Missing identifier for Bitlocker Used Disk Space Only encryption

[bulhakov-adf]

Hi,

Currently I am experiencing the issue with Bitlocker image. Here is an output including debug info:
bitlocker output.txt

I noticed that the problem appears at libbde_io_handle_read_volume_header function in libbde_io_handle.c in Bitlocker identifier checking logic. I tried to ignore checks and set LIBBDE_VERSION_WINDOWS_7 version to io_handle->version. This helped to decrypt the partition. Is it just a new Bitlocker identifier that is stored in those 16 bytes or the problem is much deeper?

Thank you!

[joachimmetz]

If we assume this is BDE ToGO from bitlocker output.txt it looks like part of the metadata including the identifier (at offset 0x1a8) has been changed to 'x'

00000180: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
00000190: 00 00 00 00 00 00 00 00  78 78 78 78 78 78 78 78   ........ xxxxxxxx
000001a0: 78 78 78 78 78 78 78 78  78 78 78 78 78 78 78 78   xxxxxxxx xxxxxxxx
000001b0: 78 78 78 78 78 78 78 78  78 78 78 78 78 78 78 78   xxxxxxxx xxxxxxxx
000001c0: 78 78 78 78 78 78 78 78  78 78 78 78 78 78 78 78   xxxxxxxx xxxxxxxx
000001d0: 78 78 78 78 78 78 78 78  78 78 78 78 78 78 78 78   xxxxxxxx xxxxxxxx
000001e0: 78 78 78 78 78 78 78 78  ff ff ff ff ff ff ff ff   xxxxxxxx ........
000001f0: ff ff ff ff ff ff ff ff  ff ff ff 00 1f 2c 55 aa   ........ .....,U.

If we assume this is BDE 7 offset 0xa0

00000090: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
000000a0: 3b 4d a8 92 80 dd 0e 4d  9e 4e b1 e3 28 4e ae d8   ;M.....M .N..(N..
000000b0: 00 00 40 02 00 00 00 00  00 40 8b 42 00 00 00 00   ..@..... .@.B....

uuid.UUID(bytes_le='3b 4d a8 92 80 dd 0e 4d  9e 4e b1 e3 28 4e ae d8'.replace(' ', '').decode('hex'))
Out[3]: UUID('92a84d3b-dd80-4d0e-9e4e-b1e3284eaed8')

92a84d3b-dd80-4d0e-9e4e-b1e3284eaed8 is different from known GUIDs.

• The BitLocker identifier (GUID) is 4967d63b-2e29-4ad8-8399-f6a339e3d00.
• BitLocker To Go uses 4967d63b-2e29-4ad8-8399-f6a339e3d01.

Any more context about this volume?

Also see: https://github.com/libyal/libbde/blob/master/documentation/BitLocker%20Drive%20Encryption%20(BDE)%20format.asciidoc#42-bitlocker-windows-7-and-later or https://github.com/libyal/libbde/blob/master/documentation/BitLocker%20Drive%20Encryption%20(BDE)%20format.asciidoc#43-bitlocker-to-go

[bulhakov-adf]

I will try to share everything I know:
The image was created on Win10(ver. 1803), this is a system partition. The image was created by my colleges some time ago, so, unfortunately, I have no details on the creation. I will also share the output for succeed decryption with assumption that the version is LIBBDE_VERSION_WINDOWS_7 and failed one for LIBBDE_VERSION_TO_GO:
bitlocker_output_win7.txt
bitlocker_output_to_go.txt

I still have the source PC available and I will try to image again.

[joachimmetz]

My initial guess is that the format was changed, I can add the identifier but without a reference image to confirm, this will be speculation at this point nothing else changed. Would it be possible to make a small test image that could be shared?

[bulhakov-adf]

Unfortunately, I can't reproduce it, but I can give you the initial image(raw or raw compressed by 7zip). The size of raw image is 29 Gb. I will upload the image(or 7z containing raw image, as you prefer) to Google Drive and grant you access(to the email address that you provided in profile info), if you are okay with that.

[joachimmetz]

@bulhakov-adf yes that sounds good to me, thx

[bulhakov-adf]

Cool. I have sent you an email message with a link.

[joachimmetz]

Thx, I received it, and as indicated will try to have a look shortly at format changes.

[joachimmetz]

I've added support for the identifier (locally and will push the changes later). This looks it could be an identifier for "BitLocker Used Disk Space Only encryption" also referred to as Encryption On Write (EOW).

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#used-disk-space-only-encryption

[joachimmetz]

Preliminary support of the "Bitlocker Used Disk Space Only encryption" has been disabled for now. Will re-enable when time permits to ensure format behaves the same as Windows 7 BDE

[Andrew-J-Larson]

@joachimmetz I might be able to help with the testing in a couple of days or so, is the current status of the "Bitlocker Used Disk Space Only encryption" such that bdemount can work on Windows 8/8.1/10 drives, but unsure if it works the same on Windows 7 drives? Let me know what I can do to help.