EncryptionSupport Class Reference

#include <encryption_support.hpp>

Static Public Member Functions
static std::vector< ScanResult >	detect_encrypted_volumes (DiskReader &reader, const std::vector< ScanResult > &seed_results, std::vector< std::string > &logs)
static bool	export_encrypted_metadata (DiskReader &reader, const ScanResult &result, const std::string &output_dir, std::vector< std::string > &logs, std::string &error)
static bool	try_unlock_volume (const std::string &source_path, const ScanResult &result, UnlockSession &session, std::vector< std::string > &logs, std::string &error)

Detailed Description

Definition at line 23 of file encryption_support.hpp.

Member Function Documentation

detect_encrypted_volumes()

std::vector< ScanResult > EncryptionSupport::detect_encrypted_volumes ( DiskReader & reader, const std::vector< ScanResult > & seed_results, std::vector< std::string > & logs )

static

Definition at line 422 of file encryption_support.cpp.

                                                                                                {
    std::vector<ScanResult> out;
    std::set<uint64_t> seen;
    for (uint64_t offset : candidate_offsets(seed_results)) {
        if (!seen.insert(offset).second || offset >= reader.size()) continue;
        if (auto luks = probe_luks(reader, offset); !luks.type.empty()) out.push_back(luks);
        if (auto bitlocker = probe_bitlocker(reader, offset); !bitlocker.type.empty()) out.push_back(bitlocker);
    }
    if (!out.empty()) logs.push_back(trs("Encryption probes: detected") + std::string(" ") + std::to_string(out.size()) + " encrypted container(s).");
    return out;
}

References DiskReader::size(), trs(), and ScanResult::type.

export_encrypted_metadata()

bool EncryptionSupport::export_encrypted_metadata ( DiskReader & reader, const ScanResult & result, const std::string & output_dir, std::vector< std::string > & logs, std::string & error )

static

Definition at line 436 of file encryption_support.cpp.

                                                                    {
    const fs::path root = fs::path(output_dir) / "filesystem_recovered" / "encrypted" /
                          (sanitize_name(result.type) + "_" + std::to_string(result.offset_bytes));
    try {
        fs::create_directories(root);
    } catch (const std::exception& ex) {
        error = ex.what();
        return false;
    }
 
    const uint64_t header_length = result.type.find("BitLocker") != std::string::npos ? 65536ull : 16ull * 1024 * 1024;
    const uint64_t available = result.offset_bytes < reader.size() ? reader.size() - result.offset_bytes : 0;
    const uint64_t to_copy = std::min<uint64_t>(header_length, available);
    if (to_copy == 0) return true;
 
    fs::path meta_path = root / "header_and_metadata.bin";
    if (!ensure_parent_created(meta_path, error)) return false;
    if (!write_bytes(reader, result.offset_bytes, to_copy, meta_path, error)) return false;
 
    std::ofstream readme(root / "README.txt");
    if (readme) {
        readme << result.type << "\n";
        readme << "Offset: " << result.offset_bytes << "\n";
        readme << "Detail: " << result.detail << "\n\n";
        readme << "Unlock environment variables supported by this build:\n";
        readme << "- RECOVERY_LUKS_PASSPHRASE\n";
        readme << "- RECOVERY_LUKS_KEYFILE\n";
        readme << "- RECOVERY_BITLOCKER_PASSWORD\n";
        readme << "- RECOVERY_BITLOCKER_RECOVERY_KEY\n";
        readme << "- RECOVERY_BITLOCKER_BEK_FILE\n";
        readme << "The engine will attempt external read-only unlock through cryptsetup/dislocker when available.\n";
    }
 
    logs.push_back(trs("Exported encrypted volume metadata:") + std::string(" ") + meta_path.string());
    return true;
}

References ScanResult::detail, ScanResult::offset_bytes, DiskReader::size(), trs(), and ScanResult::type.

try_unlock_volume()

bool EncryptionSupport::try_unlock_volume ( const std::string & source_path, const ScanResult & result, UnlockSession & session, std::vector< std::string > & logs, std::string & error )

static

Definition at line 477 of file encryption_support.cpp.

                                                            {
    session = {};
 
    if (result.type.find("LUKS") != std::string::npos) {
        std::string err_keyfile;
        if (const std::string keyfile = getenv_existing_file("RECOVERY_LUKS_KEYFILE");
            !keyfile.empty() && cryptsetup_open_with_keyfile(source_path, result.offset_bytes, keyfile, session, logs, err_keyfile)) {
            return true;
        }
        const std::string passphrase = getenv_str("RECOVERY_LUKS_PASSPHRASE");
        if (cryptsetup_open(source_path, result.offset_bytes, passphrase, session, logs, error)) return true;
        if (!err_keyfile.empty()) error = err_keyfile + "; " + error;
        return false;
    }
 
    if (result.type.find("BitLocker") != std::string::npos) {
        std::string err_password;
        if (const std::string password = getenv_str("RECOVERY_BITLOCKER_PASSWORD");
            !password.empty() && dislocker_open(source_path, result.offset_bytes, password, false, session, logs, err_password)) {
            return true;
        }
        std::string err_recovery;
        if (const std::string recovery_key = getenv_str("RECOVERY_BITLOCKER_RECOVERY_KEY");
            !recovery_key.empty() && dislocker_open(source_path, result.offset_bytes, recovery_key, true, session, logs, err_recovery)) {
            return true;
        }
        std::string err_bek;
        if (const std::string bek_file = getenv_existing_file("RECOVERY_BITLOCKER_BEK_FILE"); !bek_file.empty()) {
            // dislocker accepts -f with a BEK file path.
            std::string open_target = source_path;
            if (result.offset_bytes != 0) {
                if (!create_loop_for_offset(source_path, result.offset_bytes, session.loop_path, logs, err_bek)) {
                    error = err_bek;
                    return false;
                }
                open_target = session.loop_path;
            }
            if (!command_exists("dislocker") || !command_exists("losetup")) {
                error = "dislocker or losetup not available";
                return false;
            }
            const std::string mapper = "recovery_bitlocker_" + sanitize_name(std::to_string(::getpid()) + "_" + std::to_string(result.offset_bytes));
            fs::path mount_dir = fs::temp_directory_path() / (mapper + "_dislocker");
            fs::create_directories(mount_dir);
            std::ostringstream cmd;
            cmd << "dislocker -r -V " << shell_quote(open_target) << ' '
                << "-f " << shell_quote(bek_file) << ' '
                << "-- " << shell_quote(mount_dir.string());
            std::string out;
            int rc = 0;
            if (run_command_capture(cmd.str(), out, rc) && rc == 0) {
                const fs::path dislocker_file = mount_dir / "dislocker-file";
                std::string loop;
                if (fs::exists(dislocker_file) && create_loop_for_offset(dislocker_file.string(), 0, loop, logs, err_bek)) {
                    session.container_type = "BitLocker";
                    session.source_path = source_path;
                    session.source_offset = result.offset_bytes;
                    session.mapper_name = mapper;
                    session.helper_mount_dir = mount_dir.string();
                    session.helper_loop_path = loop;
                    session.uses_dislocker = true;
                    session.mapped_path = loop;
                    logs.push_back(trs("Unlocked BitLocker container through BEK file:") + std::string(" ") + session.mapped_path);
                    return true;
                }
            } else {
                err_bek = trim_copy(out.empty() ? "dislocker failed" : out);
            }
        }
        error = !err_password.empty() ? err_password : (!err_recovery.empty() ? err_recovery : err_bek);
        if (error.empty()) error = "no BitLocker credential environment variable provided";
        return false;
    }
 
    error = "unsupported encrypted container type";
    return false;
}

References UnlockSession::container_type, UnlockSession::helper_loop_path, UnlockSession::helper_mount_dir, UnlockSession::loop_path, UnlockSession::mapped_path, UnlockSession::mapper_name, ScanResult::offset_bytes, UnlockSession::source_offset, UnlockSession::source_path, trs(), ScanResult::type, and UnlockSession::uses_dislocker.

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-recovery-data/src/encryption_support.hpp
• BastionGuard/thirdparty/bastionguard-recovery-data/src/encryption_support.cpp