anonymous_namespace{encrypted_volume_support.cpp} Namespace Reference

Functions
uint16_t	be16 (const unsigned char *p)
uint16_t	le16 (const unsigned char *p)
uint32_t	le32 (const unsigned char *p)
uint64_t	le64 (const unsigned char *p)
bool	read_bytes (DiskReader &reader, uint64_t offset, void *buffer, size_t len)
ScanResult	luks_probe (DiskReader &reader, uint64_t offset)
ScanResult	bitlocker_probe (DiskReader &reader, uint64_t offset)

Function Documentation

be16()

uint16_t anonymous_namespace{encrypted_volume_support.cpp}::be16

(

const unsigned char *

p

)

Definition at line 11 of file encrypted_volume_support.cpp.

                                      {
    return (static_cast<uint16_t>(p[0]) << 8) | static_cast<uint16_t>(p[1]);
}

References be16().

Referenced by be16(), and luks_probe().

bitlocker_probe()

ScanResult anonymous_namespace{encrypted_volume_support.cpp}::bitlocker_probe	(	DiskReader &	reader,
		uint64_t	offset )

Definition at line 74 of file encrypted_volume_support.cpp.

                                                                {
    std::array<unsigned char, 512> sector{};
    if (!read_bytes(reader, offset, sector.data(), sector.size())) return {};
 
    const std::string oem(reinterpret_cast<const char*>(sector.data() + 3), 8);
    const std::string fve(reinterpret_cast<const char*>(sector.data() + 0x03), 11);
    const bool has_fvefs = oem == "-FVE-FS-" || fve.find("FVE-FS") != std::string::npos;
    if (!has_fvefs) return {};
 
    std::ostringstream detail;
    detail << "BitLocker/FVE metadata detected";
    const uint16_t bps = le16(sector.data() + 11);
    const uint8_t spc = sector[13];
    if (bps != 0 && spc != 0) {
        detail << ", bytes/sector: " << bps << ", sectors/cluster: " << static_cast<unsigned>(spc);
    }
    detail << ", encrypted container detected (data recovery requires recovery key/password or an already unlocked device)";
 
    return {ResultKind::FilesystemVolume,
            offset,
            reader.size() > offset ? (reader.size() - offset) : 0,
            "BitLocker volume",
            "Encrypted volume probe",
            detail.str(),
            0.97};
}

References bitlocker_probe(), FilesystemVolume, le16(), read_bytes(), and DiskReader::size().

Referenced by bitlocker_probe().

le16()

uint16_t anonymous_namespace{encrypted_volume_support.cpp}::le16

(

const unsigned char *

p

)

Definition at line 15 of file encrypted_volume_support.cpp.

                                      {
    return static_cast<uint16_t>(p[0]) | (static_cast<uint16_t>(p[1]) << 8);
}

References le16().

Referenced by bitlocker_probe(), and le16().

le32()

uint32_t anonymous_namespace{encrypted_volume_support.cpp}::le32

(

const unsigned char *

p

)

Definition at line 19 of file encrypted_volume_support.cpp.

                                      {
    return static_cast<uint32_t>(p[0]) |
           (static_cast<uint32_t>(p[1]) << 8) |
           (static_cast<uint32_t>(p[2]) << 16) |
           (static_cast<uint32_t>(p[3]) << 24);
}

References le32().

Referenced by le32(), and luks_probe().

le64()

uint64_t anonymous_namespace{encrypted_volume_support.cpp}::le64

(

const unsigned char *

p

)

Definition at line 26 of file encrypted_volume_support.cpp.

                                      {
    return static_cast<uint64_t>(p[0]) |
           (static_cast<uint64_t>(p[1]) << 8) |
           (static_cast<uint64_t>(p[2]) << 16) |
           (static_cast<uint64_t>(p[3]) << 24) |
           (static_cast<uint64_t>(p[4]) << 32) |
           (static_cast<uint64_t>(p[5]) << 40) |
           (static_cast<uint64_t>(p[6]) << 48) |
           (static_cast<uint64_t>(p[7]) << 56);
}

References le64().

Referenced by le64(), and luks_probe().

luks_probe()

ScanResult anonymous_namespace{encrypted_volume_support.cpp}::luks_probe	(	DiskReader &	reader,
		uint64_t	offset )

Definition at line 41 of file encrypted_volume_support.cpp.

                                                           {
    std::array<unsigned char, 4096> hdr{};
    if (!read_bytes(reader, offset, hdr.data(), hdr.size())) return {};
    if (!(hdr[0] == 'L' && hdr[1] == 'U' && hdr[2] == 'K' && hdr[3] == 'S' && hdr[4] == 0xBA && hdr[5] == 0xBE)) {
        return {};
    }
 
    const uint16_t version = be16(hdr.data() + 6);
    std::ostringstream detail;
    uint64_t payload_offset = 0;
    if (version == 1) {
        const uint32_t payload_sectors = le32(hdr.data() + 104);
        payload_offset = static_cast<uint64_t>(payload_sectors) * 512ull;
        detail << "LUKS1, payload offset: " << payload_offset << " bytes";
    } else if (version == 2) {
        // We intentionally avoid a full JSON parser here; this is enough to identify container geometry safely.
        const uint64_t hdr_size = le64(hdr.data() + 8);
        payload_offset = hdr_size >= 4096 ? hdr_size * 2ull : (16ull * 1024 * 1024);
        detail << "LUKS2, metadata area: " << hdr_size << " bytes, estimated payload offset: " << payload_offset << " bytes";
    } else {
        detail << "LUKS version " << version;
    }
    detail << ", encrypted container detected (data recovery requires passphrase/key material or an already unlocked mapper device)";
 
    return {ResultKind::FilesystemVolume,
            offset,
            reader.size() > offset ? (reader.size() - offset) : 0,
            version == 2 ? "LUKS2 container" : "LUKS1 container",
            "Encrypted volume probe",
            detail.str(),
            0.98};
}

References be16(), FilesystemVolume, le32(), le64(), luks_probe(), read_bytes(), and DiskReader::size().

Referenced by luks_probe().

read_bytes()

bool anonymous_namespace{encrypted_volume_support.cpp}::read_bytes	(	DiskReader &	reader,
		uint64_t	offset,
		void *	buffer,
		size_t	len )

Definition at line 37 of file encrypted_volume_support.cpp.

                                                                               {
    return reader.read_at(offset, buffer, len);
}

References DiskReader::read_at(), and read_bytes().

Referenced by bitlocker_probe(), luks_probe(), and read_bytes().