search

pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
47 stars 12 forks source link

BITLOCKER Parsing #365

Open pjrinaldi opened 3 years ago

pjrinaldi commented 3 years ago

Implement Bitlocker Parsing

pjrinaldi commented 2 years ago

Tested using libbde.h to see what i could do with it, but it requires a filename and a file to parse it, which I won't have since it's a ForImg qiodevice and not a low level c file. I'll just have to manually implement, but at least i can try to follow the libbde code as a reference.

pjrinaldi commented 2 years ago

once it's detected and before parsing, I need to popup a dialog which detects key types and then asks for the user password for the user key, recovery password for the recovery key, and nothing for the clear key, and also informs the user when it's a tpm key and can't be decrypted. will look at dislocker and libbde code as reference for this as I work my way through the spec to implement this.