How do I mount with cygfuse bdemount build?

[signal3436]

Hello,

I used Cygwin (installed all modules) to compile. When I run bdemount.exe in an admin cmd window to mount a BDE volume from a raw image, there is a slight pause but nothing is mounted to the specified drive letter. This occurs when using both the password and recovery options. When I try to use the FVEK option, I get errors:

---

P:\bdemount>bdeinfo P:\image.raw
bdeinfo 20240223

Volume is locked and a password is needed to unlock it.

Password:

Unable to unlock volume.

BitLocker Drive Encryption information:
Volume identifier : abbda335-f434-420c-b97e-5dc2fac4bf74
Encryption method : AES-XTS 128-bit
Creation time : Mar 21, 2024 17:32:18.237762100 UTC
Description : DESKTOP-B8H4DIM C: 3/21/2024
Number of key protectors : 3
Is locked

Key protector 0:
Identifier : 49941cc7-a594-4ce9-be12-9e8d3007d356
Type : Password

Key protector 1:
Identifier : d76929dc-6ab0-4f9c-bcd2-1be14f2bfca3
Type : Startup key

Key protector 2:
Identifier : c92a358a-291f-42e0-ae44-617fc8f0a426
Type : Recovery password

---

P:\bdemount>bdemount.exe -p P:\image.raw X:
bdemount 20240223 --> it pauses and I get the command prompt, nothing mounted

P:\bdemount>bdemount.exe -r P:\image.raw X:
bdemount 20240223 --> it pauses and I get the command prompt, nothing mounted

P:\bdemount>bdemount.exe -k P:\image.raw X:
bdemount 20240223

Unable to open source volume
libbde_ntfs_volume_header_read_data: invalid volume system signature.
libbde_io_handle_read_unencrypted_volume_header: unable to read NTFS volume header.
libbde_internal_volume_unlock: unable to read unencrypted volume header.
libbde_internal_volume_open_read: unable to unlock volume.
libbde_volume_open_file_io_handle: unable to read from file IO handle.
mount_handle_open: unable to open volume.

Here are the first 1024 bytes of the volume:
1024 bytes.txt

[joachimmetz]

Can you provide the offset and data of the unencrypted volume, looks like you sent me the encrypted volume header

Also see: https://github.com/libyal/libbde/wiki/Troubleshooting#verbose-and-debug-output

[signal3436]

I compiled with the Verbose and debug output, but when I run the commands with -v, there is no output anywhere.

[signal3436]

My apologies - I typed the -v command in the wrong place. Attached is the output.

output_-k.txt
output_-p.txt
output_-r.txt

UPDATE: So I realized Volatility only provided half the FVEK. When I provided the entire key the same behavior results - a quick pause and back to the command prompt with nothing mounted.

[joachimmetz]

thanks but you'll need to rebuild the library with the verbose/debug output options otherwise the output is not sufficient detailed also see https://github.com/libyal/libbde/wiki/Building#verbose-and-debug-output

also make sure to remove any sensitive data, I'm mostly interested in what is causing the signature check to fail

[signal3436]

thanks but you'll need to rebuild the library with the verbose/debug output options otherwise the output is not sufficient detailed also see https://github.com/libyal/libbde/wiki/Building#verbose-and-debug-output

also make sure to remove any sensitive data, I'm mostly interested in what is causing the signature check to fail

It's all test data so there's nothing sensitive.

Are the attached logs not sufficient? I'm using the "> filename.txt 2>&1" command.

[joachimmetz]

Are the attached logs not sufficient? I'm using the "> filename.txt 2>&1" command.

they are empty unfortunately, given verbose/debug option has not been compiled

[signal3436]

Are the attached logs not sufficient? I'm using the "> filename.txt 2>&1" command.

they are empty unfortunately, given verbose/debug option has not been compiled

I re-uploaded, so each should be 80k.

[joachimmetz]

thanks looks better, will try to get taking a closer look soon, but have to deal with another thing first.

[signal3436]

thanks look better, will try to get taking a closer look soon, but have to deal with another thing first.

No worries at all. I really appreciate your help!

[joachimmetz]

output_-k.txt

libbde_ntfs_volume_header_read_data: NTFS volume header data:
00000000: fe 1c cd ae 13 ec 33 e3  17 98 b6 63 73 12 e3 b8   ......3. ...cs...
00000010: c8 5e 7e e1 1e fa 5f cc  06 9a f4 f4 39 a1 71 16   .^~..._. ....9.q.
00000020: 7d 03 36 e3 b9 ab 38 6a  75 20 ec 9f 26 f1 2c 8d   }.6...8j u ..&.,.
00000030: 7d 08 ec 9e f6 f6 a8 af  2d 88 28 c1 d0 0d 92 ee   }....... -.(.....

output_-p.txt

libbde_ntfs_volume_header_read_data: NTFS volume header data:
00000000: eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00   .R.NTFS     .....
00000010: 00 00 00 00 00 f8 00 00  3f 00 ff 00 00 b8 11 00   ........ ?.......
00000020: 00 00 00 00 80 00 80 00  53 8f bb 0e 00 00 00 00   ........ S.......
00000030: 00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00   ........ ........
00000040: f6 00 00 00 01 00 00 00  06 c6 a7 12 fc a7 12 70   ........ .......p

output_-r.txt

libbde_ntfs_volume_header_read_data: NTFS volume header data:
00000000: eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00   .R.NTFS     .....
00000010: 00 00 00 00 00 f8 00 00  3f 00 ff 00 00 b8 11 00   ........ ?.......
00000020: 00 00 00 00 80 00 80 00  53 8f bb 0e 00 00 00 00   ........ S.......
00000030: 00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00   ........ ........
00000040: f6 00 00 00 01 00 00 00  06 c6 a7 12 fc a7 12 70   ........ .......p
00000050: 00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07   .....3.. ...|.h..

[joachimmetz]

Looks like output_-p.txt and output_-r.txt are able to decrypt the volume. Which version of Dokan are you using?

[signal3436]

Looks like output_-p.txt and output_-r.txt are able to decrypt the volume. Which version of Dokan are you using?

v2.0.5

[joachimmetz]

The issue you are encountering might be due to changes in Dokan 2.0 and later, I'll have a look later this week to see if I can add support. If you need it urgently you might be able to make the changes yourself based on libyal/libewf@8abd6a9