NAME

       Dislocker-fuse - Read/write BitLocker encrypted volumes under Linux, OSX and FreeBSD.

SYNOPSIS

       dislocker-fuse  [-hqrsv]  [-l  LOG_FILE]  [-O  OFFSET] [-V VOLUME DECRYPTMETHOD -F[N]] [--
       ARGS...]

       Where DECRYPTMETHOD = {-p[RECOVERY_PASSWORD]  |  -f  BEK_FILE  |  -u[USER_PASSWORD]  |  -k
       FVEK_FILE | -K VMK_FILE | -c}

DESCRIPTION

       Given a decryption mean, the program is used to read or write BitLocker encrypted volumes.
       Technically, the program will create a virtual NTFS partition that you can  mount  as  any
       other NTFS partition.

       The  virtual  partition is linked to the underlying BitLocker volume, so any write to this
       volume is put on the BitLocker volume as well. However, you can use dd(1) to  get  rid  of
       this  limitation  --  if it's a limitation for you. An example is provided in the EXAMPLES
       section of this man page.

OPTIONS

       Program's options are described below:

       -c, --clearkey
              decrypt volume using a clear key which is searched on the volume (default)

       -f, --bekfile BEK_FILE
              decrypt volume using the bek file (present on a USB key)

       -F, --force-block=[N]
              force use of metadata block number N (1, 2 or 3).  Without N, the  first  block  is
              forced.   Without this option, the program will try each block until a valid one is
              found

       -h     print the help and exit

       -k, --fvek FVEK_FILE
              decrypt volume using the FVEK  directly.   See  the  FVEK  FILE  section  below  to
              understand what is to be put into this FVEK_FILE

       -K, --vmk VMK_FILE
              decrypt  volume  using  the  VMK  directly.   See  the  VMK  FILE  section below to
              understand what is to be put into this VMK_FILE

       -l, --logfile LOG_FILE
              put messages into this file (stdout by default)

       -O, --offset OFFSET
              BitLocker partition offset, in bytes, in base 10 (default is 0).  Protip:  in  your
              shell,  you  probably can pass -O $((0xdeadbeef)) if you have a 16-based number and
              are too lazy to convert it in another way.

       -p, --recovery-password=[RECOVERY_PASSWORD]
              decrypt volume using the recovery password  method.   If  no  recovery-password  is
              provided,  it will be asked afterward; this has the advantage that the program will
              validate each block one by one, on the fly, as you type it  and  not  to  leak  the
              password on the commandline

       -q, --quiet
              do NOT display any information.  This option has priority on any previous `-v'. One
              probably wants to check the return value of the program when using this option

       -r, --readonly
              do not allow one to write on the BitLocker volume (read only mode)

       -s, --stateok
              do not check the volume's state, assume it's ok to mount it.  Do not  use  this  if
              you don't know what you're doing

       -u, --user-password=[USER_PASSWORD]
              decrypt  the  volume  using  the  user  password  method.   If  no user-password is
              provided, it will be asked afterward; this  has  the  advantage  not  to  leak  the
              password on the commandline

       -v, --verbosity
              increase verbosity (CRITICAL level by default), see also `-q'

       -V, --volume VOLUME
              volume to get metadata and encrypted keys from

       --     mark  the  end of program's options and the beginning of FUSE's ones (useful if you
              want to pass something like -d to FUSE)

       ARGS are any arguments you want to pass to FUSE. Note that you need to pass at  least  the
       mount-point.

FVEK FILE

       The  FVEK  file option expects a specific format from the file. The file is split into two
       major parts:
              - 2 bytes describing the encryption in use, from 0x8000 to 0x8003 for  AES  128  or
              256 bits, with or without diffuser.

              -  64  bytes  (512  bits)  which  are  the  FVEK  as in the FVEK key protector once
              decrypted.

       The file is therefore 66 bytes long, not more nor less.  Note that you may  have  to  deal
       with endianness.

EXAMPLES

       These  are  examples  you  can  run  directly.   First, you may want to copy the BitLocker
       volume:

              % dd if=/dev/sda2 of=encrypted.bitlocker

              This will copy the entire volume located  into  /dev/sda2  to  encrypted.bitlocker.
              You're  not  forced  to  do  this step, but this will ensure no write whatsoever is
              performed on the BitLocker volume.

       Then dislock it:

              % dislocker -V encrypted.bitlocker -f /path/to/usb/file.BEK -- /mnt/ntfs

              This will create a file into /mnt/ntfs named dislocker-file.

       To mount partitions once decrypted, use this sort of line:
              % mount -o loop /mnt/ntfs/dislocker-file /mnt/clear

       --

       It seems that you have to unmount the NTFS partition and the dislocker one before  halting
       the  system,  or  you  will  run into unexpected behaviour. In order to do so, you may run
       these commands (replacing your mount points):
              % umount /mnt/clear && umount /mnt/ntfs/dislocker-file

       --

       Note that these are examples and, as such, may need to be modified. For instance, you  may
       want to change the decryption method used in them.

AUTHOR

       This tool is developed by Romain Coltel on behalf of HSC (http://www.hsc.fr/)

       Feel free to send bugs report to <dislocker __AT__ hsc __DOT__ fr>