1 terabyte partition limit?

[gfd2020]

Hi,

I am using libbde DLL (version 20190701) to decrypt a 1.8 TB bitlocker partition (1984698515456 bytes).

When the libbde_volume_read_buffer method arrives at offset 1099511627776 (0x10000000000), an error occurs as follows:

--------------------------------------------------------------------------------------------
error_backtrace:
libfdata_vector_get_element_index_at_offset: invalid element index value exceeds maximum.
libfdata_vector_get_element_value_at_offset: unable to retrieve element index at offset: 0x10000000000.
libbde_internal_volume_read_buffer_from_file_io_handle: unable to retrieve sector data at offset: 1099511627776.
libbde_volume_read_buffer: unable to read buffer.

debug:
libfdata_vector_get_element_value_by_index: cache: 0x4569dc98 hit
libfdata_vector_get_element_index_at_offset: requested offset: 0x10000000000
libfdata_vector_get_element_index_at_offset: segment: 000   mapped range: 0x00000000 - 0x1ce19400000 (size: 1984698515456)
libfdata_vector_get_element_index_at_offset: segment: 000   file index: 000 offset: 0x00000000 - 0x1ce19400000 (size: 1984698515456)
-------------------------------------------------------------------------------------------

The 'element index' has value of 0x80000000

Is there a limitation to read bytes at addresses above 1099511627776 bytes? Is there any alternative configuration?

Thanks!

[joachimmetz]

the limit here is the storage size of the integer used by libfdata_vector_get_element_index_at_offset. If that is 32-bit for your build you could try changing this to int64.

[gfd2020]

Ok. Thank you!