Skip to content

BitLocker, FileVault, mpe LUKS Bokangami ya fungola ya bozongisi ya chiffrement ya disque

Mituya ya mbalakaka ekeseni na mikili. Lokasa oyo esaleli 911, nimero ya États-Unis mpe Canada. Bikólo mosusu mingi esalelaka 112, 999, to motángo mosusu. Luka nimero ya mboka na yo.

Komona écran ya bleu BitLocker Recovery na Windows, bosengi ya bokɔti FileVault oyo ekangami na macOS, to ** oyo ezali koyanola te.cryptsetup passphrase prompt** na poste ya mosala ya Linux ekoki komema mosala na yo mpe bomoi na yo moko na esika. Chiffrement ya disque mobimba (FDE) esalela ba chiffres symétriques ya grade militaire, mingi mingi AES-128 to AES-256 na mode XTS, pona ko scramble secteur nionso ya disque solide (SSD) to disque dur (HDD) na yo. Kozanga cryptographique Volume Master Key (VMK) to protecteur ya clé-encryption valide, ba données brutes na ba puces flash NAND ezali mathématiquement indistinguable na bruit aléatoire.

Kasi, écran ya clé ya récupération ya mbalakaka elakisi rarement que disque na yo ebebi to clé na yo esili libela. Mingi ya ba lockouts ya BitLocker na FileVault e déclenchamaka automatiquement tango mise à jour ya firmware ya BIOS/UEFI ya routine, changement ya dock ya Thunderbolt, toggle ya Secure Boot, to pile ya cellule ya mbongo ya CMOS ekufa ebongoli ba Registres ya Configuration ya Plateforme (PCR) na kati ya carte mère na yo Module ya plateforme ya confiance (TPM 2.0). Ata soki okomaki ata mokolo moko te fungola ya bozongisi, mbala mingi okoki koleka likambo oyo osɛngi na kozongisaka paramètre ya sikisiki ya firmware ya UEFI oyo ekangaki mesure ya TPM, to na kolukaka sauvegarde automatique ya kimia ya fungola na yo na kati ya compte Microsoft ya moto ye moko, répertoire ya Microsoft Entra ID ya mosala to ya eteyelo, porte-clé ya Apple iCloud, to kopi ya elili ya volume oyo ekangami te.

Sala boye sikoyo

  1. TELEMA liboso ya kofina "Reset this PC", "Effacer Mac", to ko formater partition. Kozongisa Windows, macOS, to Linux na nzela ya partition chiffrée ekomaka likolo ya tête ya volume cryptographique (ba blocs ya métadonnées ya BitLocker, superblock ya conteneur APFS, to tête ya LUKS2 JSON). Soki motó ya likambo wana ya moke ya ba métadonnées ekomami likolo, ata koluka lobi na yo ya bozongisi ya 48 chiffres oyo ezali na ntina, eko déchiffrer lisusu ba fichiers na yo te.
  2. Kolongola ba lecteurs USB nionso ya libanda, ba cartes SD, ba docks ya Thunderbolt, ba adaptateurs HDMI, mpe ba contrôleurs ya jeux, sima rebooter. Na ba systèmes Windows oyo esalelaka TPM 2.0 Platform Configuration Registers (concrètement PCR 0, PCR 2, PCR 4, mpe PCR 7), démarrage na USB thumb drive oyo ekoki ko démarrer, dock Thunderbolt oyo euti kokangisama na firmware Option ROM, to hub ya monitor ya libanda ekoki ko changer mesure ya hash avant démarrage. Kolongola fiche ya périphérique nionso mpe kosala reboot ya malili mbala na mbala epesaka nzela na TPM kobimisa Fungola Maître ya Volume normalement sans besoin ya code ya 48 chiffres.
  3. Tala compte nionso ya Microsoft, Apple, to ya entreprise oyo osaleli na téléphone to ordinateur portable ya mibale. Kokanisa te que oyebi compte email nini ezalaki active tango ordinateur portable e déboîté mpo na mbala ya liboso. Na Windows, vérifier account.microsoft.com/devices/recoverykey na kati ya ba comptes na yo moko ya Outlook/Hotmail/Live, mpe vérifier aka.ms/myrecoverykey na compte ya mosala nyonso, ya iniversite, to ya client Microsoft 365 (Entra ID) oyo okɔtaki naino na kati ya Microsoft Word, Ba équipes, to Paramètres ya Windows.
  4. Kokokanisa bilembo 8 ya liboso ya "ID ya fungola" oyo elakisami na écran na yo oyo ekangami. Ecran ya bozongisi ya Windows BitLocker elakisaka ID ya fungola ya bilembo 32 (to bilembo 8 ya liboso ya hexadécimal, lokola A1B2C3D4). Soki ozali na ba touches ebele oyo ebombami na compte Microsoft na yo to na ba ordinateurs ya kala, kaka mot de passe ya récupération ya 48 chiffres oyo ID ya Clé na yango ekokani na ba caractères 8 wana ya sikisiki nde ekofungola volume ya disque oyo ya sikisiki.
  5. Zongisa mbongwana nyonso ya sika ya BIOS/UEFI oyo esalemi liboso ya bokangami. Soki écran ya BitLocker ebimaki mbala moko nsima ya kokota na configuration ya BIOS mpo na kokanga Secure Boot, kobongola CSM (Module ya lisungi ya boyokani), kobongola Intel PTT / AMD fTPM, to kofungola ** Mbongwana ya Ordre ya Démarrage**, kofungola lisusu na BIOS (F2, . F12, to Del) mpe kozongisa ba toggles wana ya sikisiki na état na yango ya liboso. Soki kaka PCR 7 na PCR 0 ekokani na hash cryptographique na yango ya ebandeli, TPM ekofungola clé automatiquement.
  6. Kopesa esika ya liboso na bokengi ya nzoto soki bokangami esalemi na ntango ya mpasi ya mbalakaka to ya ndako. Soki ozali komeka kozwa mikanda ya monganga, mikanda ya mosolo, to miango ya bolongoli na ntango ya mpasi, kobosana te ete ba disque durs chiffrés ebatelaka ba données mpo na ntango oyo etyami ndelo te ntango ezali kokangama. Soki okutani na likama ya mbala moko na nzoto, tika matériel mpe benga nimero ya urgence ya esika ofandi (911 na Etats-Unis mpe Canada, 112 na Union européenne mobimba, 999 na Royaume-Uni, to tala ya biso banimero ya mbalakaka répertoire).

Kosala jamais chkdsk, fsck, to bisaleli ya kobongisa partition na volume chiffré sans ko déverrouiller yango liboso

Kosala ba utilitaires ya kobongisa disque directement contre partition brute bloquée (to kosalela logiciel ya ko changer taille ya partition ya troisième partie na volume ya BitLocker to LUKS suspendu) ekoki kobebisa moko ya ba têtes misato ya métadonnées ya BitLocker redundante to kokoma likolo ya esika ya esika ya ba clés LUKS2 ya 16 mégabytes. Soki ozali ko suspecter dégradation sous-jacente ya matériel SSD, sala toujours image forensique brute secteur par secteur (ddrescue) na disque ya libanda yambo ya komeka kobongisa motó to kozongisa bafungola.

Triage ya lockout ya chiffrement ya disque na nzete ya décision ya récupération

flowchart TD
    Start["Ekangami libanda ya disque chiffré: BitLocker, FileVault, to LUKS Prompt"] --> WhichOS{"Système d'exploitation na Moteur ya Chiffrement nini?"}

    WhichOS -->|"Windows: BitLocker Écran ya récupération ya 48 chiffres"| PeriphCheck["Etape 1: Débrancher ba lecteurs USB nionso, ba docks ya Thunderbolt, na ba monitors ya libanda; reboot ya malili"]
    PeriphCheck --> StillLocked{"Ozali kaka kosɛnga fungola ya 48 chiffres?"}
    StillLocked -->|"Te: Ezali ko démarrer Normalement"| BackupNow["Mbala moko tambuisa 'manage-bde -protectors -get C:' mpe bomba fungola ya 48 chiffres hors ligne"]
    StillLocked -->|"Ɛɛ"| BIOSCheck{"Obongoli kaka BIOS, Secure Boot, CSM, to mise à jour ya firmware?"}

    BIOSCheck -->|"Ɛɛ"| RevertBIOS["Kota na Configuration ya UEFI: Ko activer lisusu Secure Boot, Mode ya démarrage UEFI, na Intel PTT / AMD fTPM pona kozongisa hash ya PCR 7"]
    BIOSCheck -->|"Te"| HuntKey["Etape 2: Kokokanisa ID ya fungola ya 8-Char na kati ya ba Comptes NIOSO ya Microsoft ya Moto ye moko, ID ya Entra ya Mosala/Eteyelo, Active Directory, mpe ba fichiers USB .BEK/.TXT"]
    RevertBIOS --> HuntKey

    WhichOS -->|"macOS: Bokɔti ya FileVault eboyi mot ya nzela"| ApplePath{"Mac ya Apple Silicon/T2 vs Mac ya Intel?"}
    ApplePath -->|"Ba Mac nionso"| TestLayout["Etape 1: Vérifier Menu d'entrée na likolo-na droite ya écran FileVault pona mismatch ya layout ya clavier"]
    TestLayout --> FVMethod{"Méthode Nini ya Récupération Ezalaki Activé?"}
    FVMethod -->|"Escrow ya Compte ya iCloud"| BootRecovery["Boot to macOS Recovery: Authentifier na Compte Apple na nzela ya Recovery Assistant mpo na kozongisa mot de passe"]
    FVMethod -->|"24-Char Fungola ya kozongisama ya moto ye moko (PRK) to MDM"| EnterPRK["Tyá fungola XXXX-XXXX-XXXX-XXXX-XXXX-XXXX na Mosungi ya Bozongisi to senga Fungola ya Escrow Institutionnel epai na IT"]

    WhichOS -->|"Linux: LUKS / cryptsetup Moloba ya nzela eboyami"| LUKSPath["Etape 1: Kokita na shell ya initramfs to ko démarrer Live USB; vérifier layout ya clavier na console"]
    LUKSPath --> LUKSHeader{"Ba Keyslots Ezali Intact na 'cryptsetup luksDump'?"}
    LUKSHeader -->|"Oui: Keyslot Ezali kosala"| TestPass["Meka ba keyslots secondaires (Slot 1-7), jeton FIDO2/TPM2, to tambuisa hashcat Mode 29500 contre sauvegarde ya tête"]
    LUKSHeader -->|"Te: Motó ya likambo ebebi"| RestoreHeader["Zongisa motó ya LUKS uta na '--header-backup-file' to disque ya scanner mpo na ba métadonnées oyo etikali"]

Kososola Encryption ya Disque mobimba mpe bokangami ya TPM 2.0

Ezala Windows BitLocker, Apple FileVault 2, to Linux te dm-crypt / LUKS e chiffrer SSD na yo directement na mot de passe ya login na yo to clé ya récupération. Na esika na yango, ba plateformes nionso misato esalelaka hiérarchie ya ba clés ya deux niveaux:

  1. Clé Maître de Volume (VMK) / Clé ya Encryption ya Volume mobimba (FVEK): Clé ya matériel aléatoire (128-bit, 256-bit, to 512-bit) e chiffrer mpe e déchiffrer ba secteurs ya disque ya solo na vol.
  2. Ba Protecteurs ya ba clés / ba clés (KEKs): Fungola ya Maître ya Volume ezingami na kosalelaka Ba clés ya chiffrement ya ba clés (KEKs) oyo ezali indépendant, oyo babengaka Ba Protecteurs ya ba clés na BitLocker, Bags ya ba clés na Apple APFS, mpe Baslots ya clé na Linux LUKS.
  3. Mpo na nini kokangama ya TPM 2.0 ekanga yo libanda na Windows: Na Windows 10 mpe 11, mobateli ya liboso ya bafungola ezali puce Module plateforme ya kotyela motema (TPM 2.0) (silicium to firmware discret Intel PTT / AMD fTPM). Tango BitLocker ekangaki Fungola Maître ya Volume na TPM, ekangisaka fungola na Ba registres ya configuration ya plateforme (PCR) ya sikisiki:
  4. PCR 0: Ezali kosala hashes ya firmware ya système UEFI/BIOS ya moboko.
  5. PCR 2: Ezali kosala hashes na matériel ya libanda oyo ekoki ko brancher Code ROM ya Option (ba docks ya Thunderbolt, ba cartes RAID, ba GPUs ya libanda).
  6. PCR 4: Ezali kosala hash na mokambi ya bobandi (bootmgfw.efi) mpe état ya ordre ya démarrage.
  7. PCR 7: Ezali kosala hashes na politiki ya Secure Boot mpe UEFI db / . dbx ba bases de données ya certificat.
  8. PCR 11: Ezali kosala hashes na ba composants ya contrôle d'accès ya BitLocker.

Tango nionso ofini bouton ya puissance, carte mère emekaka ba composants ya firmware wana avant Windows e charger. Soki bit moko na PCR 0, PCR 2, PCR 4, to PCR 7 ekeseni na motuya oyo ekomamaki ntango BitLocker ekangamaki, TPM eboyi kobimisa Fungola Maître ya Volume mpe etindi na makasi Windows Boot Manager kolakisa écran ya 48-chiffres BitLocker Recovery Key.

Comparaison ya ba architectures ya Encryption ya Disque Complète na ba mécanismes ya récupération

Attribut technique ya makambo BitLocker ya Windows (fvevol.sys) . macOS FileVault 2 (APFS + Enclave ya libateli) . Linux LUKS1 / LUKS2 (dm-crypt / . cryptsetup) .
Chiffre & Mode ya liboso AES-128-XTS to AES-256-XTS (AES-CBC na ba disque Windows ⅞ ya kala) AES-128-XTS (e accéléré par matériel na nzela ya moteur Apple Silicon AES / T2) AES-256-XTS ( Ezali ndenge moko na .aes-xts-plain64, 512-bit bonene ya fungola ya malamu)
Anchor ya matériel TPM 2.0 (PTT Intel / fTPM AMD / TPM SPI/LPC ya bokeseni) Puce ya Sécurité Apple T2 to Processeur Enclave Secure ya Silicon Apple (SEP) . Na bolingi na yo systemd-cryptenroll na TPM 2.0, FIDO2 YubiKey, to PKCS#11
Format ya clé ya récupération 48 chiffres na bituluku mwambe ya mituya ya 6 chiffres (123456-123456-...) . Bilembo 24 ya alfabe na banimero na bituluku motoba ya bilembo 4 (XXXX-XXXX-...) . Jusqu'à 8 Keyslots indépendants (LUKS1) to 32 Keyslots (LUKS2)
Escrow automatique ya lipata Compte Microsoft ya moto ye moko (account.microsoft.com), ID ya Entra, to Annuaire Active on-prem Optional Compte Apple (iCloud) jeton ya récupération to Escrow institutionnel ya MDM Moko te na ndenge ya libela (Ba déploiements ya entreprise ekoki kosalela Red Hat Tang/Clevis to Vault)
Esika ya motó ya likambo oyo ezali na disque Ba copies misato ya ba métadonnées redundantes na kati ya partition (plus secteur ya démarrage ya volume) . Ebombami na ba structures ya APFS Container Superblock na Volume Key Bag Ya liboso 2 MB (LUKS1) to 16 MB (LUKS2) na ebandeli ya sikisiki ya dispositif ya bloc
Limite ya taux ya matériel Ba tentatives sans limite pona clé ya 48 chiffres (\(2^{128}\) entropie ekomisaka brute-force impossible) Esalemi makasi na silicium na Secure Enclave (kobakisa ba retards tii na effacement/lockout) Moko te na logiciel, etambwisami na Argon2id / PBKDF2 coût ya iterations mémoire-hard

Eteni 1: Kosilisa ba lockouts ya récupération ya Windows BitLocker

Ntango PC na yo ya Windows etelemi na "BitLocker: Tyá fungola ya bozongisi mpo na disque oyo" (to Windows Recovery Environment esɛngi fungola liboso ya kopesa nzela na kokɔta na Command Prompt to Mode ya libateli), salá na nzela ya banzela oyo mibale oyo ezali parallèle: Track A emekaka kotinda TPM efungola disque kozanga ete ezala na mposa ya fungola, mpe Track B elukaka fungola ya 48 chiffres na kati ya nyonso esika ya kobomba biloko ya nimero mpe ya mboka.

Track A: Ko contourner prompt ya BitLocker sans clé ya récupération (Kozongisa état ya PCR TPM)

Soki o effacer TPM na maboko te to o déplacer SSD ya NVMe na carte mère ya sika, Fungola Maître Volume ezali kaka na kati ya puce na yo ya TPM 2.0. Ezali koboya ko débloquer mpo mesure ya PCR avant démarrage ebongwanaki. Meka ba restauration oyo ya matériel na firmware oyo ebebisaka te na ordre:

  1. Kokata ba matériels nionso ya libanda na ba docks:
  2. Boma ordinateur mobimba (simbá bouton ya kofungola na boumeli ya segɔnde 10).
  3. Débranche chaque flash USB, disque dur externo, hub USB-C, station de docking Thunderbolt, carte SD, e câble monitor externo.
  4. Longola chargeur AC na boumeli ya segɔnde 15, tyá chargeur natif directement na ordinateur portable, mpe fungola yango. Ba docks ya Thunderbolt na ba hubs USB-C ezalaka mingi mingi na ba ROM ya démarrage to affichage ya réseau PXE ya kati oyo ezo extend na PCR 2 na PCR 4, ezo invalider état ya TPM.
  5. Kozongisa Secure Boot na Mode ya Démarrage UEFI na Configuration ya BIOS:
  6. Reboot mpe finá touche BIOS ya carte mère na yo (F2 na Dell/ASUS/Lenovo/Acer, F10 na HP, . Del na ba tableaux ya bureau).
  7. Soki Secure Boot ebongwani kala mingi te uta Enabled na Disabled, zongisa yango na Enabled (Mode standard) mpe bomba mbongwana. Contrairement, soki mise à jour ya BIOS ebalusaki Secure Boot na Enabled, meka ko toggler yango na Disabled mbala moko.
  8. Confirmer Mode ya démarrage etiamaki na UEFI Kaka (ko désactiver Legacy / CSM) mpe confirmer Windows Boot Manager ezali option ya démarrage ya liboso.
  9. Verifier Intel PTT to AMD fTPM ezali activé (Ko finga jamais "Effacer TPM"):
  10. Nsima ya pile CMOS oyo ekufá to kozongisama ya BIOS, ntango mosusu ba cartes mères e désactiver TPM ya firmware (Intel Platform Trust Technology to mpe AMD CPU fTPM). Kende na onglet Security to Trusted Computing na BIOS mpe confirmer TPM 2.0 State ezali Enabled.
  11. Kebisa: Kopona ata moke te "Effacer TPM" to "Effacer fTPM NV" na kati ya BIOS. Kolongola TPM ebebisaka libela Fungola ya misisa ya bobateli ya kati na kati ya puce ya silicium, kosala ete fungola ya bozongisi ya 48 chiffres ezala obligatoire.
  12. Kozongisa sima mise à jour ya capsule ya BIOS oyo ezali na buggy:
  13. Na ba ordinateurs portables ya Dell, simba ** .Ctrl + Esc** tango ozali ko brancher puissance AC pona ko lancer menu Dell BIOS Recovery pe pona Rollback BIOS. Na ba ordinateurs portables HP, simba ** .Win + B** tango ozali kofina bouton ya puissance pendant 2 secondes pona ko déclencher HP Sure Start BIOS rollback.

Track B: Boluki ya mobimba mpo na Fungola na yo ya kozongisa BitLocker ya 48 chiffres

Soki TPM ekoki kozongisama te (to soki okɔtisi SSD na kati ya boîtier USB ya libanda), osengeli kopesa mot de passe ya récupération numérique ya 48 chiffres (XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX) to a .BEK fisyé ya fungola ya kobanda. Kokoma ba caractères 8 ya liboso ya ID ya Fungola oyo elakisami na écran (ndakisa, Key ID: 4F8A9C12) mpe talá bisika motoba oyo:

1. Ba comptes ya Microsoft ya moto ye moko (account.microsoft.com/devices/recoverykey) .

Kotala ** .https://account.microsoft.com/devices/recoverykey** (to https://aka.ms/myrecoverykey) na telefone to na ordinatɛrɛ ya mibale. - Vérifier compte historique nionso: Encryption ya dispositif ezo sala sauvegarde ya clé ya Compte Microsoft oyo esalelamaki mpo na mbala ya liboso tango PC elongolamaki na boîte, ata soki na sima o changer na login local. Kota pe meka nionso ya kala @hotmail.com, . @live.com, . @outlook.com, to oyo ezali na boyokani @gmail.com ba comptes, bakisa compte ya molongani, moboti, to technicien nyonso oyo asalisaki na kosala PC to akoti na Microsoft Office to Xbox Game Pass na machine wana.

2. Mosala, Eteyelo, to Iniversite Entra ID / Azure AD (myaccount.microsoft.com) .

Ata na ordinateur portable ya ndako ya moto ye moko, soki okoti naino na ba applis Microsoft 365 (Word, Excel, Teams) na adresse email ya mosala, ya université, to ya client mpe otiki "Tika ebongiseli na ngai etambwisa aparɛyi na ngai" etiamaki elembo, Windows e escrow automatiquement clé na yo ya récupération ya BitLocker na locataire ya Microsoft Entra ID ya organisation wana: 1. Kotala ** .https://myaccount.microsoft.com/device-list** mpe kota na email na yo ya mosala to ya eteyelo. 2. Pona kombo ya ordinateur na yo pe finá Tala ba touches ya BitLocker. 3. Soki compte na yo ya mosala to ya eteyelo esi ekangami, benga Biro ya lisalisi ya IT ya ebongiseli wana mpe pesa bango ID ya Fungola na yo ya bilembo 8. Ba administrateurs bakoki kozua ba clés pona ba comptes désactivés na se ya Apareyi > Ba appareils nionso > Ba touches ya récupération na entra.microsoft.com.

3. Annuaire active ya entreprise na esika (msFVE-RecoveryInformation) .

Soki ordinateur esanganaki na domaine ya Active Directory, Administrateur ya Domaine akoki koluka fungola na ID na ye ya Fungola ya bilembo 8 na kosalelaka PowerShell: 

Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -Properties msFVE-RecoveryPassword, whenCreated |
  Where-Object { $_.Name -like "*4F8A9C12*" } | Select-Object Name, msFVE-RecoveryPassword, whenCreated

4. Ba Fichiers Texte Automatiques to Manuels na ba Flash Drives USB na ba Cloud Drives

Ntango Windows ebombi fungola ya kozongisa na fisyé to na disque USB, epesaka nkombo ya fisyé BitLocker Recovery Key [GUID].txt to ebikisaka oyo ebombami .BEK fisyé (attrib +h +s). Tambwisa boluki oyo ya PowerShell na kati ya ba lecteurs USB nionso, ba disques durs ya libanda, ba dossiers OneDrive, Google Drive, mpe Dropbox na PC mosusu: 

Get-PSDrive -PSProvider FileSystem | ForEach-Object {
    Get-ChildItem -Path $_.Root -Include "*BitLocker*Recovery*Key*.txt", "*.bek" -Recurse -Force -ErrorAction SilentlyContinue
} | Select-Object FullName, LastWriteTime

5. Kobimisa Fungola mpo na Lecteur ya ba données secondaires (D:) uta na Unlocked moko C: Bokabwani ya biloko

Soki C: bottes normalement mpe kaka disque secondaire D: ekangami, fungola fenêtre ya Administrateur PowerShell na C: mpe kokima mbangu manage-bde -protectors -get D: mpo na komona soki C: esimbaka kaka clé ya registre ya ko déverrouillage automatique, to inspecter ba Copies ya Ombre ya Volume ya kala ya yo Documents dossier mpo na effacé BitLocker Recovery Key *.txt ba fichiers.

6. Imprimer Histoire ya Spooler mpe ba impressions PDF / OneNote

Soki o cliqué "Imprimer clé ya récupération" na tango ya configuration, tala Microsoft OneNote mpe luka ya yo Documents dossier mpo na .pdf to mpe .xps ba fichiers oyo esalemi na nzela ya "Microsoft Print to PDF".

Track C: Kofungola mpe ko déchiffrer disque BitLocker na WinRE Command Prompt (manage-bde) .

Soki kokoma mot de passe ya récupération ya 48 chiffres na écran bleu ezo boucle lisusu na BitLocker na reboot oyo elandi to ezo crasher Windows, débloquer pe suspendre BitLocker na Windows Recovery Environment (WinRE) Command Prompt:

  1. Press Esc na écran ya BitLocker, sima finá Skip this drive -> Troubleshoot -> Options avancées -> Command Prompt.
  2. Tala ezalela mpe kofungola volume ya OS (C:): 
    manage-bde -status
manage-bde -unlock C: -RecoveryPassword 123456-123456-123456-123456-123456-123456-123456-123456
    (To kofungola na kosalelaka binaire .BEK fichier na stick USB oyo esalemi na carte lokola F: via manage-bde -unlock C: -RecoveryKey "F:\key.BEK"). ) .*
  3. Suspendre ba protecteurs po prompt ezongi te na reboot oyo ekolanda: 
    manage-bde -protectors -disable C:
    Rebooter na Windows, sima tambuisa manage-bde -protectors -enable C: na Command Prompt oyo etombolami mpo na kokanga lisusu Fungola Maître ya Volume contre ba hashes ya sika ya UEFI PCR.
  4. Soki Windows ekoki ko démarrer te, copier ba fichiers to déchiffrer mobimba: 
    robocopy C:\Users\YourUsername F:\RescueBackup /E /ZB /R:1 /W:1 /XJ
manage-bde -off C:

Track D: Kotia SSD ya BitLocker na Linux (dislocker / . cryptsetup) mpo na kobikisa ba fichiers

Soki carte mère na yo ya Windows ekufi, tia M.2 NVMe to SATA SSD na kati ya boîtier USB-C ya libanda (oyo ezali na mesure ya soki 10 centimètres na 3 centimètres, to 4 pouces na 1,2 pouces) mpe débloquer yango na PC Linux nionso to Ubuntu Live USB:

# Method 1: Modern cryptsetup (v2.3+ natively supports BITLOCKER volumes)
sudo cryptsetup open --type bitlocker /dev/nvme0n1p3 bitlocker_unlocked
# Type the 48-digit recovery key INCLUDING hyphens when prompted
sudo mkdir -p /mnt/windows_data
sudo mount -t ntfs3 -o ro /dev/mapper/bitlocker_unlocked /mnt/windows_data

# Method 2: Using dislocker
sudo apt update && sudo apt install -y dislocker ntfs-3g
sudo mkdir -p /mnt/dislocker_raw /mnt/windows_rescue
sudo dislocker -V /dev/nvme0n1p3 -p123456-123456-123456-123456-123456-123456-123456-123456 -- /mnt/dislocker_raw
sudo mount -t ntfs-3g -o loop,ro /mnt/dislocker_raw/dislocker-file /mnt/windows_rescue

Eteni ya 2: Kosilisa ba lockouts ya Apple macOS FileVault 2 mpe Secure Enclave

Na macOS (High Sierra na nzela ya macOS Sequoia mpe ya sika), FileVault 2 e chiffrer volume mobimba ya APFS (Apple File System). Na Macs oyo ezali na Apple Silicon (M1, M2, M3, M4) to Apple T2 Security Chip, volume ezali vraiment ntango nionso chiffré na repos na nzela ya ba clés matérielles na kati ya Secure Enclave Processor (SEP). Kofungola FileVault ekozinga matériel wana Fungola ya Encryption ya Volume (VEK) na Clé ya Chiffrement ya Clé (KEK) oyo euti na mot de passe na yo ya bokɔti na macOS mpe Fungola na yo ya Bozongisi ya FileVault.

Lokola FileVault esengaka ko déchiffrer volume ya APFS avant macOS e charger na disque, écran ya liboso oyo omoni tango okofungola Mac oyo ezali activé na FileVault ezali fenêtre ya login ya macOS normal te, ezali écran ya déverrouillage ya FileVault EFI / iBoot avant démarrage.

Etape 1: Bolongola ntina #1 ya ba lockouts ya mbalakaka ya FileVault (Pre-boot layout ya clavier & claviers ya libanda)

Yambo ya kokanisa ete mot de passe na yo ebukani to kobanda kozongisa, tala ba quirks misato oyo ya liboso ya démarrage oyo esalaka ete ba mots de passe ya malamu eningana mpe eboya na écran ya démarrage ya FileVault:

  1. Commutateur ya menu ya entrée ya clavier avant démarrage: Écran ya FileVault avant démarrage esalela pilote ya clavier ya firmware oyo elongolami oyo mbala mingi ezalaka par défaut na U.S. QWERTY (to ABC) ata soki okoma mot de passe na yo na kosalelaka layout ya UK, Allemand (QWERTZ), Français (AZERTY), to Dvorak na kati ya macOS. Tala na coin ya likolo na loboko ya mobali ya écran ya bokɔti ya FileVault, finá na Icône ya menu Entrée ya clavier, mpe pona layout ya clavier na yo ya sikisiki.
  2. Bluetooth Keyboard Timing & Num Lock: Ba claviers Bluetooth ya troisième partie mbala mingi ebwakaka ba touches mibale ya liboso tango ezali kolamuka na écran avant démarrage, to ezangi ba indicateurs ya état Num Lock. Branchez clavier USB fil directement na Mac (to salela clavier MacBook oyo ezali na kati) mpe koma malembe.
  3. Ba usagers ya Admin ebele na Mac moko: Na FileVault, compte moko na moko ya mosaleli ya macOS oyo epesami ndingisa ezali na jeton cryptographique indépendant na yango na Sac ya ba clés ya APFS (diskutil apfs listCryptoUsers /). Soki compte na yo eningani mpe elongi te, finá ** elembo mosusu ya mosaleli ya Administrateur** na écran FileVault mpe kota na mot de passe na bango. Soki okoti na kati ya macOS, admin wana akoki ko réinitialiser mot de passe na yo na Paramètres ya système > Utilisateurs & Groupes.

Etape 2: Kofungola FileVault na nzela ya Compte Apple (iCloud) to Clé ya Récupération personnelle ya 24 caractères

Soki mot de passe na yo elongi kaka te na écran ya bokɔti ya FileVault:

  1. Zela Prompt ya Récupération: Nsima ya kokoma mot de passe ya mabe mbala misato na écran ya login ya FileVault, macOS elakisaka ba options ya ko réinitialiser na nzela ya Compte Apple na yo to kokotisa Clé na yo ya Récupération.
  2. To ko démarrer directement na macOS Recovery (Recovery Assistant):
  3. Apple Silicon Macs (M1/M2/M3/M4): Kanga mobimba, sima finá mpe simbá bouton Power (Touch ID) na boumeli ya 10 secondes kino "Loading startup options..." ekobima, finá Options, mpe finá Koba.
  4. Intel Macs: Fungola Mac mpe simbá Command (⌘) + R kino logo ya Apple ekobima.
  5. Na kati ya... Reset Password Fenêtre ya Assistant ya récupération:
  6. Connecter na Wi-Fi na coin ya likolo na droite ya écran to brancher na Ethernet.
  7. Option A (Apple Account Escrow): Soki o activer récupération ya iCloud, pona Obosani ba mots de passe nionso? -> Kota na Compte Apple. Tyá email ya Compte Apple na yo, mot de passe, mpe code 2FA ya 6 chiffres (soki obungisi telefone na yo, tala ya biso... MFA lockout and authenticator recovery guide) mpo na kofungola volume ya APFS mpe kotya mot de passe ya sika.
  8. Option B (Fulé ya récupération personnelle ya 24 caractères): Pona Kotisa Fungola ya récupération ya FileVault mpe koma code na yo ya alphanumérique ya 24 caractères (XXXX-XXXX-XXXX-XXXX-XXXX-XXXX).
  9. Option C (Corporate / University MDM Escrow): Soki Mac na yo ezali kokambama na nzela ya Jamf Pro, Kandji, Mosyle, to Microsoft Intune, benga Bureau na yo ya lisalisi ya IT na nimero ya série ya Mac na yo mpo ete bakoka kotanga yo Fungola ya bozongisi ya FileVault ya bilembo 24 oyo ekangami na escrow.

Etape 3: Kofungola volume ya FileVault APFS na maboko uta na Terminal (diskutil apfs unlockVolume) .

Soki Assistant ya Récupération graphique elongi te ko monter disque na yo, fungola Utilities -> Terminal na kati ya macOS Recovery mpe débloquer volume ya APFS manuellement:

# 1. List all APFS containers and encrypted volumes to find the Volume Identifier (e.g., disk3s5)
diskutil apfs list

# 2. List all cryptographic users (UUIDs) authorized to unlock that APFS volume
diskutil apfs listCryptoUsers /dev/disk3s5

# 3. Unlock the APFS volume using either your user password OR your 24-character Recovery Key:
diskutil apfs unlockVolume /dev/disk3s5 -passphrase "YOUR-XXXX-XXXX-XXXX-XXXX-XXXX-KEY"

# 4. Copy critical files from '/Volumes/Macintosh HD - Data' to an external USB drive:
cp -Rv "/Volumes/Macintosh HD - Data/Users/yourusername/Documents" "/Volumes/ExternalUSB/Backup/"

Apple Silicon mpe T2 Macs ekoki te kozala na ba SSD na yango oyo elongolami mpe etangama na ba boîtiers ya libanda

Na bokeseni na ba PC Windows standard, Apple Silicon Macs (M1/M2/M3/M4) mpe T2 Intel Macs ekangisaka ba clés ya chiffrement matériel APFS na kati ya Processeur Secure Enclave soudé na carte logique. Soki carte logique MacBook elongi te kofungola, mema yango na magasin spécialisé ya réparation ya composants ya carte logique mpo na kobongisa rail ya puissance na carte original na yo au lieu ya ko remplacer carte logique (oyo e effacer libela ba données nionso).

Eteni ya 3: Kosilisa Linux LUKS (dm-crypt / . cryptsetup) ba lockouts ya encryption

Ba distributions ya Linux (Ubuntu, Fedora, Debian, Arch Linux, Red Hat Enterprise Linux, Pop._OS, mpe Qubes OS) etie motema na LUKS (Linux Unified Key Setup), mingi mingi LUKS2, oyo ekambami na cryptsetup mpe dm-crypt. Tango machine Linux ekweyi na kati ya (initramfs) to mpe dracut shell koloba ** .cryptsetup failed, bad password or options**, landá makambo minei oyo:

Etape 1: Vérifier carte clé ya console vs layout graphique ya clavier

Na tango ya pré-boot initramfs phase, système esalelaka carte clé ya console Linux (/etc/vconsole.conf), oyo mbala mingi ezalaka na ** .us** ata soki o configurer layout ya programmeur ya UK, Allemand, Français, to personnalisé na kati ya GNOME to KDE. Démarrer Linux Live USB, fungola terminal graphique esika okoki ko koma phrase na yo na ndenge ya komonana na éditeur ya texte pona ko vérifier caractère nionso, pe débloquer disque na Live USB: 

lsblk -f
sudo cryptsetup luksOpen /dev/nvme0n1p3 my_encrypted_root

Etape 2: Tala motó ya likambo ya LUKS mpe talá bisika ya bafungola ya mibale (cryptsetup luksDump) .

LUKS1 esimbaka ba Keyslots 8 indépendants (0 à 7) mpe LUKS2 esimbaka tii na 32 Keyslots (0 à 31), bakisa matériel Tokens (systemd-tpm2 to mpe systemd-fido2). Tala motó na yo kozanga kobongola eloko moko na disque:

sudo cryptsetup luksDump /dev/nvme0n1p3
1. Ezali kolakisa LUKS header information na UUID mpe ba Keyslots oyo ezali na ntina? Soki ɛɛ, motó ya likambo na yo ya LUKS ezali intacte mpe ba données na yo ekoki kozongisama nokinoki soki bapesameli fraze ya nzela nyonso ya keyslot oyo ezali kosala. 2. Ezali ba Keyslots ebele oyo efungolami (Keyslot 0, . Keyslot 1)? Ba administrateurs mingi mpe ba installateurs ya entreprise bakomisaka frase de passe ya récupération secondaire to fichier clé na Keyslot 1. Ata soki obosani fraze de passe na yo ya liboso na Keyslot 0, phrase na yo ya fallback na Keyslot 1 ekofungola volume mbala moko. 3. Soki TPM2 auto-déverrouillage ebukani (systemd-cryptenroll --tpm2-device=auto): Tango mise à jour ya noyau to ya BIOS ebukani auto-déverrouillage ya TPM2 PCR 7, débloquer na fraze ya passe na yo ya Keyslot 0 mpe zongela kokomisa jeton ya TPM: 
sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 /dev/nvme0n1p3

Etape 3: Kozonga sima na motó ya LUKS2 oyo ebebi to oyo ekomami likolo

Na LUKS, ba keyslots nionso efandaka na 2 mégabytes (LUKS1) to 16 mégabytes (LUKS2) ya liboso ya partition. Soki cryptsetup luksDump alobi ** .not a valid LUKS device**, sala ba étapes oyo:

  1. Image ya 32 MB ya liboso avant osimba eloko moko: 
    sudo dd if=/dev/nvme0n1p3 of=~/damaged_luks_first32mb.img bs=1M count=32 status=progress
  2. Meka kobongisa ba métadonnées ya JSON secondaire ya LUKS2 automatique (cryptsetup repair):
  3. LUKS2 ebombaka ba copies redundantes mibale ya ba métadonnées binaire na tête JSON na offset 0x0000 mpe kosala offset 0x4000 (16 KB) (16 KB). Soki kaka copie primaire na byte 0 nde clobbered, . sudo cryptsetup repair /dev/nvme0n1p3 etongaka yango lisusu uta 0x4000.
  4. Zongisa uta na Sauvegarde ya motó ya LUKS oyo ebombami (luksHeaderRestore):
  5. Débloquer non-destructivement na nzela ya fichier ya sauvegarde ya tête ya libanda: 
    sudo cryptsetup luksOpen --header /path/to/luks-header.bak /dev/nvme0n1p3 rescued_volume

Etape 4: Komeka ba frazes de passe oyo bakanisaki ndambo na hashcat

Atako okoki te brute-force ya kozanga kokana na 48 chiffres BitLocker Recovery Key to 24-caracters Apple Recovery Key (\(2^{128}\) bits ya entropie), okoki koki komeka ba variations ya LUKS oyo moto aponaki to mot de passe ya mosaleli ya BitLocker personnalisé soki omikundoli maloba ya moboko:

# For Linux LUKS2 (mode 29500) or LUKS1 (mode 14600):
sudo dd if=/dev/nvme0n1p3 of=luks_header.bin bs=1M count=16
hashcat -m 29500 luks_header.bin my_candidate_words.txt -r /usr/share/hashcat/rules/best64.rule

# For BitLocker protected by a custom User Password (mode 22100):
bitlocker2john -i /dev/nvme0n1p3 | grep "\$bitlocker\$0\$" > user_pass.hash
hashcat -m 22100 user_pass.hash my_candidate_words.txt -r /usr/share/hashcat/rules/best64.rule

Kopekisa: Ndenge ya kotonga sauvegarde ya encryption ya disque oyo ekoki kokangama te sikoyo

Moment oyo ozongeli accès na ordinateur na yo (to na ordinateur nionso mosusu oyo ozali na yango lelo), lekisa minutes mitano na ko exécuter ba commandes oyo po panne ya carte mère to mise à jour ya firmware ekoki ko traper lisusu ba fichiers na yo te:

1. Na Windows (Exporter clé ya récupération ya BitLocker na yo & pause avant ba mises à jour ya BIOS)

Fungola Administrator PowerShell to Command Prompt mpe bimisá mot de passe na yo ya bozongisi ya 48 chiffres ya lelo: 

# Display all BitLocker recovery keys and Key IDs across all drives
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, -ExpandProperty KeyProtector |
  Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } |
  Select-Object MountPoint, KeyProtectorId, RecoveryPassword
- Avant ya ko mettre à jour BIOS na yo to ko swap matériel: Tambola tango nionso Suspend-BitLocker -MountPoint "C:" -RebootCount 1 na Administrateur PowerShell liboso ya ko flasher mise à jour ya BIOS ya carte mère, ko toggler Secure Boot, to ko remplacer CPU/carte mère. Yango ebombaka mpo na mwa ntango mobateli ya polele mpo na reboot moko mpe ezongisaka na ndenge ya automatique ba hashes ya sika ya PCR ya TPM mbala moko mise à jour esili.

2. Na macOS (Vérifier to tourner clé ya récupération ya FileVault na yo)

Fungola Terminal mpe tala nani azali na ndingisa ya kofungola disque ya démarrage na yo ya APFS: 

sudo fdesetup status
diskutil apfs listCryptoUsers /
Soki olingi kobimisa Clé ya sika ya 24 caractères ya récupération personnelle mpo okoka kokoma yango mpe kobomba yango na gestionnaire ya mot de passe na yo mpe na coffre-fort ya ndako: 
sudo fdesetup changerecovery -personal

3. Na Linux (Kosala sauvegarde ya tête na yo ya LUKS mpe kokomisa Keyslot ya fallback)

Bomba ntango nyonso kopi ya motó ya likambo na yo ya LUKS ya 16 mégabytes na disque de pouce USB ya libanda mpe komisa fraze ya nzela ya bozongisi ya bilembo 64 oyo enyatami na Keyslot 1: 

# 1. Back up the binary LUKS header to an external USB drive
sudo cryptsetup luksHeaderBackup /dev/nvme0n1p3 --header-backup-file /media/usb/luks-header-nvme0n1p3.bak

# 2. Add an independent emergency recovery passphrase into Keyslot 1
sudo cryptsetup luksAddKey --key-slot 1 /dev/nvme0n1p3

Liste ya vérification ya prêt ya urgence ya encryption

  • Exporter 48-chiffres BitLocker Recovery Key (y compris na yango 8 caractères Key ID) mpe bomba yango na kati ya yo mokambi ya mot de passe mpe enyatami na papier na kati ya coffre-fort oyo ekoki kozika te ata na mɛtrɛ 1,5 likoló ya nivo ya mabele.
  • Imprimer to bomba Clé de récupération macOS FileVault na yo ya 24 caractères pembeni ya clé ya récupération ya Compte Apple na yo ya 28 caractères.
  • Salá sauvegarde ya motó ya likambo na yo ya 16 mégabyte Linux LUKS (cryptsetup luksHeaderBackup) na lecteur USB hors ligne mpo ete kokoma likolo ya partition na mbalakaka ekoki kobebisa ba clés nionso te.
  • Bobatela oyo ezali na lipanda, oyo ezali na masini 3-2-1 sauvegarde ya ordinateur na boye ete ata liwa ya contrôleur SSD ya likama to fungola ya chiffrement oyo ebosani ebebisa ata moke te bafoto na yo oyo okoki kozongisa te, mikanda ya mpako, to code source.

Mituna oyo batunaka mingi

Why did my Windows 11 laptop suddenly ask for a BitLocker Recovery Key when I never turned on BitLocker?

Almost all modern Windows 10 and 11 laptops ship with "Device Encryption" (using the BitLocker engine) pre-staged at the factory. The moment you sign in with a Microsoft Account or a work/school account during setup, Windows silently activates BitLocker and uploads your 48-digit recovery key to `account.microsoft.com/devices/recoverykey`. Later, when a routine Windows Update installs a UEFI/BIOS firmware update that alters the motherboard TPM 2.0 measurements, BitLocker locks the drive and demands that 48-digit key.

Can a professional data recovery lab or forensic company bypass BitLocker, FileVault 2, or LUKS without the key?

No. If the Volume Master Key is properly sealed and you have neither the recovery key nor a guessable user password, no data recovery lab can brute-force AES-128-XTS or AES-256-XTS encryption. The only exceptions where a lab can help are: (1) repairing a physically dead motherboard so the original onboard TPM 2.0 or Apple Secure Enclave chip can boot and release the key automatically; (2) sniffing an uninsulated discrete LPC/SPI TPM bus if the TPM already considers the boot state valid; or (3) running GPU dictionary attacks (`hashcat`) against a human-chosen passphrase whose root words you partially remember.

I have multiple BitLocker recovery keys in my Microsoft Account for the same computer name. How do I know which one to type?

Never go by the computer hostname alone, because reinstalling Windows creates a new key under the same name. Look at the blue BitLocker screen on your PC and note the **Key ID** (the first 8 hexadecimal characters, like `3A9F82C1`). Match those exact 8 characters against the **Key ID** column listed at `account.microsoft.com/devices/recoverykey`.

If I clean-install Windows over a locked BitLocker drive, can I use data recovery software like Recuva or PhotoRec to get my photos back?

No. File-carving tools like PhotoRec or Recuva scan raw disk sectors for recognizable file headers (such as `FF D8 FF` for JPEGs). On an AES-XTS encrypted drive, every sector is scrambled into high-entropy ciphertext with zero recognizable file headers, and formatting over the partition destroys the BitLocker metadata headers needed to ever decrypt the drive.

Ba guides oyo etali yango

Ba sources e vérifié

  • Institut national ya ba normes mpe technologie (NIST) (Etats-Unis): Mokanda ya sipesiale ya NIST 800-111: Buku ya ba technologies ya chiffrement ya bobateli mpo na ba dispositifs ya mosaleli ya suka & FIPS 197 (AES-XTS).
  • Microsoft Learn Mikanda ya Leta: Botali ya bozongisi ya BitLocker, Profil ya bondimi ya ba registres ya configuration ya plateforme ya TPM (PCR 0-11), mpe manage-bde Référence ya Molongo ya komande.
  • Buku ya bokengi ya plateforme Apple: Chiffrement ya volume na FileVault, Sacs ya ba clés ya APFS, Rasis ya confiance ya matériel enclave ya sécurité, mpe Escrow ya clé ya récupération institutionnelle/personnelle. -Groupe informatique ya confiance (TCG) (International): Spécification ya bibliothèque ya TPM 2.0 mpe Spécification ya profil ya firmware ya plateforme ya client PC.
  • GitLab Cryptsetup / LUKS2 Spécification officielle: LUKS2 Spécification ya format na disque, Argon2id PBKDF Memory-Hard Keyslots, mpe Procédures ya sauvegarde/reparation ya tête.