First, thanks for dislocker, it's great to be able to read BitLocker disks on Linux!
I have a 4TB BitLocker volume that I created on Windows 10. I checksummed 1.8TB of files on this volume, and found a single file that dislocker appears to be reading incorrectly. Specifically, two 4KB blocks in the file appear to be garbled. Windows 10 reads the file correctly (tested twice on different weeks) while dislocker reads the file incorrectly (tested twice across two physical-power-off events).
I built dislocker@develop 564420c on Ubuntu 15.10 (64-bit).
With dislocker:
# cd /home/dislocker/dislocker/src
# ./dislocker-fuse --readonly --verbosity --user-password -V /dev/sda4 /mnt/bitlocker-C
Enter the user password:
# ls -l /mnt/bitlocker-C/dislocker-file
-r--r--r-- 1 root root 4,000,191,610,368 1970-01-01 00:00 /mnt/bitlocker-C/dislocker-file
# mount -t ntfs-3g -o ro,uid=1000,gid=1000,umask=077 /mnt/bitlocker-C/dislocker-file /mnt/C
# cd /mnt/C/YouTube/UCNHAsCPp3tfbV3O3t7RxYMA
# ls -l 'Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm'
-rwx------ 2 at at 605,594,334 2015-10-13 08:00 Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm*
# md5sum 'Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm'
f943abbd99343db0d4e384524e8d588a Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm
# ffmpeg -v error -i 'Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm' -f null -
[matroska,webm @ 0x13c5c00] Invalid EBML number size tag 0x05 at pos 572409231 (0x221e458f)
I booted into Windows 10 after seeing the incorrect hash f943abbd99343db0d4e384524e8d588a and confirmed that Windows 10 still saw the correct hash 61ac59d3b615cf191b22351b706d7db4.
On a known-good copy of the data created on Windows 10, copying into a Linux Samba share:
# md5sum 'Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm'
61ac59d3b615cf191b22351b706d7db4 Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm
# ffmpeg -v error -i 'Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm' -f null -
(no errors)
Binary-diffing the file shows these differences, indicating that two 4KB blocks are garbled.
strace'ing the mount.ntfs-3g process and then running this program to read the garbled block:
python -c "f=open('Forbush, Colombatto, Shuen, Polleit, Huelsmann, Discusssion, Q & A (PFS 2015)-v5zr8s0Zmn8.webm', 'rb');f.seek(568303648);print hash(f.read(8*1024))"
shows
read(4, "8\0\0\0\3\0\0\0\357\22\0\0\0\0\0\0\3\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 56
writev(4, [{"x\0\0\0\0\0\0\0\357\22\0\0\0\0\0\0", 16}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\232\372;\0\0\0\0\0\0\0\2\0\0\0\0\0"..., 104}], 2) = 120
read(4, "\207\0\0\0\1\0\0\0\360\22\0\0\0\0\0\0\3\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 135
writev(4, [{"\220\0\0\0\0\0\0\0\360\22\0\0\0\0\0\0", 16}, {"\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 128}], 2) = 144
read(4, "8\0\0\0\3\0\0\0\361\22\0\0\0\0\0\0\4\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 56
writev(4, [{"x\0\0\0\0\0\0\0\361\22\0\0\0\0\0\0", 16}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Y\373;\0\0\0\0\0\336\242\30$\0\0\0\0"..., 104}], 2) = 120
read(4, "0\0\0\0\16\0\0\0\362\22\0\0\0\0\0\0\4\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 48
writev(4, [{" \0\0\0\0\0\0\0\362\22\0\0\0\0\0\0", 16}, {"\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0", 16}], 2) = 32
read(4, "8\0\0\0\3\0\0\0\363\22\0\0\0\0\0\0\4\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 56
writev(4, [{"x\0\0\0\0\0\0\0\363\22\0\0\0\0\0\0", 16}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Y\373;\0\0\0\0\0\336\242\30$\0\0\0\0"..., 104}], 2) = 120
read(4, "8\0\0\0\3\0\0\0\364\22\0\0\0\0\0\0\4\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 56
writev(4, [{"x\0\0\0\0\0\0\0\364\22\0\0\0\0\0\0", 16}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Y\373;\0\0\0\0\0\336\242\30$\0\0\0\0"..., 104}], 2) = 120
read(4, "@\0\0\0\22\0\0\0\365\22\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 135168) = 64
writev(4, [{"\20\0\0\0\0\0\0\0\365\22\0\0\0\0\0\0", 16}], 1) = 16
read(4, "8\0\0\0\3\0\0\0\366\22\0\0\0\0\0\0\3\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 56
writev(4, [{"x\0\0\0\0\0\0\0\366\22\0\0\0\0\0\0", 16}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\232\372;\0\0\0\0\0\0\0\2\0\0\0\0\0"..., 104}], 2) = 120
read(4, "-\0\0\0\1\0\0\0\367\22\0\0\0\0\0\0\3\0\0\0\0\0\0\0\350\3\0\0\350\3\0\0"..., 135168) = 45
pread(3, "INDX(\0\t\0h\0019\366\10\0\0\0\3\0\0\0\0\0\0\0(\0\0\0\0\10\0\0"..., 4096, 2905324924928) = 4096
pread(3, "INDX(\0\t\0\204\0051\366\10\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\250\7\0\0"..., 4096, 2778237616128) = 4096
writev(4, [{"\20\0\0\0\376\377\377\377\367\22\0\0\0\0\0\0", 16}], 1) = 16
Is there any other debugging information that might be useful?
First, thanks for dislocker, it's great to be able to read BitLocker disks on Linux!
I have a 4TB BitLocker volume that I created on Windows 10. I checksummed 1.8TB of files on this volume, and found a single file that dislocker appears to be reading incorrectly. Specifically, two 4KB blocks in the file appear to be garbled. Windows 10 reads the file correctly (tested twice on different weeks) while dislocker reads the file incorrectly (tested twice across two physical-power-off events).
I built dislocker@develop 564420c on Ubuntu 15.10 (64-bit).
With dislocker:
I booted into Windows 10 after seeing the incorrect hash
f943abbd99343db0d4e384524e8d588aand confirmed that Windows 10 still saw the correct hash61ac59d3b615cf191b22351b706d7db4.On a known-good copy of the data created on Windows 10, copying into a Linux Samba share:
(no errors)
Binary-diffing the file shows these differences, indicating that two 4KB blocks are garbled.
strace'ing the
mount.ntfs-3gprocess and then running this program to read the garbled block:shows
Is there any other debugging information that might be useful?