>. NG files seems to be used in filling the file name entries, so that it gets 906 files in the count. But I have no idea why it has to be this number.

UPDATE: I know the purposes of PAD <num>. NG files now. They are meant to fill the root directory entries so that no new files may be created on the drive. It seems to be used as the last stage of padding after all clusters have been allocated in the filesystem.

You can try these commands on the discovery volume as a proof:

TYPE NUL: >FOO.TXT
REM The above command should error with "There is not enough space on the disk."
DEL PAD 0001. NG
TYPE NUL: >FOO.TXT
REM Should succeed now.
TYPE NUL: >BAR.TXT
REM Should error again with "There is not enough space on the disk."
joachimmetz commented 5 years ago

@Explorer09 thanks for sharing your findings I've update the documentation in https://github.com/libyal/libbde/commit/a5a78a51c9a5756365d1878a8173340c578655c2