dissect.fve.bde

Submodules

Package Contents

Classes

BDE

Bitlocker disk encryption.

Functions

is_bde_volume

class dissect.fve.bde.BDE(fh: BinaryIO)

Bitlocker disk encryption.

fh
boot_sector
information
eow_information = None
property identifiers: list[uuid.UUID]
property sector_size: int
property version: int
property paused: bool
property decrypted: bool
property encrypted: bool
property switching: bool
property unlocked: bool
description() → str | None

Return the volume description, if present.

has_clear_key() → bool

Return whether this volume has a clear/obfuscated encryption key. Used in paused volumes.

has_recovery_password() → bool

Return whether this volume can be unlocked with a recovery password.

has_passphrase() → bool

Return whether this volume can be unlocked with a user passphrase.

has_bek() → bool

Return whether this volume can be unlocked with a BEK file.

unlock(key: bytes) → None

Unlock this volume with the specified encryption key.

unlock_with_clear_key() → None

Unlock this volume with the clear/obfuscated key.

unlock_with_recovery_password(recovery_password: str, identifier: uuid.UUID | str | None = None) → None

Unlock this volume with the recovery password.

unlock_with_passphrase(passphrase: str, identifier: uuid.UUID | str | None = None) → None

Unlock this volume with the user passphrase.

unlock_with_bek(bek_fh: BinaryIO) → None

Unlock this volume with a BEK file.

open() → BitlockerStream

Open this volume and return a readable (decrypted) stream.

reserved_regions() → list[tuple[int, int]]

Return a list of reserved regions for this volume.

Some areas of the volume must “fake” return all null bytes when read. This includes things like the information regions.

Reference: - InitializeFilterData - FveLibIdentifyCurrentRegionTypeAndEnd

dissect.fve.bde.is_bde_volume(fh: BinaryIO) → bool