pub struct BitLockerVolume;Expand description
Namespace for opening a BitLocker volume. All state lives in the returned
DecryptedVolume; this type carries no data itself.
Implementations§
Source§impl BitLockerVolume
impl BitLockerVolume
Sourcepub fn read_metadata<R: Read + Seek>(reader: &mut R) -> Result<FveMetadata>
pub fn read_metadata<R: Read + Seek>(reader: &mut R) -> Result<FveMetadata>
Parse the volume header and the first valid FVE metadata block from
reader, without unlocking. Used by the forensic analyzer to audit the
key protectors even when no password is known.
§Errors
BdeError::NotBitLocker if the header signature is absent, or
BdeError::NoValidMetadata if no -FVE-FS- block is found.
Sourcepub fn unlock_with_password<R: Read + Seek>(
reader: R,
password: &str,
) -> Result<DecryptedVolume<R>>
pub fn unlock_with_password<R: Read + Seek>( reader: R, password: &str, ) -> Result<DecryptedVolume<R>>
Unlock the volume with password, returning a plaintext view.
§Errors
Fails loud on a non-BitLocker image, an unsupported cipher, a missing password protector, absent key material, or a wrong password (the AES-CCM tag fails to verify).
Sourcepub fn unlock_with_recovery_password<R: Read + Seek>(
reader: R,
recovery: &str,
) -> Result<DecryptedVolume<R>>
pub fn unlock_with_recovery_password<R: Read + Seek>( reader: R, recovery: &str, ) -> Result<DecryptedVolume<R>>
Unlock the volume with a 48-digit recovery password, returning a
plaintext view. Uses the recovery protector (0x0800) and the recovery
key-derivation (recovery_key_hash).
§Errors
BdeError::InvalidRecoveryPassword if the recovery password is
malformed; otherwise the same failures as Self::unlock_with_password
(non-BitLocker image, unsupported/unvalidated cipher, no recovery
protector, absent key material, or a wrong key).
Sourcepub fn unlock_clear_key<R: Read + Seek>(reader: R) -> Result<DecryptedVolume<R>>
pub fn unlock_clear_key<R: Read + Seek>(reader: R) -> Result<DecryptedVolume<R>>
Unlock the volume with no credential via its clear-key protector
(0x0000), returning a plaintext view. A clear-key protector stores the
VMK unprotected — BitLocker adds it when protection is suspended — so the
clear key held in the VMK’s KEY property unwraps the VMK directly, with no
stretch and no external key. A clear-key volume is effectively unencrypted.
§Errors
BdeError::NoUnlockProtector if the volume carries no clear-key protector;
otherwise the same failures as Self::unlock_with_password (non-BitLocker
image, unsupported/unvalidated cipher, absent key material, or a wrong key).
Sourcepub fn unlock_with_startup_key<R: Read + Seek>(
reader: R,
startup_key: &[u8],
) -> Result<DecryptedVolume<R>>
pub fn unlock_with_startup_key<R: Read + Seek>( reader: R, startup_key: &[u8], ) -> Result<DecryptedVolume<R>>
Unlock the volume with a startup-key (.BEK) external key, returning a
plaintext view. startup_key is the raw bytes of the .BEK file. Uses the
startup-key protector (0x0200): the 256-bit external key held in the
.BEK AES-CCM-unwraps the VMK directly — no stretch, no password.
§Errors
BdeError::MissingKeyMaterial if the .BEK carries no external key,
BdeError::NoUnlockProtector if the volume has no startup-key protector;
otherwise the same failures as Self::unlock_with_password (non-BitLocker
image, unsupported/unvalidated cipher, absent key material, or a wrong key).