EncryptedVolumeSupport Class Reference

#include <encrypted_volume_support.hpp>

Static Public Member Functions
static std::vector< ScanResult >	probe (DiskReader &reader, const std::vector< ScanResult > &seed_results, std::vector< std::string > &logs)
static bool	collect_detected_containers (const ScanReport &report, std::vector< EncryptedContainerInfo > &out)

Detailed Description

Definition at line 17 of file encrypted_volume_support.hpp.

Member Function Documentation

collect_detected_containers()

bool EncryptedVolumeSupport::collect_detected_containers ( const ScanReport & report, std::vector< EncryptedContainerInfo > & out )

static

Definition at line 133 of file encrypted_volume_support.cpp.

                                                                                                 {
    out.clear();
    for (const auto& r : report.results) {
        EncryptedContainerInfo info;
        if (r.type == "LUKS1 container") info.scheme = "LUKS1";
        else if (r.type == "LUKS2 container") info.scheme = "LUKS2";
        else if (r.type == "BitLocker volume") info.scheme = "BitLocker";
        else continue;
        info.offset_bytes = r.offset_bytes;
        info.size_bytes = r.size_bytes;
        info.detail = r.detail;
        // Best-effort payload offset extraction from detail string.
        const std::string needle = "payload offset: ";
        const auto pos = r.detail.find(needle);
        if (pos != std::string::npos) {
            const auto start = pos + needle.size();
            const auto end = r.detail.find(' ', start);
            try {
                info.payload_offset_bytes = std::stoull(r.detail.substr(start, end - start));
            } catch (...) {
                info.payload_offset_bytes = 0;
            }
        }
        out.push_back(info);
    }
    return !out.empty();
}

References EncryptedContainerInfo::detail, EncryptedContainerInfo::offset_bytes, EncryptedContainerInfo::payload_offset_bytes, ScanReport::results, EncryptedContainerInfo::scheme, and EncryptedContainerInfo::size_bytes.

probe()

std::vector< ScanResult > EncryptedVolumeSupport::probe ( DiskReader & reader, const std::vector< ScanResult > & seed_results, std::vector< std::string > & logs )

static

Definition at line 102 of file encrypted_volume_support.cpp.

                                                                                  {
    std::vector<ScanResult> out;
    std::set<uint64_t> seen_offsets;
    logs.push_back(trs("Encrypted volume probes: analysis started."));
 
    for (const auto& seed : seed_results) {
        const bool interesting_seed =
            seed.kind == ResultKind::Partition ||
            seed.kind == ResultKind::LostPartitionCandidate ||
            seed.kind == ResultKind::FilesystemCandidate ||
            seed.kind == ResultKind::FilesystemVolume ||
            seed.kind == ResultKind::NtfsVolume;
        if (!interesting_seed || seen_offsets.count(seed.offset_bytes) != 0) continue;
        seen_offsets.insert(seed.offset_bytes);
 
        if (auto r = luks_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
        if (auto r = bitlocker_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
    }
 
    // Also probe the whole source offset 0 for raw encrypted-device headers.
    if (seen_offsets.insert(0).second) {
        if (auto r = luks_probe(reader, 0); !r.type.empty()) out.push_back(r);
        if (auto r = bitlocker_probe(reader, 0); !r.type.empty()) out.push_back(r);
    }
 
    logs.push_back(trs("Encrypted volume probes: analysis completed."));
    return out;
}

References FilesystemCandidate, FilesystemVolume, LostPartitionCandidate, NtfsVolume, Partition, and trs().

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-recovery-data/src/encrypted_volume_support.hpp
• BastionGuard/thirdparty/bastionguard-recovery-data/src/encrypted_volume_support.cpp