infrastructure tier

`infrastructure-bitlocker-forensics`

Native parser for the BitLocker FVE metadata block: enumerates the VMK key-protector inventory (clear key / TPM / TPM+PIN / recovery password / password / startup key) as cited Observations, no verdicts. Reads the newer XTS-AES metadata versions that the packaged libbde/dislocker builds reject.

Native parser for the BitLocker FVE metadata block: enumerates the VMK key-protector inventory (clear key / TPM / TPM+PIN / recovery password / password / startup key) as cited Observations, no verdicts. Reads the newer XTS-AES metadata versions that the packaged libbde/dislocker builds reject.

Tier	infrastructure
Role	adapter
Path	`crates/infrastructure/bitlocker-forensics`
Edition	2021
Targets	infrastructure_bitlocker_forensics
Public items	11 across 0 modules
Tests	9

What it is for

Native parser for the BitLocker FVE metadata block: enumerates the volume's key-protector inventory (the VMK entries) as cited Observations, never a verdict.

Why this exists rather than a wrapper crate: the packaged libbde (20190102) and dislocker (0.7.3) both abort on the XTS-AES metadata versions Windows 10/11 writes (unsupported FVE metadata entry version / the VIRTUALIZATION datum), so the established "thin wrapper around the reference tool" pattern has no working reference tool for these images. This reads the documented on-disk structure directly.

Layout is the libyal libbde documentation of the FVE metadata:

the -FVE-FS- volume header carries three metadata-block offsets at byte 0xb0;
each metadata block opens with the -FVE-FS- signature, an FVE metadata header at

0x40 (metadata size, header size, volume GUID, encryption method), then a run of entries ("datums");

a datum is size:u16, entry_type:u16, value_type:u16, version:u16 then its value;
a VMK datum is entry_type == 0x0002, value_type == 0x0008; its value is

guid16, modification_time:i64, unknown:u16, protection_type:u16.

No secret is ever needed to read this: protector types live in the metadata in the clear. Whether a given protector can then unlock the FVEK (a clear-key protector can; a TPM/recovery/password protector needs its secret) is a fact the caller reads off the inventory — this crate states what protectors exist, it does not attempt any unlock.

Capabilities

`crate root`

Native parser for the BitLocker FVE metadata block: enumerates the volume's

Item
`fn parse_metadata_block(block : & u8) -> Result <BitlockerMetadata, BdeError>`

`BdeError`

Native parser for the BitLocker FVE metadata block: enumerates the volume's

Item
`pub enum BdeError`
`fn metadata_offsets(volume_header : & u8) -> Result <u64; 3, BdeError>`

`BitlockerMetadata`

Native parser for the BitLocker FVE metadata block: enumerates the volume's

Item
`pub struct BitlockerMetadata`
`BitlockerMetadata :: fn recoverable_without_secret(& self) -> bool`
`fn to_observations(md : & BitlockerMetadata, rule_id : & str) -> Vec <Observation>`

`ProtectionType`

Native parser for the BitLocker FVE metadata block: enumerates the volume's

Item
`pub enum ProtectionType`
`ProtectionType :: fn from_code(code : u16) -> Self`
`ProtectionType :: fn label(& self) -> String`
`ProtectionType :: fn unlocks_without_secret(& self) -> bool`

`VmkProtector`

Native parser for the BitLocker FVE metadata block: enumerates the volume's

Item
`pub struct VmkProtector`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

Item	What it is
`pub enum BdeError`	Every way parsing the metadata can fail
`pub enum ProtectionType`	The kind of key protector guarding a VMK
`ProtectionType :: fn from_code(code : u16) -> Self`	Map a raw little-endian protection code to its kind.
`ProtectionType :: fn label(& self) -> String`	A stable, human-readable label for citation.
`ProtectionType :: fn unlocks_without_secret(& self) -> bool`	Whether this protector unlocks the FVEK with no secret from anyone
`pub struct VmkProtector`	One VMK key protector, as read from the metadata.
`pub struct BitlockerMetadata`	The protector inventory parsed from one metadata block.
`BitlockerMetadata :: fn recoverable_without_secret(& self) -> bool`	Whether any protector unlocks the FVEK with no secret (a clear-key protector is present)
`fn metadata_offsets(volume_header : & u8) -> Result <u64; 3, BdeError>`	Read the three metadata-block offsets (volume-relative) from a volume boot sector
`fn parse_metadata_block(block : & u8) -> Result <BitlockerMetadata, BdeError>`	Parse one FVE metadata block into its protector inventory
`fn to_observations(md : & BitlockerMetadata, rule_id : & str) -> Vec <Observation>`	Lift a protector inventory into cited `Observation`s — one per protector, plus a header observation for the volume description

No pub use re-exports: every item above is declared in this crate.

Boundary

Depends on no other workspace tier.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`infrastructure`
Architectural role (taxonomy)	`adapter`
Location	`crates/infrastructure/bitlocker-forensics`
Vocabulary in force (lexicon)	`current`

Dependencies

Runtime, in this workspace.

Crate	Tier	Optional	Only on
`infrastructure-host-forensics`	infrastructure	no	always

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`thiserror`	`^2`	—	no	always

Development. None.

Build. None.

Depended on by. 1 workspace crate.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_tools_ir_triage["tools-ir-triage"] -->|uses| SELF
  SELF["infrastructure-bitlocker-forensics"]
  SELF -->|runtime| n_infrastructure_host_forensics["infrastructure-host-forensics"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
lib	`infrastructure_bitlocker_forensics`	`src/lib.rs`

Error model

Error type	Named by
`BdeError`	`metadata_offsets`, `parse_metadata_block`

Operational characteristics

Property	Evidence
async public surface	none detected
async runtime	none detected
database access	none detected
network I/O	none detected
unsafe code	none detected
environment variables	none detected

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

1 workspace crate depends on this one: tools-ir-triage.

Verification

Kind	Count
Unit tests	9
Integration tests	0
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Examples	Consumers
`crate root`	7	0	3

What the tests establish, by name:

a_corrupt_entry_size_ends_the_walk_without_panicking — src/lib.rs
all_known_protector_codes_map_and_a_typical_os_drive_needs_a_secret — src/lib.rs
clear_key_means_recoverable_without_secret — src/lib.rs
description_and_guid_and_modtime_are_cited — src/lib.rs
metadata_offsets_reads_the_table_and_rejects_non_bitlocker — src/lib.rs
non_bitlocker_block_is_rejected — src/lib.rs
protection_codes_round_trip_through_from_code — src/lib.rs
recovery_password_protector_is_read_at_the_right_offset — src/lib.rs
truncated_metadata_size_is_an_error_not_a_panic — src/lib.rs

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	11	11
Public modules with a `//!` block	0	0

pie showData
    title Public items with rustdoc
    "Documented" : 11
    "No rustdoc detected" : 0

Metrics

Metric	Value
Rust source files	1
Source lines	522
Code lines	386
Public API items	11
Public modules	0
Tests	9
Examples	0
Cargo features	0
Direct runtime dependencies	2
Workspace reverse dependencies	1

pie showData
    title Public API by kind
    "enum" : 2
    "function" : 3
    "method" : 4
    "struct" : 2

pie showData
    title Rust source composition
    "Code" : 386
    "Blank or comment" : 136

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.

All infrastructure · Manual