1

BitLocker to Go volumes are fully supported on Windows 7 and later. For compatibility with systems running Windows XP or Windows Vista, a utility called BitLocker to Go Reader (archived) is provided to enable read-only access to the volume on these older systems.

The BitLocker to Go Reader, bitlockertogo.exe, is included on encrypted volumes as an unencrypted file that is readable by older versions of Windows:

By default, BitLocker To Go Reader is stored on an un-encrypted part of removable drives that are protected with BitLocker. (Source)

However, if BitLocker is supposed to encrypt the entire volume, including filesystem metadata, how does it leave a file unencrypted and readable in this manner? Does this mean that it leaves a portion of the volume's filesystem metadata unencrypted for this purpose? (If so, how does it do this without interfering with the rest of the filesystem, and how does it ensure that the encrypted portions are not accidentally overwritten by the legacy OS?) Note that this does not work on NTFS volumes:

To use BitLocker To Go Reader on a computer that is running Windows XP or Windows Vista, your BitLocker-protected removable drive must be formatted by using the exFAT, FAT16, or FAT32 file system. If the drive is NTFS formatted, it can only be unlocked on a computer that is running Windows 7.

  • The Bitlocker To Go Reader software is an exception to "all data is encrypted" rule – albal Aug 9 '15 at 1:38
  • The question is how does it do this without interfering with the encrypted portion of the volume and while maintaining compatibility with Windows XP and Windows Vista. – bwDraco Aug 9 '15 at 1:40
  • Related info: forensicswiki.org/wiki/…, github.com/libyal/libbde/blob/master/documentation/…, jessekornblum.com/presentations/dodcc10-1.pdf -- looks like it just wraps the encrypted data in a FAT32 FS. Don't know how they prevent chkdsk/fsck from noticing and accidentally clearing the used space, though I suppose that isn't too important - this is for data privacy, not integrity. Oh, also possible: the actual partition is bigger than the FAT32 FS metadata. – Bob Aug 9 '15 at 1:50
  • Sorry if I am still missing the point/question. It Autoruns Reader on a Legacy OS or expects Reader to be installed. If neither are available then there is nothing to prevent someone formatting the partitioned but unreadable drive. – albal Aug 9 '15 at 1:55
  • Nup, checked and the wrapper FS's size matches the drive size. So they're doing something else to mark the encrypted section as 'off-limits'. @albal, the point is that there is some portion of the drive that is not encrypted and can be read by any standard FAT reader. Nothing will prevent an intentional reformat, but it will prevent an accidental one, and provides a copy of the reader without having to download one separately. – Bob Aug 9 '15 at 3:45
0

Okay, I just opened a 4 GB BitLocker-protected flash drive under Linux (openSUSE Leap 42.2) and got some interesting results.

The drive looks like any other normal FAT32 volume and contains the BitLocker to Go Reader executable, localization and AutoRun data, and a Read Me link (to a page which has since been taken down as Microsoft has since removed most non-Windows 10 help content). The rest of the drive is quite peculiar:

  • The actual encrypted volume is stored as a series of files just under 4 GiB in size (for drives larger than 4 GB) or as a single file that fills nearly the entire volume (for smaller drives). These files are named COV ####. ER, where #### is a sequence number starting from zero.
  • There are additional padding files which start with PAD, most of which are zero bytes in size. I'm not sure what the purpose of these files are. For FAT16 volumes, they would completely fill up all available root directory entries, preventing any more files from being created, but I don't quite see how this would work with FAT32 or exFAT.
  • All of these files are marked read-only, hidden, and system, preventing them from being accidentally overwritten or even read.

This directory listing should give you a better idea of what the drive actually contains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.