3

I have a 4TB drive that has been bitlocker encrypted (via password) since day one and want to wipe it before I sell it used. The process looks like it's going to take 100+ hours via nwipe but I was wondering if there was any public info on what sectors the bitlocker encryption info is stored so I could just wipe those. As I understand it the password is merely the encryption key for the actual encryption key and the encryption key is stored somewhere on the drive. Anyone have any references to if this is a correct assumption and/or what sectors hold that info so I can just wipe those and sell the drive? Thanks in advance for any help!

  • 2
    What is nwipe? The only thing you should wipe modern SATA drives with is a program that does secure erase. I took a glance at nwipe, and it doesn't seem to have secure erase capability. See here for one appropriate tool. You may be able to find others as well. – Michael Hampton Jan 25 at 15:37
  • 2
    It's odd to me that someone would buy a used hard drive. You can buy a brand new 4TB SATA drive for $90.00 USD. – joeqwerty Jan 25 at 17:13
  • Question 1: Nwipe is a fork of dban that implements DOD 5220.22M wiping techniques and I'm using the 7 pass in leu of DoD short. The standard is open and thus some people forked the last free version of Dban and turned it into nwipe. – Nuvious Jan 26 at 16:14
  • Question 2: You provide no guidance to the original question. I don't need a new drive. I want to sell this one used for like $40 bucks but want it wiped first. – Nuvious Jan 26 at 16:15
  • @Nuvious Those "standards" were designed for ancient drives made in the 1980s and 1990s. They are utterly useless for modern drives, where a single write pass is sufficient, where overwriting manually as they do will miss various bits of the drive, and where the hard drive can do this properly on its own via the security erase commands. – Michael Hampton Jan 27 at 16:35
2

There are actually multiple keys.

The key used to do the encryption, the Full Volume Encryption Key (FVEK), is stored in the BitLocker metadata on the protected volume. Each sector is encrypted independently.

The FVEK is encrypted using another key, the Volume Master Key (VMK). Three copies of the VMK are also stored in the metadata.

Each copy of the VMK is encrypted using one or more externally-supplied key/password protectors, such as TPM, PIN, User Password, Recovery Password, Recovery Key, Startup Key, or smart card.

The FVEK or VMK cannot be used if the externally-supplied key protectors are not known. So this exercise isn't going to do much for you if protection was not suspended (clear key in use) or the password was weak. It's also likely that the drive is now trashed to the point where it may not be possible to identify the FVEK or VMK in the volume metadata.

You can download a tool to validate the metadata:

https://www.m3datarecovery.com/bitlocker-drive-data-recovery/how-to-decrypt-bitlocker-encrypted-drive.html

More information:

https://www.forensicswiki.org/wiki/BitLocker_Disk_Encryption

libbde - BitLocker Drive Encryption (BDE) format specification:

https://github.com/libyal/libbde/blob/master/documentation/BitLocker%20Drive%20Encryption%20(BDE)%20format.asciidoc

See section 4, Volume Header. This has the starting location of the FVE metadata blocks. Section 5 has the format of the FVE metadata blocks. Section 5.3 has the FVE metadata types.

BitLocker Volume Header:
BitLocker Volume Header

BitLocker FVE Metadata Block Header:
BitLocker Metadata Block Header

BitLocker FVE Metadata Header:
BitLocker FVE Metadata Header

  • Thanks for the detailed answer! Went above and beyond what I was hoping to get. – Nuvious Mar 2 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.