VeraCrypt, LUKS, oba BitLocker Encrypted Container eyonoonese: Okuzzaawo Omutwe gwa Embedded Backup Volume¶

Okuwandiika password yo ey’okusiba entuufu ebitundu 100 ku 100 mu a VeraCrypt ekintu ekitereka fayiro oba ekitundu, Linux LUKS (dm-crypt) volume, ekintu ekiyitibwa Windows BitLocker okuvuga, oba a Cryptomator cloud vault - okukubwa ** yokka .Operation failed due to one or more of the following: Incorrect password / Not a valid volume, ** .Device /dev/nvme0n1p3 is not a valid LUKS device, oba Windows partitioning ekubuuza "Olina okukola format ya disk mu drive D: nga tonnagikozesa" - triggers instant dread. Lwaki amasannyalaze okuvaako omulundi gumu, okuwalirizibwa okuggyamu USB, mu butanwa Quick Format / . diskpart clean, oba ekitundu kimu ekibi ku byte offset 0 okuleeta drive yonna encrypted eya terabyte 2 okugaana password entuufu? Kubanga okusiba disiki ku ddaala lya bulooka (XTS-AES-256) tekakasangako kigambo kyo butereevu ku fayiro zo: mu kifo ky’ekyo, ekigambo kyo eky’okuyingira kisumulula akatundu akatono aka Volume Header (Keyslot Area) akaterekeddwa ku ntandikwa yennyini ey’ekintu ekikwata 256-bit oba 512-bit Master Encryption Key (VMK / . Volume Master Key). Singa bytes 512 ezisooka okutuuka ku bytes 131,072 (128 KB) ya voliyumu get okuwandiikibwako okutandikawo emmeeza y'okugabanya mu butanwa oba okwonooneka olw'okuggwaamu, omutwe omukulu guweddewo. Ekirungi, bombi VeraCrypt ne BitLocker otomatika embed a complete, identical Second Backup Volume Header ku nkomerero ya volume, era singa ekyuma kyonna kikyalina (oba gye buvuddeko) volume essiddwa mu RAM, raw AES Master Key esobola okuyoolwa butereevu okuva mu kujjukira okutambula. Singa okuggala kwo mu kifo ky’ekyo kuva ku kisumuluzo ky’okuzzaawo ekya BitLocker ekya digito 48 ekyerabirwa oba TPM motherboard reset ku mutwe ogutaliiko kamogo, kyusa ku ndagiriro yaffe eya mubeezi ku BitLocker, FileVault, ne LUKS okuzzaawo ensirifu okuggalawo ekisumuluzo n'okuddamu okutereeza TPM. Singa physical drive enyiga oba egwa offline, weebuuze hard drive okulemererwa n’okuzzaawo data, oba singa mu butanwa wakola ensengeka y'ekitundu ekitali kya nsirifu, laba okusazaamu fayiro mu butanwa, drive formatted, n'okuzzaawo ebifaananyi. Singa okulemererwa kuno mu cryptographic kukosa ebikozesebwa ebikulu eby’eddwaliro, okusindika mu bwangu, oba ekikolwa eky’okuggya ssente ku bantu, kuba ku nnamba y’amangu mu kitundu kyo (911 mu Amerika ne Canada, . 112 okwetoloola omukago gwa Bulaaya, . 999 mu Bungereza) oba kebera mu ndagiriro yaffe ey’ensi yonna eya ennamba z’amangu.

Kino kikole kati¶

1. YIMIRIZA amangu ddala era TOnyiga "Format Disk," "Initialize Disk (GPT/ .MBR)," oba okudduka chkdsk / . fsck butereevu ku kyuma ekibisi ekitali kissiddwa: Windows oba macOS bw'eremererwa okutegeera ekikusike VeraCrypt, . LUKS, oba BitLocker okugabanya (kubanga emitwe gya VeraCrypt mu bugenderevu tegyawulwa ku maloboozi agatali ga bulijjo era tegirina mukono gwa magezi gwa biwandiiko bya bulijjo), OS efulumya akasengejja akagamba nti "Initialize Disk" oba "Format Drive." Okunyiga Initialize (GPT) ewandiika ku bitundu bya LBA 0 okuyita mu 33 (Bytes 0 to 17,408) ku ntandikwa ya disiki ne ekisembayo 33 sectors ku nkomerero yennyini eya disiki - okusaanyaawo zombi Primary VeraCrypt Header ne Embedded Backup Header mu kunyiga omulundi gumu.
2. Nga tonnaba kukola kintu kirala kyonna, kebera oba volume encrypted EKYALI mounted (oba oba computer eri hibernated / suspended) osobole okuggya Master Encryption Key okuva mu RAM: Singa volume header yafuna wiped ku disk nga container ekyali mounted era eggule ku computer yo (oba singa VM/hibernation file hiberfil.sys / . /dev/mem eriwo okuva lwe yali eggule), TOSUmulula, tosiba, oba okuddamu okutandika kompyuta. Koppa buli fayiro emu okuva mu drive etekeddwa amangu ddala, era dump kernel memory (dmsetup table --showkeys ku Linux LUKS, oba aeskeyfind / . Passware / . Volatility ku RAM dumps) okuggyamu live 512-bit XTS-AES Master Key.
3. Clone ekintu ekitereka fayiro ensirifu ekyonooneddwa (.hc / . .tc) oba okugabanya okw'omubiri bit-ku-bit nga okozesa ddrescue NGA tonnanyiga "Restore Volume Header": Tokyusangako ku original eyonoonese .hc fayiro oba ekitundu mu kifo. Koppa ekiwandiiko .hc fayiro ya konteyina ku ddiivu eyookubiri, oba ekifaananyi ky'ekitundu ekyonoonese (sudo ddrescue -d -r3 /dev/sdb1 /mnt/backup/encrypted_clone.img /mnt/backup/mapfile.log) era okole okuzzaawo kwonna okw'omutwe n'okugezesa okuteekebwa mu ngeri enkakali ku clone.
4. Bw'oba okozesa VeraCrypt (oba omusika TrueCrypt), ssaako akabonero ku kasanduuko akawandiikiddwako "Use backup header embedded in volume" mu nda Mount Options kati: Buli voliyumu ya VeraCrypt (zombi ebitereke bya fayiro ne voliyumu z'okugabanya/ekyuma) etereka Primary Header yaayo mu bytes 0 okutuuka ku 65,535 (ekisooka 64 KB) era ewandiika mu ngeri ey'otoma Encrypted Backup Header efaanagana mu LAST 65,536 bytes (64 KB) ku nkomerero yennyini ey’eddoboozi (oba ku offset Volume_Size - 131,072 singa ekitundu kya Hidden Volume kibaawo). Okunyiga kwokka Mount Options -> kebera "Use backup header embedded in volume" -> click OK bypass a destroyed front header era n'eteeka drive yo yonna mu seconds 3.
5. Bw'oba okozesa BitLocker ku Windows n'ekitundu ky'okutandika ekisookerwako (-BOOT-) yasazibwamu olw'okusazaamu Quick Format oba partition mu butanwa, run repair-bde okusika disiki ku 3 redundant BitLocker Metadata Headers: BitLocker teyesigamye ku mutwe gumu ku sector 0; ewandiika bisatu ebitaliiko kye bikola 64-kilobyte -FVE-FS- Full Volume Encryption Ebibumbe bya metadata ebisaasaanidde mu kitundu (Offset 1, . Offset 2, ne Offset 3). Okudduka repair-bde D: E: -pw (oba -rp 48-digit-key) ezuula mu ngeri ey’otoma ebisigaddewo -FVE-FS- metadata block wakati mu drive ne decrypts volume yonna ku rescue disk.
6. Bw'oba okozesa Linux LUKS2 (cryptsetup), sikaani megabytes 16 ezisooka ez'ekitundu ku Secondary JSON Header (SKB2) oba okuyoola LUKS bytes z'obulogo (4c 55 4b 53 ba be) singa ensalosalo y'okugabanya yakyuka: Ya mulembe LUKS2 etereka emitwe ebiri egy'enjawulo egya binary+JSON metadata: Omutwe ogusookerwako ku offset 0x0000 (LUKS\xba\xbe) ne Omutwe ogw'okubiri (SKB2\xba\xbe) ku offset 0x4000 (16,384 bytes / . 16 KB, oba okusingawo okusinziira ku kukwatagana kw’ekifo ky’ebisumuluzo). Singa sector 0 yokka yali zero, . LUKS2 esobola okuddaabirizibwa ng’okozesa omutwe ogw’okubiri.

Omuti gw'okusalawo: okuzzaawo voliyumu ya VeraCrypt, LUKS, BitLocker, oba Cryptomator eyonoonese¶

Kozesa flowchart eno entuufu ey'okukebera okulonda ekkubo ettuufu ery'okuzzaawo nga towandiika ku mitwe gya backup egisigaddewo:

flowchart TD
    Start["Volume Encrypted Egaana Password Entuufu oba Eraga 'RAW / Unformatted'."] --> StillMounted{"Encrypted Volume EKYALI Essiddwa ku Kyuma Kyonna Ekidduka (Oba Ekyuma Kyasula Hibernated Nga Kissiddwa)?"}

    StillMounted -->|"YEE: Volume Eggule oba Hibernated"| ExtractRAM["EKIKOLWA EKIKULU: Koppa Fayiro Zonna Eggule Okufuluma Amangu & Suula Ebisumuluzo bya RAM / Kernel (dmsetup table --showkeys ku Linux; Dump hiberfil.sys / RAM ku Windows)"]

    StillMounted -->|"NO: Volume Tesimbiddwa / Ekubiddwa"| CloneFirst["OMUDDAALA 1: Kola Bit-for-Bit Sector Clone ng’okozesa ddrescue (Tokwatangako ku Original Drive oba Fayiro ya .hc)"]

    CloneFirst --> Platform{"Encryption Platform Ki Eyonoonese?"}

    Platform -->|"VeraCrypt oba TrueCrypt (.hc, .tc, Ekitundu, oba Enkola Drive)"| VeraPath["1. Nywa ku 'Mount Options' -> Kebera 'Kozesa omutwe gwa backup oguteekeddwa mu volume' -> Mount Read-Only. 2. Bwe kiba nga kituuse ku buwanguzi, Dduka 'Tools -> Restore Volume Header' ku Clone. 3. Singa Ekintu Kya Fayiro Kyasalibwako, Pad Fayiro Ddayo ku Original Byte Size okusobola okulaganya End Header"]

    Platform -->|"Linux LUKS1 / LUKS2 (dm-eky’okukuuma) ."| LuksPath["1. Kebera oba Ekitundu ky’okutandika okugabanya kikyusiddwa nga kiyita mu Hex Scan ku 'LUKS\\xba\\xbe' (4c 55 4b 53 ba be). 2. Ku LUKS2, Kebera Omutwe ogw'Okubiri 'SKB2\\xba\\xbe' ku Offset 0x4000 (16KB). 3. Okuzzaawo Backup y'omutwe ogw'ebweru ng'oyita mu cryptsetup luksHeaderRestore"]

    Platform -->|"Windows BitLocker (OS Drive oba Data Drive) ."| BitPath["1. Sikaani Ekitundu ku '-FVE-FS-' Omukono gwa Metadata (3 Redundant Copies eterekeddwa ku Disk). 2. Kozesa 'repair-bde Ensibuko: TargetDrive: -rp RecoveryKey' oba Kozesa Dislocker / UFS Explorer okusengejja FVE Metadata Block esigaddewo"]

    Platform -->|"Cryptomator Ekire Vault (d/ Dayirekita + ekisumuluzo ekikulu.cryptomator)"| CryptoPath["1. Okuzzaawo masterkey.cryptomator okuva mu masterkey.cryptomator.bkup eya otomatiki oba Ebyafaayo by’enkyusa y’ekire (OneDrive/Dropbox/Google Drive Ebyafaayo bya Fayiro eby’ennaku 30). 2. Kola Cryptomator Health Check okuzzaawo Fayiro za Ciphertext ezitali za mulekwa"]

Omutendera 1: Engeri Encrypted Volume Headers gye zikolamu mu butuufu ku Disk (Byte-Offset Anatomy) .¶

Nga tonnaba kugezaako kuddaabiriza kwonna, kebera ensengeka ya byte entuufu eya VeraCrypt, . LUKS, . BitLocker, ne Cryptomator okulaba lwaki ekigambo kyo eky'okuyingira kyalemererwa ne wa omutwe gwa redundant backup we gubeera ku disiki yo:

Omutendera 2: Okudda engulu mu mitendera ku... VeraCrypt (ne Legacy TrueCrypt) .¶

1. Okuteeka amangu ddala nga okozesa Embedded Backup Volume Header¶

Bwe a VeraCrypt okugabanya oba .hc ekintu ekitereka fayiro kikubwa Windows Quick Format mu butanwa, okuwandiika ku mmeeza y'okugabanya (fdisk / . diskpart), oba sector embi ku ntandikwa ya drive, esooka 64 KB eyonoonese - naye Backup Header etudde mu nkomerero 128 KB ku nkomerero y’omuzingo gukyaliyo ebitundu 100 ku 100.

Goberera emitendera gino gyennyini oluvannyuma lw’okukola a ddrescue clone ya partition yo oba okukoppa yo .hc fayilo: 1. Ggulawo VeraCrypt, nyweza Londa Fayiro (okulonda cloned yo .hc fayiro) oba Londa Ekyuma (okulonda ekitundu kyo ekya cloned, e.g., \Device\Harddisk2\Partition1 oba /dev/sdb1), era olonde ennukuta ya drive etakozesebwa (Z:). 2. Nywa ku Mount. 3. Mu kasanduuko k'okukubaganya ebirowoozo: - Yingiza Password yo, PIM (bwe kiba kikozesebwa), ne Keyfiles (bwe kiba nga kikozesebwa). - Nyiga ku Mount Options... button wansi mu ddirisa ly'ekigambo ky'okuyingira. - Laga BOTH ku box zino: - [x] Mount volume as read-only (Eremesa Windows/macOS okukyusa ensengeka zonna ez'enkola ya fayiro eyonoonese munda mu voliyumu efulumiziddwa mu kiseera ky'okununula) - [x] Use backup header embedded in volume - Nywa ku OK okulinnya. 4. Singa eddoboozi lirinnya bulungi (oba lirinnya nga a RAW drive ebbaluwa Z: kubanga eby’omunda NTFS/ .FAT32/ .exFAT boot sector ku byte 131,072 naye yabadde nicked): - Singa Z: eggulawo bulijjo mu File Explorer: Koppa fayiro zo ebitundu 100 ku 100 off Z: okutuuka ku mmotoka evuga obulungi amangu ddala. - Singa Z: mounts mu VeraCrypt (okulaga ewandiikiddwa mu VeraCrypt slot) naye Windows egamba "Z: is not accessible / The volume does not contain a recognized file system": TOggwaamu ssuubi. Ekyo kitegeeza nti ensirifu yo eya VeraCrypt esumuluddwa ebitundu 100 ku 100, era ey'omunda yokka NTFS / . exFAT / . ext4 superblock munda mu megabytes ezisooka eza volume eya decrypted yayononeka. Kuuma volume nga essiddwa mu VeraCrypt nga Z: (oba /dev/mapper/veracrypt1 ku Linux) era odduke ** .TestDisk, ** .DMDE, ** .UFS Explorer**, oba PhotoRec butereevu ku veraCrypt virtual drive efulumiziddwa (Z: / . /dev/mapper/veracrypt1) - fayiro zo zonna eziggyiddwamu ensirifu zijja kuddizibwa mangu. 5. Okuddaabiriza enkalakkalira Primary Volume Header ku clone yo: - Fayiro zo bwe zimala okuterekebwa obulungi, osobola okutereeza enkalakkalira omutwe gw’omu maaso ogwamenyese ku clone yo ey’eddoboozi ng’onyiga Ebikozesebwa mu Volume -> Restore Volume Header -> Okuzzaawo omutwe gw’eddoboozi okuva mu backup eyingiziddwa mu volume n’oyingiza password yo.

2. Watya singa a VeraCrypt .hc File Container yasalibwako oba yakyusibwa sayizi mu kiseera ky'okukwataganya ekire oba disiki okugwa?¶

Linda: lwaki yandibadde "Use backup header embedded in volume" okulemererwa ku a .hc ekintu ekirimu fayiro? - Kubanga VeraCrypt ezuula omutwe gw'okutereka oguteekeddwamu ng'enoonya ** .Exact_File_Size - 131,072 bytes** (0x20000 bytes okuva ku nkomerero ya fayiro). - Singa kkopi ya USB etali ntuufu, . rsync okutaataaganyizibwa, oba okugwa kw'enkola ya fayiro okusalako oba okugattibwako wadde 1 byte ey'enjawulo ku nkomerero ya yo .hc fayiro ya konteyina, VeraCrypt enoonya ku byte offset enkyamu ku nkomerero ya fayiro. - Engeri y'okukebera n'okutereeza ekitali kituufu .hc ekintu ekirimu fayiro: - Buli sayizi ya fayiro ya konteyina ya VeraCrypt entuufu ETEEKEDDWA okuba omukubisa omutuufu ogwa 512 bytes. Kebera sayizi ya byte entuufu eya... .hc fayiro (ls -l container.hc oba stat -c %s container.hc). - Singa Omutwe Omukulu ku Byte 0 kikyali bwe kityo (kubanga obuli bw'enguzi bwabaddewo ku enkomerero ya fayiro mu kiseera ky'okusalako okukyusa), simply pad the .hc fayiro nga ziro ezikozesa truncate -s ku kkopi ya fayiro okutuuka ku muwendo oguddako ogwa 1,048,576 bytes (1 MB) - okugeza, singa kyali a 10 GB konteyina eyafuna okusalibwako ku 9.4 GB, okudduka truncate -s 10G container_copy.hc - era osse mu ngeri eya bulijjo ng'okozesa Primary Header mu mbeera ya Read-Only.

3. Watya singa omuntu asazaamu emmeeza y’okugabanya (fdisk / . diskpart clean) kale tomanyi sector ki VeraCrypt partition gye yatandikira?¶

Kubanga emitwe gya VeraCrypt girimu zero plaintext magic bytes, sikaani z'okugabanya eza bulijjo (TestDisk) tasobola kulaba kitundu kya VeraCrypt ekisaziddwamu we kitandikira oba we kikoma. - Engeri y'okuzuula ekitundu ekituufu ekitandikirawo eky'ekitundu kya VeraCrypt ekibuze (TestCrypt / . VeraCrypt Volume Finder): 1. Kumpi ebitundu byonna ebyatondebwawo okuva mu 2010 bikwatagana ne 1-Megabyte (1 MiB = 2,048 Ebitundu bya byte 512 = 1,048,576 bytes) ensalo (okusingira ddala okutandika ku Sector 2048 ku lw'okugabanya okusooka, oba ku kituufu 2048-sector multiple). 2. N'okusingawo: nga Primary Header ebeera ku start y'ekitundu, Backup Header ebeera mu last 128 KB ku enkomerero y'ekitundu (kumpi bulijjo ekikwatagana ddala ku nkomerero ya disiki ey'omubiri oba entandikwa y'ekitundu ekiddako.). 3. Kozesa ekintu ekiggule TestCrypt oba Python ennyimpi pyveracrypt / . cryptsetup --type tcrypt loop egezesa password yo emanyiddwa ku buli 1 MiB (2,048-sector) ensalosalo offset ku kifaananyi kya disiki (losetup -o $((offset * 1048576)) -r -f disk.img) okutuusa ng’ekigambo kyo eky’okuyingira kisumuludde VERA omutwe gw’amagezi.

Omutendera 3: Okuzzaawo Omutendera ku Mitendera ku Linux LUKS1 ne LUKS2 (dm-crypt) .¶

1. Okuzuula omuntu ayonoonese LUKS omutwe (hexdump okukebera)¶

Okutandika okuva ku Linux Live USB (SystemRescue oba Ubuntu Live), okukola a ddrescue ekifaananyi ky’ekitundu, era okebere ekisooka 32 KB wa kitundu nga tokyusizza byte emu:

sudo head -c 32768 /dev/nvme0n1p3 | hexdump -C | head -n 40

2. Okutereeza a LUKS2 okugabanya nga Sector 0 (Primary Header) yasangulwa wipefs, . mkswap, oba ekitundu ekibi¶

Bwe wipefs oba okuwandiika okutaayaaya zeroed out the first 4 KB (Offset 0x0000), . cryptsetup luksOpen ayinza okulemererwa - okujjako nga cryptsetup okuddaabiriza Omutwe Omukulu okuva ku Mutwe ogw’Okubiri ogutaliiko kamogo (SKB2) ku 0x4000: 1. Gezesa singa cryptsetup repair asobola okuddamu okuzimba Omutwe Omukulu (LUKS\xba\xbe) okuva ku Mutwe ogw’Okubiri ogutaliiko kamogo (SKB2\xba\xbe) ku ekifaananyi kyo ekya cloned:

sudo cryptsetup repair /mnt/backup/luks_clone.img

3. Okuzuula a LUKS omutwe nga emmeeza y'okugabanya (GPT/ .MBR) yasazibwamu oba yakyusibwa¶

Singa mu butanwa wasazaamu... LUKS okugabanya mu fdisk / . gparted oba okusengeka drive yonna n'emmeeza empya ey'okugabanya, the LUKS\xba\xbe omutwe gutera okuba nga gukyatudde nga tegukwatibwako ddala ku byte offset yaayo eyasooka (mu ngeri entuufu 1 MiB = byte 1,048,576, oba amangu ddala nga... EFI ne /boot ebitundu ebigabanyaamu): 1. Sika disiki yonna embisi okufuna 6-byte LUKS omukono gw'obulogo (4c 55 4b 53 ba be):

sudo LC_ALL=C grep -a -b -o $'\x4c\x55\x4b\x53\xba\xbe' /dev/nvme0n1

sudo losetup -o 1074790400 --read-only -f --show /dev/nvme0n1
sudo cryptsetup open --readonly /dev/loop0 rescued_luks
sudo mount -o ro /dev/mapper/rescued_luks /mnt/rescue

4. Okuggyamu... LUKS Ekisumuluzo Master (VMK) okuva mu nkola ya Linux ekola oba ewunyiriza¶

Singa a LUKS omutwe ku disiki gusaanyeewo ebitundu 100 ku 100 (okugeza, waliwo eyadduka dd if=/dev/zero of=/dev/nvme0n1p3 bs=1M count=20), kebera mangu oba enkola ya Linux ekyalina /dev/mapper/... okuggula: 1. Singa enkola ekyakola nga volume eriko maapu, TOddamu kutandika. Kuba ekisumuluzo ekikulu ekya hexadecimal ekibisi (VMK) butereevu okuva ku kernel dm-crypt emmeeza:

sudo dmsetup table --target crypt --showkeys

xxd -r -p master_hex.txt > master.key
sudo cryptsetup luksFormat --master-key-file master.key /mnt/backup/luks_clone.img

Omutendera 4: Okuzzaawo Omutendera ku Mutendera ku Windows BitLocker (repair-bde & -FVE-FS- Okubumba kwa metadata) .¶

Bwe a BitLocker-encrypted drive mu butanwa Quick Formatted, etandikiddwa, oba ebonaabona Sector 0 okwonooneka, Windows File Explorer eraga drive nga ** .RAW** oba ** .Unallocated**, era okuginyiga emirundi ebiri tekikyaleeta kusaba kwa BitLocker password/recovery-key.

1. Lwaki BitLocker kumpi bulijjo awona Quick Format oba Sector 0 okusiimuula¶

BitLocker bw’ekuuma ensirifu y’ekintu NTFS, . FAT32, oba exFAT volume, ekola Metadata Blocks ssatu ezifaanagana, ezeetongodde eza kilobyte 64 ku disiki, nga buli emu etandika n'omukono gwa ASCII ogwa byte 8 -FVE-FS- (2d 46 56 45 2d 46 53 2d): - Copy 1: Esangibwa okumpi n'entandikwa y'ekitundu (ebiseera ebisinga mu megabytes ebikumi ebitono ebisooka). - Copy 2 & Copy 3: Esangibwa amakumi oba ebikumi bya gigabytes munda mu kitundu. - Windows Quick Format ewandiika ku ntandikwa yennyini yokka ey'ekitundu (ekitundu ky'okutandika n'entandikwa ya... $MFT), okuleka Kopi 2 ne Kopi 3 ku -FVE-FS- BitLocker Metadata Block (erimu ekisumuluzo kyo ekya Volume Master ekikusike VMK ne Ekisumuluzo ky’okusiba eddoboozi mu bujjuvu FVEK) Ebitundu 100 ku 100 nga tebifudde.

2. Okukozesa Microsoft ezimbiddwamu repair-bde.exe ekintu okusumulula voliyumu ya BitLocker eyonoonese¶

1. Ggulawo Ekiragiro ky'Omuddukanya (cmd.exe) ku Windows 10/11 (oba okutandika okuva ku Windows Recovery USB).
2. Gatta hard drive eyokubiri ey’ebweru etaliimu kintu kyonna (E:) ennene ekimala okukwata ekitundu ekiggiddwamu.
3. Dduka repair-bde okusika ddiivu ya BitLocker eyonoonese (D:) ku muntu yenna asigaddewo -FVE-FS- metadata block era owandiike volume efulumiziddwa okuva ku E::
4. Bw'oba osumulula n'ekigambo kyo ekya digito 48 ekya BitLocker Recovery Password:

   repair-bde D: E: -rp 111111-222222-333333-444444-555555-666666-777777-888888 -LogFile C:\repair_log.txt
   

5. Bw'oba osumulula USB drive ya BitLocker-To-Go nga olina password yo ey'omukozesa:

   repair-bde D: E: -pw -LogFile C:\repair_log.txt
   

6. Umu repair-bde amaliriza okuggya ensirifu mu bitundu okutuuka E:, singa eky’omunda NTFS boot sector oba entandikwa ya $MFT yayonooneddwa Quick Format eyasooka, run DMDE, ** .UFS Explorer**, oba TestDisk ku drive kati efulumiziddwa E:.

Omutendera 5: Okudda engulu mu mitendera ku... Cryptomator Ebifo ebikuumirwamu ebire (masterkey.cryptomator) .¶

Okwawukanako ne VeraCrypt, . LUKS, ne BitLocker (ezisiba ekifaananyi kya disiki kyonna block-by-block), Cryptomator esiba fayiro ssekinnoomu munda mu nsengeka ya folda (d/XX/XXXXXXXXXXXXXXXXXXXXXXXX.c9r) eyakolebwa ku Dropbox, Google Drive, OneDrive, ne iCloud.

1. Okutereeza "Invalid Masterkey / Vault Config" oba Okubula masterkey.cryptomator¶

Buli Cryptomator vault esinziira ku fayiro bbiri entonotono eza JSON mu kikolo kya vault folder: vault.cryptomator (etereka ensengeka ya JWT vault ne cipher combo) ne masterkey.cryptomator (etereka ebibyo... scrypt-ezingiddwa 256-bit Encryption Master Key ne 256-bit HMAC Ekisumuluzo Master). - Fix 1: Okuzzaawo okuva masterkey.cryptomator.bkup: Buli lw’osumulula obulungi ekifo eky’okuterekamu Cryptomator, Cryptomator ewandiika mu ngeri ey’otoma kkopi ya backup ekakasiddwa eyitibwa masterkey.cryptomator.bkup okumpi ddala ne masterkey.cryptomator. Singa enkaayana z'okukwataganya ekire eyonoonese masterkey.cryptomator (fayiro ya zero-byte oba JSON ey'ekitundu), okukoppa kyokka masterkey.cryptomator.bkup okutuuka ku masterkey.cryptomator. - Fix 2: Kozesa Ebyafaayo by’Enkyusa ya Fayiro ez’ennaku 30 eza Cloud Provider yo: Yingira mu web interface ya Google Drive (Manage versions), Ekitanda ky'ebintu (Version history), oba OneDrive (Version history), nyweza ku ddyo masterkey.cryptomator ne vault.cryptomator, n'okuzzaawo enkyusa okuva nga obuli bw'enguzi tebunnabaawo. - Fix 3: Dukanya Cryptomator's ezimbiddwamu "Health Check" okununula bamulekwa .c9r files: Singa vault yo esumululwa n'ekigambo kyo eky'okuyingira, naye nga folders zirabika nga njereere kubanga ensobi mu cloud-sync eyonoonese a dir.c9s fayiro ya dayirekita-pointer, nyweza Vault Options -> Health Check munda mu Cryptomator. Health Check scans buli... d/XX/ subfolder for bamulekwa ensirifu .c9r fayiro ezirina omukago gwazo ogwa dayirekita omuzadde ogwamenyeka era ne guddamu okuzimba mu ngeri ey'otoma ** .Cryptomator_Recovery** folder munda mu vault yo etasiddwako kkufulu nga mulimu fayiro zo zonna ezinunuddwa.

Ennamba z’embeera ez’amangu mu bitundu n’ebiragiro by’ebitongole¶

Wadde ng’ekintu ekikubiddwa ensirifu ekyonooneddwa ku kompyuta ey’obuntu mbeera ya mangu ey’okuzzaawo amawulire ag’ekikugu, okuggala ebikwata ku bantu mu ngeri ey’ekikugu okukosa amalwaliro, ebikozesebwa mu munisipaali, okuzuula mu mateeka nga kugoberera ekiragiro kya kkooti, ​​oba ebikwata ku muntu ebifugibwa (GDPR / . HIPAA) kiyinza okwetaagisa okuloopa mu butongole ebibaddewo:

• Amerika ne Canada:
• Obulamu-Obukuumi obw'amangu / Okuvaako kw'ebizimbe Ebikulu: Kuba 911 singa okulemererwa kwa database ensirifu kukosa okulabirira omulwadde oba okufuga obukuumi bw’omubiri.
• Ekitongole ekivunaanyizibwa ku by'okwerinda ku mikutu gya yintaneeti n'ebizimbe (CISA) (United States): Singa okwonooneka kw’omutwe gwa volume kwava ku wiper esaanyaawo oba ransomware attack targeting LUKS / . BitLocker / . VeraCrypt emitwe, lipoota amangu ddala eri CISA ku 1-844-Say-CISA (1-844-729-2472) ne Ekifo kya FBI ekikola ku kwemulugunya ku bumenyi bw’amateeka ku yintaneeti (ic3.gov).
• HIPAA / Regulated Data Availability: Wansi w’ekitongole ky’ebyobulamu n’obuweereza bw’abantu mu Amerika (HHS) Ofiisi y’eddembe ly’obuntu (OCR) okulambika, okufiirwa enkalakkalira okutuuka ku mawulire g’ebyobulamu agakuumibwa mu byuma bikalimagezi agatali gakuumibwa (ePHI) olw’obuli bw’enguzi oba ransomware kyetaagisa okwekenneenya wansi w’amateeka ga HIPAA Breach & Contingency Plan (45 C.F.R. § 164.308(a)(7)).
• Obwakabaka bwa Buganda:
• Empeereza ey'amangu: Kuba 999 (oba 101 ku lipoota ya poliisi etali ya mangu).
• Ofiisi ya Kaminsona w'Amawulire (ICO) - Okumenya amateeka g’okubeerawo kwa UK GDPR: Mu nnyingo 32 n’ennyingo 33 eya UK GDPR, okufiirwa okw’olubeerera mu butanwa okw’okubeerawo kw’ebikwata ku muntu (nga voliyumu ensirifu etasobola kuzuulibwa nga tewali backup) kuteekebwa mu kibinja ky’okumenya ebikwata ku muntu era kiyinza okwetaagisa okutegeezebwa ICO (0303 123 1113) mu ssaawa 72 zokka.
• Omukago gwa Bulaaya:
• Empeereza ey'amangu: Kuba 112 mu mawanga gonna agali mu mukago gwa EU.
• ENISA & Ebitongole ebikuuma amawulire mu ggwanga (DPAs): Goberera olukiiko lwa Bulaaya olukuuma amawulire (EDPB) Endagiriro 9/2022 ku kutegeeza ku kumenya data y’omuntu ku bikwata ku kufiirwa okubeerawo ng’ebisumuluzo eby’ekyama oba emitwe gy’obuzito gisaanyeewo awatali kutereka.
• Australia ne New Zealand:
• Empeereza ey'amangu: Kuba 000 mu Australia oba 111 mu kibuga New Zealand.
• Ekifo ky'ebyokwerinda ku mikutu gya yintaneeti mu Australia (ACSC): Okuyita 1300 CYBER1 (1300 292 371) olw’obuyambi bw’ebitongole oba gavumenti mu by’okusiba ebibaddewo.
• Buyindi ne Asia-Pacific:
• Empeereza ey'amangu: Kuba 112 mu Buyindi (oba 1930 ku bikolwa eby’obumenyi bw’amateeka ku mikutu gya yintaneeti; ebibaddewo mu bitongole ebikwatibwako CERT-In endagiriro zirina okuloopebwa mu ssaawa 6 okutuuka incident@cert-in.org.in).

Ebibuuzo ebitera okubuuzibwa¶

Lwaki VeraCrypt egamba nti "Incorrect password or not a VeraCrypt volume" nga nkakasa 100% nti password yange ntuufu?¶

Olw’okuba voliyumu za VeraCrypt zikoleddwa nga tezaawulwa ku maloboozi agatali ga bulijjo (plausible deniability), VeraCrypt ekola -li tereka omutwe gw'ekiwandiiko ekitaliimu nga gugamba nti "Ndi voliyumu ya VeraCrypt." Wabula, bw’onyiga Mount, VeraCrypt etwala password yo, efuna ekisumuluzo ky’okuggya omutwe okuyita mu PBKDF2, eggyamu bytes 512 ezisooka eza voliyumu, era n'ekebera oba bytes 64. Ebikwata ku nsonga eno okutuuka ku 67 wa decrypted output spell ekigambo kya ASCII VERA (n’okuyita a CRC-32 checksum). Oba wawandiika password enkyamu oba bytes 512 ezisooka eza fayiro/ekitundu zawandiikibwako ensobi ya disiki oba ekintu ekigabanya Windows, bytes eziggyiddwamu tezijja kuwandiika VERA - kale VeraCrypt eraga obubaka bw'ensobi bwe bumu ddala ku byombi. Bulijjo gezaako okussaako ne Mount Options -> Kozesa omutwe gwa backup oguteekeddwa mu volume yasoose kukeberebwa.

Singa mu butanwa nadduka "Quick Format" ku VeraCrypt oba BitLocker drive yange mu Windows, fayiro zange zonna ziweddewo?¶

Nedda - Ebitundu 99 ku 100 ebya fayiro zo ezikubiddwa ensirifu zikyaliwo, kasita oba okomye okuwandiika ku ddiivu amangu ddala. A Eddirisa Enkola ey’amangu awandiika ekipya kyokka ekitali kya nsirifu NTFS oba exFAT boot sector ne Master File Table etaliimu kintu kyonna ($MFT) okubuna megabytes entono ezisooka ez'ekitundu. Ku a VeraCrypt nga bwe kiri ekitundu, ekyo kisangula Omutwe Omukulu ku Byte 0., . naye ereka Embedded Backup Header ku nkomerero yennyini ey'ekitundu nga tegikwatibwako ddala. Bw’omala okuteeka ekitundu kya VeraCrypt mu mbeera y’okusoma kwokka ng’okozesa omutwe gw’okutereka oguteekeddwamu (oba okudduka okuddaabiriza-bde ku a BitLocker ku nsonga eno okugabanya nga okozesa wakati/enkomerero yaayo esigaddewo -FVE-FS- metadata blocks), osobola okusika voliyumu ya virtual efulumiziddwa nayo TestDisk, . DMDE, oba UFS Omunoonyereza okuzzaawo omuti gwa folda gwonna nga oyita mu secondary $MFTMirr oba okusigala $MFT ebiwandiiko.

Akola Linux LUKS (cryptsetup) balina omutwe gw'okutereka oguteekeddwa ku nkomerero ya disiki nga VeraCrypt bw'ekola?¶

Nedda - era eno njawulo nkulu buli mukozesa wa Linux gy'alina okumanya. Omusika LUKS1 erina omutwe gumu gwokka n'ekibinja kimu eky'ebisumuluzo ku ntandikwa y'ekitundu (Zero backup headers on disk). Omulembe LUKS2 (ekisookerwako okuva Ubuntu 20.04 / RHEL 8 / Debian 10) etereka a Omutwe gwa Metadata ogwa Binary ogw’okubiri ne JSON (SKB2\xba\xbe nga bwe kiri) ku byte offset 0x4000 (16 KB) amangu ddala oluvannyuma lw’Omutwe Omukulu ku 0x0000 - ekikuwonya singa sector yokka 0. yasangulwa wipefs ezisiimuula - naye LUKS2 TEKOppa bintu bya keyslot ebikuumibwa (0x8000 okutuuka ku 16 MB) ku nkomerero ya disiki. Singa megabytes 2 ku 16 ezisooka eza a LUKS partition ziwandiikibwako era volume mu kiseera kino teggule mu RAM, engeri yokka ey'okuzzaawo drive eva mu file ey'ebweru eyatondebwa nga tennabaawo via cryptsetup luksOmutweOkutereka.

Watya singa voliyumu yange eya VeraCrypt elinnya n'omutwe gwa backup, naye Windows egamba nti "Olina okusengeka disiki mu drive Z: nga tonnagikozesa"?¶

TOYINZA ku Format. Jjukira mu kifo ky'ekyo: eky'okuba nti VeraCrypt yateeka eddoboozi okuvuga ennukuta Z: akakasa nti password yo yakkirizibwa era ne 512-bit XTS-AES Master Key kati ekola nnyo okuggya ensirifu mu drive yonna mu kiseera ekituufu. Windows yeemulugunya yokka kubanga... munda ekitundu ekisooka ekya filesystem (ekisangibwa ku byte offset 131,072 wa kitundu) era yayonoonebwa kyonna ekyayonoona omutwe gwo ogwa VeraCrypt omukulu. Leka volume nga essiddwa nga Z: mu VeraCrypt (mu mbeera ya Read-Only), ggulawo DMDE, . TestDisk, oba UFS Omunoonyereza, era olondeko essiddwako virtual drive Z: (si disiki ey’omubiri embisi.). Sofutiweya y’okuzzaawo ejja kusoma mangu fayiro zo eziggyiddwamu n’ezikoppa mu kifo ekitali kya bulabe.

Nsobola okuzzaawo voliyumu ya VeraCrypt oba LUKS singa nzijukira ebitundu 90% ku password yange (e.g., mmanyi ebigambo ebisookerwako naye neerabira obubonero oba ennamba ki ze nnawandiika ennukuta ennene)?¶

Yee, singa Volume Header (oba Backup Header) tekyuse era nga omanyi ensengeka ya password yo. Okwawukana ku kufiirwa omutwe gwa Master Key (nga guno gwe kisumuluzo kya 512-bit ekitali kigenderere ekitasobola kukakasibwa mu ngeri ya brute-force), ekigambo ky’okuyingira eky’omuntu ekijjukirwa ekitundu kiyinza okukutulwa nga tekuliiko mukutu nga tukozesa Omukutu gwa Hashcat n'etteeka ery'ennono oba okulumba masiki ku bytes z'omutwe eziggiddwamu: for VeraCrypt nga bwe kiri, ggyamu ekisooka 512 bytes wa Omutwe Omukulu (dd singa=ekintu.hc ya=vc.hash bs=512 okubala=1, oba okuggyamu bytes Enkomerero - 131072 ku mutwe gw’okutereka) n’odduka hashcat -m 13721 nga bwe kiri (ku lwa SHA-512 + AES); kubanga LUKS, ggyamu ekisooka 2 MB okutuuka ku 16 MB omutwe n’okukozesa hashcat -m 14600 nga bwe kiri (LUKS1) oba -m 29511 / 29541 (LUKS2).

Nkebera ntya oba SSD zange TRIM ekiragiro kyasaanyaawo ekintu kyange eky'ensirifu ekyonoonese?¶

Singa volume yo encrypted eba a ekintu ekirimu fayiro (.hc) . ng’otudde ku SSD ekola era mu butanwa n’osazaamu... .hc fayiro (era OS yafulumya inline TRIM), bulooka ezitagabibwa ziyinza okuba nga ziro. Naye, singa volume yo encrypted eba a raw encrypted partition oba disiki enzijuvu (`VeraCrypt` ekyuma ekikyaza, . `LUKS`, oba `BitLocker`) ., omufuzi wa SSD talina kirowoozo kyonna ku bitundu ki ebikusike "eby'obwereere" okuggyako nga filesystem mount actively sent a okusuula / . TRIM ekiragiro okuyita mu layeri y'okusiba (mu butuufu, VeraCrypt eziyiza TRIM nga bwekiba ku voliyumu ezitali za nkola olw'obukuumi bwa cryptographic, ne Linux LUKS bulooka TRIM okuyita okuggyako nga okukkiriza-okusuula yayongerwako mu bulambulukufu ku /etc/crypttab nga bwe kiri).

Ebiragiro ebikwatagana nabyo¶

• BitLocker, FileVault, ne LUKS okuzzaawo ensirifu okuggalawo ekisumuluzo n'okuddamu okutereeza TPM
• rm -rf oba Shift-Delete mu butanwa ku Linux, macOS, oba Windows: okuddamu okuteekebwa mu bwangu okusoma kwokka
• Hard drive okulemererwa n'okuzzaawo data
• Okusazaamu fayiro mu butanwa, drive formatted, n'okuzzaawo ebifaananyi
• Okuggalawo omuddukanya password, okufiirwa password ya master, n'okuzzaawo vault
• Ennamba z’amangu okusinziira ku nsi

Ensonda n’obulagirizi obutongole¶

• Ekitongole ky’eggwanga ekikola ku mutindo ne tekinologiya (NIST) (Amerika): Ekitabo eky'enjawulo 800-38E: Okuteesa ku ngeri za Block Cipher ez'okukola: The XTS-AES Omutindo gw'okukuuma ebyama ku byuma ebitereka & SP 800-111: Ekitabo ekikwata ku tekinologiya w'okusiba okutereka.
• IDRIX (veracrypt.fr): VeraCrypt Official Technical Documentation - Okulaga Ensengeka ya Volume, Ensengeka ya Byte-Offset ey'emitwe egy'okutereka egy'okusooka n'egyateekebwamu (Bytes 0-65535 vs End-131072), n’Enkola z’okuzzaawo emitwe.
• Enkoofiira Emmyufu & The cryptsetup / . LUKS Pulojekiti (gitlab.com/cryptsetup/cryptsetup): * .LUKS2 Okulaga Ensengeka ku Disiki (Ekisookerwako LUKS\xba\xbe ne Secondary SKB2\xba\xbe Enzimba y'omutwe gwa Binary/JSON ne luksHeaderBackup Ebiwandiiko (Protocols))*.
• Microsoft Yiga (learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/): BitLocker Drive Encryption Okulaba eby'ekikugu, Ebitaliiko mugaso -FVE-FS- Okukakasa Metadata, ne repair-bde Ekiwandiiko eky'Olunyiriri lw'Ekiragiro.
• Skymatic GmbH (docs.cryptomator.org): Enzimba y'obukuumi bwa Cryptomator (scrypt Okuva mu Masterkey, . masterkey.cryptomator.bkup Okudda engulu, n'okukebera obulamu bwa Vault Specification).