wxtla 0.3.1

Wired eXploring Target Layer Accessor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

//! BitLocker volume driver and probe registration.

mod crypto;
mod driver;
mod header;
mod metadata;
mod system;

pub use driver::BitlockerDriver;
pub use header::{BitlockerHeaderFlavor, BitlockerVolumeHeader};
pub use metadata::{
  BitlockerEncryptionMethod, BitlockerKeyProtectorKind, BitlockerMetadata,
  BitlockerMetadataBlockHeader, BitlockerMetadataHeader, BitlockerVolumeMasterKey,
};
pub use system::BitlockerVolumeSystem;

use crate::{
  FormatDescriptor, FormatKind, FormatProbe, ProbeConfidence, ProbeContext, ProbeMatch,
  ProbeRegistry, ProbeResult, Result,
};

/// BitLocker stacked volume descriptor.
pub const DESCRIPTOR: FormatDescriptor =
  FormatDescriptor::new("volume.bitlocker", FormatKind::VolumeManager);

inventory::submit! {
  crate::formats::FormatInventoryEntry::new(DESCRIPTOR, register_probes)
}

fn register_probes(registry: &mut ProbeRegistry) {
  registry.register(BitlockerProbe);
}

struct BitlockerProbe;

impl FormatProbe for BitlockerProbe {
  fn descriptor(&self) -> FormatDescriptor {
    DESCRIPTOR
  }

  fn probe(&self, context: &ProbeContext<'_>) -> Result<ProbeResult> {
    let Ok(header_bytes) = context.header(512) else {
      return Ok(ProbeResult::rejected());
    };
    if BitlockerVolumeHeader::from_bytes(&header_bytes).is_ok() {
      return Ok(ProbeResult::matched(ProbeMatch::new(
        DESCRIPTOR,
        ProbeConfidence::Exact,
        "bitlocker volume header found",
      )));
    }

    Ok(ProbeResult::rejected())
  }
}