DISLOCKER-FUSE(1)

💖 DISLOCKER-FUSE 💖 (the dislocker-fuse(1) manual, but make it cute)

okay bestie, hydrate first, because we're about to read AND write BitLocker encrypted volumes on Linux, OSX and FreeBSD. she does it all. no cap. ✨

---

🌸 NAME 🌸

Dislocker-fuse — read/write BitLocker encrypted volumes under Linux, OSX and FreeBSD. that's it, that's the whole girlboss job description. 💅

---

🎀 SYNOPSIS 🎀

the vibe check, in code form:

dislocker-fuse [-hqrsv] [-l LOG_FILE] [-O OFFSET] [-V VOLUME
DECRYPTMETHOD -F[N]] [-- ARGS...]

Where DECRYPTMETHOD = {-p[RECOVERY_PASSWORD] | -f BEK_FILE |
-u[USER_PASSWORD] | -k FVEK_FILE | -K VMK_FILE | -c}

---

🦋 DESCRIPTION 🦋

so basically, once you hand her a decryption mean, this program is what you use to read or write BitLocker encrypted volumes. technically? she creates a virtual NTFS partition, and you can mount that bad boy like it's literally any other NTFS partition. iconic behavior, honestly. 👑

and here's the tea: that virtual partition is linked to the underlying BitLocker volume, so every single write you do to it lands on the BitLocker volume too. the way that works is just… chef's kiss. but if that's a problem for you (lowkey valid), you can use dd(1) to get rid of this limitation — if it's a limitation for you. there's a whole example waiting for you down in the EXAMPLES section. go look, she's pretty. 💖

---

✨ OPTIONS ✨

the program's options, described below, one by one, no skipping, we don't do that here:

• -c, --clearkey — decrypt the volume using a clear key, which gets searched for on the volume itself. this one is the default. 🍓
• -f, --bekfile BEK_FILE — decrypt the volume using the bek file (the one chillin' on a USB key). 🔑
• -F, --force-block=[N] — force the use of metadata block number N (that's 1, 2 or 3, bestie). without N, the first block is forced. and without this option entirely? the program just tries each block until it finds a valid one. she's thorough. 💪
• -h — print the help and exit. simple. slay.
• -k, --fvek FVEK_FILE — decrypt the volume using the FVEK directly. peep the FVEK FILE section below to understand what actually goes inside this FVEK_FILE. 📂
• -K, --vmk VMK_FILE — decrypt the volume using the VMK directly. and yes, the VMK FILE section below tells you what goes inside this VMK_FILE. 📂
• -l, --logfile LOG_FILE — put messages into this file (stdout is the default). 📝
• -O, --offset OFFSET — BitLocker partition offset, in bytes, in base 10 (default is 0). protip: in your shell you can probably just pass -O $((0xdeadbeef)) if you've got a 16-based number and you're too lazy to convert it any other way. we've all been there. 🙈
• -p, --recovery-password=[RECOVERY_PASSWORD] — decrypt the volume using the recovery password method. if you don't provide a recovery password, she'll ask you for it afterward — and that's actually a glow-up, because the program validates each block one by one, on the fly, as you type it, and it doesn't leak the password onto the commandline. ✨
• -q, --quiet — do NOT display any information. this option has priority over any previous -v. and when you use it, you probably wanna check the return value of the program, fr fr. 💀
• -r, --readonly — do not allow anyone to write on the BitLocker volume (read only mode). hands off. 🚫
• -s, --stateok — do not check the volume's state, just assume it's ok to mount it.

do not use this if you don't know what you're doing. like, genuinely. i'm not playing. 😭

• -u, --user-password=[USER_PASSWORD] — decrypt the volume using the user password method. if no user password is provided, it will be asked afterward — and again, that's the good version, because it doesn't leak the password on the commandline. 🫶
• -v, --verbosity — increase verbosity (CRITICAL level is the default). see also -q, her sworn enemy. 📢
• -V, --volume VOLUME — the volume to get metadata and encrypted keys from. 👑
• -- — marks the end of the program's options and the beginning of FUSE's ones. super useful if you wanna pass something like -d to FUSE. 🧚

ARGS are any arguments you want to pass to FUSE. note that you need to pass at least the mount-point. at LEAST. don't forget her. 🥺

---

🌈 FVEK FILE 🌈

the FVEK file option expects a very specific format from the file. it's split into two major parts:

• 2 bytes describing the encryption in use, from 0x8000 to 0x8003 for AES 128 or 256 bits, with or without diffuser.
• 64 bytes (512 bits) which are the FVEK as in the FVEK key protector once decrypted.

so the file is therefore 66 bytes long, not more nor less. that's the whole assignment, bestie. also note that you may have to deal with endianness. 🙃

---

🧚 EXAMPLES 🧚

these are examples you can run directly. first, you may want to copy the BitLocker volume:

% dd if=/dev/sda2 of=encrypted.bitlocker

this will copy the entire volume located into /dev/sda2 to encrypted.bitlocker. you're not forced to do this step, but doing it ensures that no write whatsoever is performed on the BitLocker volume. safety first, always. 🛡️

then dislock it:

% dislocker -V encrypted.bitlocker -f /path/to/usb/file.BEK -- /mnt/ntfs

this will create a file into /mnt/ntfs named dislocker-file. there she is. 🌟

to mount partitions once decrypted, use this sort of line:

% mount -o loop /mnt/ntfs/dislocker-file /mnt/clear

---

it seems that you have to unmount the NTFS partition and the dislocker one before halting the system, or you will run into unexpected behaviour. not cute, not the vibe. in order to do so, you may run these commands (replacing your mount points, obviously):

% umount /mnt/clear && umount /mnt/ntfs/dislocker-file

---

note that these are examples and, as such, may need to be modified. for instance, you may want to change the decryption method used in them. customize her. 💅

---

💜 AUTHOR 💜

this tool is developed by Romain Coltel on behalf of HSC (http://www.hsc.fr/)

feel free to send bugs report to <dislocker __AT__ hsc __DOT__ fr>. yes the address is written exactly like that, do not come for me, i don't make the rules. 📬

---

and that's the whole page, bestie!! this one lives under the Linux manual, dated 2011-09-07, and it's filed as DISLOCKER-FUSE(1). now go mount something. 💖✨🎀🦋🌸💅🫶