Add support for metadata version 3

[joachimmetz]

libbde_metadata_entry_read: FVE metadata entry:
00000000: a0 00 02 00 08 00 03 00                            ........

libbde_metadata_entry_read: entry size                                  : 160
libbde_metadata_entry_read: entry type                                  : 0x0002 (Volume master key (VMK))
libbde_metadata_entry_read: value type                                  : 0x0008 (Volume master key)
libbde_metadata_entry_read: version                                     : 3

libbde_metadata_entry_read: unsupported FVE metadata entry version.
libbde_metadata_read_entries: unable to read metadata entry.
libbde_metadata_read_block: unable to read metadata header.
libbde_volume_open_read: unable to read primary metadata block.
libbde_volume_open_file_io_handle: unable to read from file IO handle.
info_handle_open_input: unable to open input volum

[PassMark]

Do you have any information about the process required to create a Bitlocker volume with a FVE metadata version 3 header? If we could create a example volume it would help in adding support.

[joachimmetz]

I assume it is used in a recent Windows 10 BDE volume.

[PassMark]

Not so sure. We tested on Win 10 Enterprise Version 1803 (May 2018) today and still saw version 1 volumes being created. We'll try Win10 Version 1809 (Oct 2018) next. But that doesn't really make much sense as you obviously encountered a Version 3 volume back in Nov 2017, when this issue was opened.

Must be some other factor that we don't know about.

[joachimmetz]

This has surfaced again, with an image that comes from Windows 10 Pro 1803

[mirh]

I have this header by default on my Windows 8.1 tablet, which is using this
https://arstechnica.com/information-technology/2013/10/windows-8-1-includes-seamless-automatic-disk-encryption-if-your-pc-supports-it/

[joachimmetz]

Finally seen another instance of this for the VMK in a BDE volume with a clear key. No obvious format differences.

[joachimmetz]

Added version 3 support to 4b879c6, closing issue. "version" value possibly not a version.