Encrypted Virtual Disk Drive Mounting Tool In C — Complete Documentation & Simulation

Overview & System Context

Encrypted Virtual Disk Drive Mounting Tool In C: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9524 Words · Real Software Screenshots: 1 1. Executive Overview & Technical Background Oracle VirtualBox (formerly Oracle VM VirtualBox, Sun VirtualBox, Sun xVM VirtualBox and InnoTek VirtualBox) is a hosted hypervisor for x86 and ARM virtualization developed by Oracle Corporation. VirtualBox was originally created by InnoTek Systemberatung GmbH, which was acquired by Sun Microsystems in 2008, which was in turn acquired by Oracle in 2010.

VirtualBox may be installed on Microsoft Windows, macOS, Linux, Solaris and OpenSolaris. There are also ports to FreeBSD and Genode. It supports the creation and management of guest virtual machines running Windows, Linux, BSD, OS/2, Solaris, Haiku, and OSx86, as well as limited virtualization of macOS guests on Apple hardware. For some guest operating systems, a "Guest Additions" package of device drivers and system applications is available, which typically improves performance, especially that of graphics, and allows changing the resolution of the guest OS automatically when the window of the virtual machine on the host OS is resized. Released under the terms of the GNU General Public License and, optionally, the CDDL for most files of the source distribution, VirtualBox is free and open-source software, though the Extension Pack is proprietary software, free of charge only to personal users. The license to VirtualBox was relicensed to GPLv3 with linking exceptions to the CDDL and other GPL-incompatible licenses.

VirtualBox was first offered by InnoTek Systemberatung GmbH, a German company based in Weinstadt, under a proprietary software license, making one version of the product available at no cost for personal or evaluation use, subject to the VirtualBox Personal Use and Evaluation License (PUEL). In January 2007, based on counsel by LiSoG, InnoTek released VirtualBox Open Source Edition (OSE) as free and open-source software, subject to the requirements of the GNU General Public License (GPL), version 2. InnoTek also contributed to the development of OS/2 and Linux support in virtualization and OS/2 ports of products from Connectix which were later acquired by Microsoft. Specifically, InnoTek developed the "additions" code in both Windows Virtual PC and Microsoft Virtual Server, which enables various host–guest OS interactions like shared clipboards or dynamic viewport resizing. Sun Microsystems acquired InnoTek in February 2008. Following the acquisition of Sun Microsystems by Oracle Corporation in January 2010, the product was re-branded as "Oracle VM VirtualBox". In December 2019, VirtualBox removed support for software-based virtualization and exclusively performs hardware-assisted virtualization. In August 2025, VirtualBox started fully supporting ARM virtualization.

Users of VirtualBox can load multiple guest OSes under a single host operating-system (host OS). Each guest can be started, paused and stopped independently within its own virtual machine (VM). The user can independently configure each VM and run it under a choice of software-based virtualization or hardware assisted virtualization if the underlying host hardware supports this. The host OS and guest OSs and applications can communicate with each other through a number of mechanisms including a common clipboard and a virtualized network facility. Guest VMs can also directly communicate with each other if configured to do so.

VirtualBox emulates hard disks in three formats: the native VDI (Virtual Disk Image), VMware's VMDK, and Microsoft's VHD. It thus supports disks created by other hypervisor software. VirtualBox can also connect to iSCSI targets and to raw partitions on the host, using either as virtual hard disks. VirtualBox emulates IDE (PIIX4 and ICH6 controllers), SCSI, SATA (ICH8M controller), and SAS controllers, to which hard drives can be attached. VirtualBox has supported Open Virtualization Format (OVF) since version 2.2.0 (April 2009). Both ISO images and physical devices connected to the host can be mounted as CD or DVD drives. VirtualBox supports running operating systems from live CDs and DVDs. By default, VirtualBox provides graphics support through a custom virtual graphics-card that is VBE or UEFI GOP compatible. The Guest Additions for Windows, Linux, Solaris, OpenSolaris, and OS/2 guests include a special video-driver that increases video performance and includes additional features, such as automatically adjusting the guest resolution when resizing the VM window and desktop composition via virtualized WDDM drivers. For an Ethernet network adapter, VirtualBox virtualizes these Network Interface Cards: Figure 1: Figure 1: Verified System Architecture & Pipeline Workflow AMD PCnet PCI II (Am79C970A) AMD PCnet-Fast III (Am79C973) Intel Pro/1000 MT Desktop (82540EM) Intel Pro/1000 MT Server (82545EM) Intel Pro/1000 T Server (82543GC) Paravirtualized network adapter (virtio-net) The emulated network cards allow most guest OSs to run without the need to find and install drivers for networking hardware as they are shipped as part of the guest OS. A special paravirtualized network adapter is also available, which improves network performance by eliminating the need to match a specific hardware interface, but requires special driver support in the guest. (Many distributions of Linux ship with this driver included.) By default, VirtualBox uses NAT through which Internet software for end-users such as Firefox or ssh can operate. Bridged networking via a host network adapter or virtual networks between guests can also be configured. Up to 36 network adapters can be attached simultaneously, but only four are configurable through the graphical interface. For a sound card, VirtualBox virtualizes Intel HD Audio, Intel ICH AC'97, and SoundBlaster 16 devices. A USB 1.1 controller is emulated, so that any USB devices attached to the host can be seen in the guest. The proprietary extension pack adds a USB 2.0 or USB 3.0 controller and, if VirtualBox acts as an RDP server, it can also use USB devices on the remote RDP client, as if they were connected to the host, although only if the client supports this VirtualBox-specific extension (Oracle provides clients for Solaris, Linux, and Sun Ray thin clients that can do this, and has promised support for other platforms in future versions).

The system reconfigures the guest OS code, which would normally run in ring 0, to execute in ring 1 on the host hardware. Because this code contains many privileged instructions which cannot run natively in ring 1, VirtualBox employs a Code Scanning and Analysis Manager (CSAM) to scan the ring 0 code recursively before its first execution to identify problematic instructions and then calls the Patch Manager (PATM) to perform in-situ patching. This replaces the instruction with a jump to a VM-safe equivalent compiled code fragment in hypervisor memory. The guest user-mode code, running in ring 3, generally runs directly on the host hardware in ring 3. In both cases, VirtualBox uses CSAM and PATM to inspect and patch the offending instructions whenever a fault occurs. VirtualBox also contains a dynamic recompiler, based on QEMU to recompile any real mode or protected mode code entirely (e.g. BIOS code, a DOS guest, or any operating system startup). Using these techniques, VirtualBox could achieve performance comparable to that of VMware in its later versions. The feature was dropped starting with VirtualBox 6.1.

Raw hard disk access – allows physical hard disk partitions on the host system to appear in the guest system VMware Virtual Machine Disk (VMDK) format support – allows exchange of disk images with VMware Microsoft VHD support QEMU qed and qcow disks HDD format disks (only version 2; versions 3 and 4 are not supported) used by Parallels virtualization products Windows 10 64-bit and higher. Support for 64-bit Windows was added with VirtualBox 1.5. Support for 32-bit Windows was removed in 6.0. Support for Windows 2000 was removed in version 1.6. Support for Windows XP was removed in version 5.0.

Support for Windows Vista was removed in version 5.2. Support for Windows 7 (64-bit) was removed in version 6.1. Support for Windows 8 (64-bit) was removed in version 7.0. Support for Windows 8.1 (64-bit) was removed in version 7.1. Windows Server 2019 and higher. Support for Windows Server 2003 was removed in 5.0. Support for Windows Server 2008 was removed in 6.0. Support for Windows Server 2008 R2 was removed in version 7.0. Support for Windows Server 2012 and 2016 was removed in version 7.1. Linux distributions macOS from version 11 (Big Sur) to 14 (Sonoma) both ARM and Intel versions: Preliminary Mac OS X support (beta stage) was added with VirtualBox 1.4, full support with 1.6. Support for Mac OS X 10.4 (Tiger) and earlier was removed with VirtualBox 3.1. Support for Mac OS X 10.5 (Leopard) was removed with VirtualBox 4.2. Support for Mac OS X 10.6 (Snow Leopard) and 10.7 (Lion) was removed with VirtualBox 5.0. Support for Mac OS X 10.8 (Mountain Lion) was removed with VirtualBox 5.1. Support for Mac OS X 10.9 (Mavericks) was removed with VirtualBox 5.2. Support for Mac OS X 10.10 (Yosemite) and OS X 10.11 (El Capitan) was removed with VirtualBox 6.0.

Support for macOS 10.12 (Sierra) was officially removed with VirtualBox 6.1 (as of 6.1.16 it will still install and run, however). Support for macOS 10.13 (High Sierra) and macOS 10.14 (Mojave) was officially removed with VirtualBox 7.0. Support for macOS 10.15 (Catalina) was officially removed with VirtualBox 7.1. Oracle Solaris Support for a virtual USB 2.0/3.0 controller (EHCI/xHCI) (Starting with VirtualBox 7.0, this functionality was integrated into the GPL version instead.) PXE boot for Intel cards. Webcam support While VirtualBox itself is free to use and is distributed under an open source license the VirtualBox Extension Pack is licensed under the VirtualBox Personal Use and Evaluation License (PUEL). Personal use of the extension pack is free but commercial users need to purchase a license. Guest Additions are installed within each guest virtual machine which supports them; the Extension Pack is installed on the host running VirtualBox.

Comparison of platform virtualization software VMware Workstation OS-level virtualization x86 virtualization Official website Official website (innotek.de) at the Wayback Machine (archived 2006-02-07) virtualbox on GitHub A USB flash drive (also known as a thumb drive) is a data storage device that includes flash memory with an integrated USB interface. A typical USB drive is removable, rewritable, and smaller than an optical disc, and usually weighs less than 30 g (1 oz). Since first offered for sale in late 2000, the storage capacities of USB drives have ranged from 8 megabytes to 1 terabyte (TB). As of 2024, 4 TB flash drives were the largest currently in production. Some allow up to 100,000 write/erase cycles, depending on the exact type of memory chip used, and are thought to physically last between 10 and 100 years under normal circumstances (shelf storage time). Common uses of USB flash drives are for storage, supplementary back-ups, and transferring of computer files. Compared with floppy disks or CDs, they are smaller, faster, have significantly more capacity, and are more durable due to a lack of moving parts. Additionally, they are less vulnerable to electromagnetic interference than floppy disks, and are unharmed by surface scratches (unlike CDs). However, as with any flash storage, data loss from bit leaking due to prolonged lack of electrical power and the possibility of spontaneous controller failure due to poor manufacturing could make it unsuitable for long-term archiving of data. The ability to retain data is affected by the controller's firmware, internal data redundancy, and error correction algorithms. Until about 2005, most desktop and laptop computers were supplied with floppy disk drives in addition to USB ports, but floppy disk drives became obsolete after widespread adoption of USB ports and the larger USB drive capacity compared to the "1.44 megabyte" 3.5-inch floppy disk. USB flash drives use the USB mass storage device class standard, supported natively by modern operating systems such as Windows, Linux, macOS and other Unix-like systems, as well as many BIOS boot ROMs. USB drives with USB 2.0 support can store more data and transfer faster than much larger optical disc drives like CD-RW or DVD-RW drives and can be read by many other systems such as the Xbox One, PlayStation 4, DVD players, automobile entertainment systems, and in a number of handheld devices such as smartphones and tablet computers, though the electronically similar SD card is better suited for those devices, due to their standardized form factor, which allows the card to be housed inside a device without protruding. A flash drive consists of a small printed circuit board carrying the circuit elements and a USB connector, insulated electrically and protected inside a plastic, metal, or rubberized case, which can be carried in a pocket or on a key chain, for example.

Some are equipped with an I/O indication LED that lights up or blinks upon access. The USB connector may be protected by a removable cap or by retracting into the body of the drive, although it is not likely to be damaged if unprotected. Most flash drives use a standard Type-A USB connection allowing connection with a port on a personal computer, but drives for other interfaces also exist (e.g. micro-USB and USB-C ports). USB flash drives draw power from the computer via the USB connection. Some devices combine the functionality of a portable media player with USB flash storage; they require a battery only when used to play music on the go.

Inside the casing is a small printed circuit board, which has some power circuitry and a small number of surface-mounted integrated circuits (ICs). Typically, one of these ICs provides an interface between the USB connector and the onboard memory, while the other is the flash memory. Drives typically use the USB mass storage device class to communicate with the host.

USB plug – provides a physical interface to the host computer. Some USB flash drives use USB plug that does not protect the contacts, with the possibility of plugging it into the USB port in the wrong orientation, if the connector type is not symmetrical. USB mass storage controller – a small microcontroller with a small amount of on-chip ROM and RAM. NAND flash memory chip(s) – stores data (NAND flash is typically also used in digital cameras). Crystal oscillator – produces the device's main clock signal and controls the device's data output through a phase-locked loop. Cover – typically made of plastic or metal, protecting the electronics against mechanical stress and even possible short circuits.

Jumpers and test pins – for testing during the flash drive's manufacturing or loading code into its microcontroller. LEDs – indicate data transfers or data reads and writes. Write-protect switches – Enable or disable writing of data into memory. Unpopulated space – provides space to include a second memory chip. Having this second space allows the manufacturer to use a single printed circuit board for more than one storage size device. USB connector cover or cap – reduces the risk of damage, prevents the entry of dirt or other contaminants, and improves overall device appearance. Some flash drives use retractable USB connectors instead. Others have a swivel arrangement so that the connector can be protected without removing anything. Transport aid – the cap or the body often contains a hole suitable for connection to a key chain or lanyard.

Connecting the cap, rather than the body, can allow the drive itself to be lost. Some drives offer expandable storage via an internal memory card slot, much like a memory card reader. Most USB flash drives weigh less than 30 g (1 oz). While some manufacturers are competing for the smallest size, with the biggest memory, offering drives only a few millimeters larger than the USB plug itself, some manufacturers differentiate their products by using elaborate housings, which are often bulky and make the drive difficult to connect to the USB port. Because the USB port connectors on a computer housing are often closely spaced, plugging a flash drive into a USB port may block an adjacent port. Such devices may carry the USB logo only if sold with a separate extension cable. Such cables are USB-compatible but do not conform to the USB standard. USB flash drives have been integrated into other commonly carried items, such as watches, pens, laser pointers, and even the Swiss Army Knife; others have been fitted with novelty cases such as toy cars or Lego bricks. USB flash drives with images of dragons, cats or aliens are very popular in Asia. The small size, robustness and cheapness of USB flash drives make them an increasingly popular peripheral for case modding.

Most flash drives ship preformatted with the FAT32, or exFAT file systems. The ubiquity of the FAT32 file system allows the drive to be accessed on virtually any host device with USB support. Also, standard FAT maintenance utilities (e.g., ScanDisk) can be used to repair or retrieve corrupted data. However, because a flash drive appears as a USB-connected hard drive to the host system, the drive can be reformatted to any file system supported by the host operating system.

Transfer speeds are technically determined by the slowest of three factors: the USB version used, the speed in which the USB controller device can read and write data onto the flash memory, and the speed of the hardware bus, especially in the case of add-on USB ports. USB flash drives usually specify their read and write speeds in megabytes per second (MB/s); read speed is usually faster. These speeds are for optimal conditions; real-world speeds are usually slower. In particular, circumstances that often lead to speeds much lower than advertised are transfer (particularly writing) of many small files rather than a few very large ones, and mixed reading and writing to the same device. In a typical well-conducted review of a number of high-performance USB 3.0 drives, a drive that could read large files at 68 MB/s and write at 46 MB/s, could only manage 14 MB/s and 0.3 MB/s with many small files. When combining streaming reads and writes the speed of another drive, the drive could read at 92 MB/s and write at 70 MB/s, was 8 MB/s. These differences differ radically from one drive to another; some could write small files 10% faster than for large ones. The examples given are chosen to illustrate extremes.

Loading a minimal, hardened kernel for embedded applications (e.g., network router, firewall). Bootstrapping an operating system install or disk cloning operation, often across a network. Maintenance tasks, such as virus scanning or low-level data repair, without the primary host operating system loaded. As of 2011, newer flash memory designs have much higher estimated lifetimes. Several manufacturers are now offering warranties of 5 years or more. Such warranties should make the device more attractive for more applications. By reducing the probability of the device's premature failure, flash memory devices can now be considered for use where a magnetic disk would normally have been required. Flash drives have also experienced an exponential growth in their storage capacity over time (following the Moore's Law growth curve). As of 2013, single-packaged devices with capacities of 1 TB are readily available, and devices with 16 GB capacity are very economical.

Storage capacities in this range have traditionally been considered to offer adequate space, because they allow enough space for both the operating system software and some free space for the user's data. This is simple for the end-user, and more likely to be done. The drive is small and convenient, and more likely to be carried off-site for safety. The drives are less fragile mechanically and magnetically than tapes. The capacity is often large enough for several backup images of critical data. Flash drives are cheaper than many other backup systems. Flash drives also have disadvantages. They are easy to lose and facilitate unauthorized backups. A lesser setback for flash drives is that they have only one tenth the capacity of hard drives manufactured around their time of distribution.

Many companies make small solid-state digital audio players, essentially producing flash drives with sound output and a simple user interface. Examples include the Creative MuVo, Philips GoGear and the first generation iPod shuffle. Some of these players are true USB flash drives as well as music players; others do not support general-purpose data storage. Other applications requiring storage, such as digital voice or sound recording, can also be combined with flash drive functionality.

Many of the smallest players are powered by a permanently fitted rechargeable battery, charged from the USB interface. Fancier devices that function as a digital audio player have a USB host port (type A female typically). Digital audio files can be transported from one computer to another like any other file, and played on a compatible media player (with caveats for DRM-locked files). In addition, many home Hi-Fi and car stereo head units are now equipped with a USB port. This allows a USB flash drive containing media files in a variety of formats to be played directly on devices which support the format. Some LCD monitors for consumer HDTV viewing have a dedicated USB port through which music and video files can also be played without use of a personal computer. Artists have sold or given away USB flash drives, with the first instance believed to be in 2004 when the German punk band Wizo released the Stick EP, only as a USB drive. In addition to five high-bitrate MP3s, it also included a video, pictures, lyrics, and guitar tablature. Subsequently, artists including Nine Inch Nails and Kylie Minogue have released music and promotional material on USB flash drives. The first USB album to be released in the UK was Kiss Does... Rave, a compilation album released by the Kiss Network in April 2007.

The availability of inexpensive flash drives has enabled them to be used for promotional and marketing purposes, particularly within technical and computer-industry circles (e.g., technology trade shows). They may be given away for free, sold at less than wholesale price, or included as a bonus with another purchased product. Usually, such drives will be custom-stamped with a company's logo, as a form of advertising. The drive may be blank, or preloaded with graphics, documentation, web links, Flash animation or other multimedia, and free or demonstration software. Some preloaded drives are read-only, while others are configured with both read-only and user-writable segments. Such dual-partition drives are more expensive. Flash drives can be set up to automatically launch stored presentations, websites, articles, and any other software immediately on insertion of the drive using the Microsoft Windows AutoRun feature. Autorunning software this way does not work on all computers, and it is normally disabled by security-conscious users.

Floppy disk drives are rarely fitted to modern computers and are obsolete for normal purposes, although internal and external drives can be fitted if required. Floppy disks may be the method of choice for transferring data to and from very old computers without USB or booting from floppy disks, and so they are sometimes used to change the firmware on, for example, BIOS chips. Devices with removable storage like older Yamaha music keyboards are also dependent on floppy disks, which require computers to process them. Newer devices are built with USB flash drive support. Floppy disk hardware emulators exist which effectively utilize the internal connections and physical attributes of a floppy disk drive to utilize a device where a USB flash drive emulates the storage space of a floppy disk in a solid state form, and can be divided into a number of individual virtual floppy disk images using individual data channels.

Flash memory cards, e.g., Secure Digital cards, are available in various formats and capacities, and are used by many consumer devices. However, while virtually all PCs have USB ports, allowing the use of USB flash drives, memory card readers are not commonly supplied as standard equipment (particularly with desktop computers). Although inexpensive card readers are available that read many common formats, this results in two pieces of portable equipment (card plus reader) rather than one. Some manufacturers, aiming at a "best of both worlds" solution, have produced card readers that approach the size and form of USB flash drives (e.g., Kingston MobileLite, SanDisk MobileMate) These readers are limited to a specific subset of memory card formats (such as SD, microSD, or Memory Stick), and often completely enclose the card, offering durability and portability approaching, if not quite equal to, that of a flash drive. Although the combined cost of a mini-reader and a memory card is usually slightly higher than a USB flash drive of comparable capacity, the reader + card solution offers additional flexibility of use, and virtually "unlimited" capacity. The ubiquity of SD cards is such that, circa 2011, due to economies of scale, their price is now less than an equivalent-capacity USB flash drive, even with the added cost of a USB SD card reader. An additional advantage of memory cards is that many consumer devices (e.g., digital cameras, portable music players) cannot make use of USB flash drives (even if the device has a USB port), whereas the memory cards used by the devices can be read by PCs with a card reader.

As highly portable media, USB flash drives are easily lost or stolen. All USB flash drives can have their contents encrypted using third-party disk encryption software, which can often be run directly from the USB drive without installation (for example, FreeOTFE), although some, such as BitLocker, require the user to have administrative rights on every computer it is run on. Archiving software can achieve a similar result by creating encrypted ZIP or RAR files. Some USB flash drive solutions incorporate hardware-based copy protection directly into the drive's design, eliminating the need for third-party software.

Unlike software-based encryption systems, which can often be bypassed or removed, hardware solutions embed the protection into the drive at the controller level, making the content read-only and non-duplicable while still being viewable. This approach offers a higher level of security and reliability, particularly for distributing files such as videos, PDFs, and software, though it may come at a higher cost than conventional, software-only methods. A minority of flash drives support biometric fingerprinting to confirm the user's identity. As of mid-2005, this was an expensive alternative to standard password protection offered on many new USB flash storage devices. Most fingerprint scanning drives rely upon the host operating system to validate the fingerprint via a software driver, often restricting the drive to Microsoft Windows computers. However, there are USB drives with fingerprint scanners which use controllers that allow access to protected data without any authentication.

Some manufacturers deploy physical authentication tokens in the form of a flash drive. These are used to control access to a sensitive system by containing encryption keys or, more commonly, communicating with security software on the target machine. The system is designed so the target machine will not operate except when the flash drive device is plugged into it. Some of these "PC lock" devices also function as normal flash drives when plugged into other machines.

Similar in appearance to a USB flash drive, a USB killer is a circuit which charges its capacitors to a high voltage using the power supply pins of a USB port, then discharges that voltage through the data pins. This standalone device can instantly and permanently damage or destroy any host hardware that it is connected to. Semiconductor corporations have worked to reduce the cost of the components in a flash drive by integrating various flash drive functions in a single chip, thereby reducing the part-count and overall package-cost. Flash drive capacities on the market increase continually. High speed has become a standard for modern flash drives. Capacities exceeding 256 GB were available on the market as early as 2009. Lexar attempted to introduce a USB FlashCard, which would be a compact USB flash drive intended to replace various kinds of flash memory cards. Pretec introduced a similar card, which also plugs into any USB port, but is just one quarter the thickness of the Lexar model. Until 2008, SanDisk manufactured a product called SD Plus, which was a SecureDigital card with a USB connector. SanDisk introduced a digital rights management technology called FlashCP that they had purchased in 2005 to control the storage and usage of copyrighted materials on flash drives, primarily for use by students.

BitLocker is a full volume encryption feature included with Microsoft Windows versions starting with Windows Vista. It is designed to protect data by providing encryption for entire volumes. By default, it uses the Advanced Encryption Standard (AES) algorithm in cipher block chaining (CBC) or "xor–encrypt–xor (XEX)-based tweaked codebook mode with ciphertext stealing" (XTS) mode with a 128-bit or 256-bit key. CBC is not used over the whole disk; it is applied to each individual sector.

Enterprise and Ultimate editions of Windows Vista and Windows 7 Pro and Enterprise editions of Windows 8 and 8.1 Windows Embedded Standard 7 and Windows Thin PC Windows Server 2008 and later Pro, Enterprise, and Education editions of Windows 10 Pro, Enterprise, and Education editions of Windows 11 2. System Architecture & Core Working Principles Transparent operation mode: This mode uses the capabilities of TPM 1.2 or 2.0 hardware to provide for a transparent user experience—the user powers up and logs into Windows as usual. The key used for disk encryption is sealed (encrypted) by the TPM chip and will only be released to the OS loader code if the early boot files appear to be unmodified. The pre-OS components of BitLocker achieve this by implementing a Static Root of Trust Measurement—a methodology specified by the Trusted Computing Group (TCG). This mode is vulnerable to a cold boot attack, as it allows a powered-down machine to be booted by an attacker. It is also vulnerable to a sniffing attack, as the volume encryption key is transferred in plain text from the TPM to the CPU during a successful boot. User authentication mode: This mode requires that the user provide some authentication to the pre-boot environment in the form of a pre-boot PIN or password. USB Key Mode: The user must insert a USB device that contains a startup key into the computer to be able to boot the protected OS. Note that this mode requires that the BIOS on the protected machine supports the reading of USB devices in the pre-OS environment. BitLocker does not support smart cards for pre-boot authentication. The following combinations of the above authentication mechanisms are supported, all with an optional escrow recovery key: In February 2008, a group of security researchers published details of a so-called "cold boot attack" that allows full disk-encryption systems such as BitLocker to be compromised by booting the machine from removable media, such as a USB drive, into another operating system, then dumping the contents of pre-boot memory. The attack relies on the fact that DRAM retains information for up to several minutes (or even longer, if cooled) after the power has been removed. The Bress/Menz device, described in US Patent 9,514,789, can accomplish this type of attack. Similar full-disk-encryption mechanisms of other vendors and other operating systems, including Linux and Mac OS X, are vulnerable to the same attack. The authors recommend that computers be powered down when not in physical control of the owner (rather than be left in a sleep mode) and that the encryption software be configured to require a password to boot the machine. On 10 November 2015, Microsoft released a security update to mitigate a security vulnerability in BitLocker that allowed authentication to be bypassed by employing a malicious Kerberos key distribution center, if the attacker had physical access to the machine, the machine was part of a domain and had no PIN or USB flash drive protection. BitLocker still does not properly support TPM 2.0 security features which, as a result, can lead to a complete bypass of privacy protection when keys are transmitted over Serial Peripheral Interface in a motherboard. All these attacks require physical access to the system and are thwarted by a secondary protector such as a USB flash drive or PIN code.

cppcryptfs is based on the design of gocryptfs , an encrypted overlay filesystem written in Go. cppcryptfs is an implementation of the gocryptfs filesystem in C++ for Windows. cppcryptfs is compatible with gocryptfs. Filesystems created with one can generally be mounted (and synced) with the other. Please see the statement on compatibility near the end of this document.

cppcrypts provides on-the-fly, at-rest and in-the-cloud encryption of files and file names in a virtual filesystem. It uses the Dokany driver and library to provide a virtual filesystem in user mode under Windows. IMPORTANT : As per this discussion, you should only store the created gocryptfs.conf in the cloud if your password is strong. If an attacker obtains your gocryptfs.conf, then they will be able to throw whatever resources they have at a brute force attack on your encrypted password. Increasing scryptn will slow them down (see below) The developer keeps his gocryptfs.conf in the cloud and uses a very strong password.

You can use cppcryptfs to create an encrypted filesystem in a folder. The encrypted filesystem is protected with a password that you choose. When you use cppcryptfs to mount the encrypted filesystem by providing the password, then you have a new drive letter in Windows. This virtual drive letter gives you an unencrypted view of your files. The encryption and decryption are done on the fly and are transparent to applications that use the files on that virtual drive.

After you tell cppcryptfs to dismount the virtual drive letter, then there is no way to get at your unencrypted data unless the filesystem is re-mounted again using your password. If the folder where the encrypted files are kept is being synced with a cloud service, then only the encrypted files with encrypted file names will be uploaded to the cloud service.

This way, neither the employees of the cloud service nor anybody who hacks into the cloud service can use your files. Also, if someone steals your computer and the encrypted filesystem is not mounted, then the thief cannot use your files. Because the encryption is done on a per-file basis instead of using a container file to store the data, you do not have to decide ahead of time how much encrypted storage you will need. cppcryptfs has very minimal storage overhead, and your encrypted filesystem can grow dynamically limited only by the amount of free space on the physical drive on which the encrypted filesystem is located.

Another advantage of per-file encryption over container-based encryption is that per-file encryption syncs very quickly and efficiently with cloud-based services. The developer has been using cppcryptfs in forward (normal) mode for over three years and hasn't lost any data. At least one other person is using it.

cppcryptfs passes 506/506 tests in winfstest when run as administrator. Without administrator privileges, cppcryptfs passes 500/506 tests. This winfstest is forked from the version used by the Dokany project. The Dokany team added additional tests. The tests that cppcryptfs fails when run without administrator privileges have to do with operations on DACLs (Discretionary Access Control Lists). cppcryptfs must be run as administrator for these operations to work. Running without administrator privileges doesn't seem to affect the normal usage of cppcryptfs.

Note: It appears that Windows 10 Version 1909 (OS Build 18363.1016) allows cppcryptfs to pass all 506 tests without having to be run as administrator. cppcryptfs doesn't require administrator privileges to run, but if it is not running as administrator, then it won't be able to acquire the SE_SECURITY_NAME privilege. SE_SECURITY_NAME is needed for some operations performed by the Windows API functions SetFileSecurity() and GetFileSecurity().

cppcryptfs seems to work without SE_SECURITY_NAME. If you do run into problems, then you can try running cppcryptfs as adminstrator and see if that helps. On Windows, you should encrypt the pagefile to avoid leaking sensitive data on disk. Run the following command in CMD.exe as administrator: fsutil behavior set EncryptPagingFile 1 first.

You need to find or create a directory to be the root of your filesystem. You can create a directory in the directory selector in the UI. If you are using reverse mode, then the directory need not be empty (see the section on Reverse Mode in this document which follows this section).

Then you need to choose a (hopefully strong) password and repeat it. The dialog box will accept at most 255 characters for the password. The password field class treats one character as special. This character looks like a small x, but not the same. It's unicode 215 which is 0xd7 in hex.

You can choose to have your file names encryped using AES256-EME or not to encrypt the file names (plain text). If "Long file names" is checked, then the names of files and directories can be up to 255 characters long when encrypted file names are used. This option has no effect if plain text file names are used (plain text file names can be up to 255 characters long). See the section "File name and path length limits" near the end of this document for more information.

If a "Long name max" value that is less than 255 is selected (minimum value is 62), then cppcryptfs will limit filename length. Even when 62 is selected, file names created will be up to 67 characters long. This option is useful when using cloud services that have problems with filenames that are above a certain length. If "Deterministic names" is checked, then cppcryptfs will not use DirIV files. The folowing explanation is lifted from the gocryptfs man page: You can choose between AES256-GCM, AES256-SIV (RFC 5297), or XChaCha20-Poly1305 for file data encryption. The default is AES256-GCM which is recommended. GCM is about twice as fast as SIV for streaming reads and writes. SIV was implemented in order to support reverse mode.

3. Software Implementation, Frameworks & Protocols Note: In the gocryptfs documentation, the SIV mode is referred to as AES-512-SIV, which is the proper name for this mode of operation. However, it is called AES256-SIV in cppcryptfs because the 512-bit SIV key is derived from the 256-bit master key (as is the case with gocryptfs). Also, the developer of cppcryptfs doesn't want to call it AES512-SIV in the user interface because that might cause users to think that it is more secure than AES256-GCM.

If you check Reverse then you will be creating a Reverse Mode filesystem. See the section in this document about Reverse Mode for more information. If you wish, you can specifiy a config file. This is the file that contains the settings for the filesystem and also the random 256-bit AES master key that is encrypted using your password. The config file file can be kept outside the encrypted filesystem for an extra degree of security.

When you click on the "Create" button, config file will be created. It will be created as gocryptfs.conf in the root directory of the encrypted filesystem unless you specified an alternate config file. Unless you choose to use plain text file names, a gocryptfs.diriv will also be created there. Be sure to back up these files in case they get lost or corrupted. You won't be able to access any of your data if something happens to gocryptfs.conf. gocryptfs.conf will never change for the life of your filesystem unless you change the volume label (see bellow).

If you choose to give the volume a label, then the label will be encrypted in gocryptfs.conf. The maximum volume label length is 32 characters. The volume label is AES256-GCM encrypted using the master key and a 128-bit random initialization vector and 8 zero bytes of auth data. Then it is base64 encoded along with the initilization vector and saved in gocryptfs.conf.

You can right click on the mounted drive letter in File Explorer, select "Properties", and change the volume label. However, doing so will cause cppcryptfs to re-write gocryptfs.conf when the drive is dismounted. This does entail some risk to your gocryptfs.conf. Again, it's a good a idea to back up your gocryptfs.conf file somewhere. The "Disable named streams" option may be needed if the underlying filesystem (e.g. a Linux filesystem shared via Samba) does not support named streams. cppcryptfs normally automatically detects (at mount time) if the underlying filesystem supports named streams. However, in some configurations, the underlying filesystem is reporting that it supports named streams when it actually does not. The developer has tested with Ubuntu 16.04 Samba and does not have this problem. This feature was added to help a user who was having this problem with a different Linux version. Please see #63 if you are having issues with Samba and would like to retro-actively disable named streams after creating your filesystem.

Then go to the "Mount" tab and select a drive letter and select the folder you just created the filesystem in. Then enter the password and click on the "Mount" button. You can also right-click in the list of drive letters and select "Add Mount Point". This will let you add an empty directory to the list of drive letters. This empty directory, which must be on an NTFS volume, can serve as a mount point in place of a drive letter. The added mount point will be added to the list below the drive letters. You can also right click on an added mount point and delete it from the list. The mount point directories you add are saved in the Windows registry.

NOTE: Though A: and B: are useable as mount points, it is not recommended to use them because mounting an encrypted filesystem to them has been known to cause problems with Windows Update. You can also right-click on a mounted filesystem and dismount it or view its properties. If you specified a custom path for the config file when you created the filesystem, then you must specify it here also.

If you specified a custom path for the config file, you must also select "reverse" if it is a reverse filesystem. Otherwise, cppcryptfs will automatically detect if the filesytem should be mounted in forward or reverse mode. Note: cppcryptfs uses the path to the encrypted filesystem as a key for rembering the custom path to the config file (if there is one) and other settings like reverse and read only. So when you select a path to mount, be sure to verify that these settings are what you wish to use this time.

For information about "scryptn" see the documentation for the --scryptn parameter for cppcryptfsctl. After you mount the filesystem, you will then have a new drive letter, and you can use it like a normal drive letter and store your sensitive information there. The data is encrypted and saved in files in the folder you specified. If you check "Read-only", then the filesystem will be mounted read-only (write-protected).

For an explanation of how saved passwords work in cppcryptfs, please see the section on "Saved Passwords" below. If you check "Auto mount" (which needs a saved password to work), then the next time you start cppcryptfs, that path will be mounted to that mount point upon startup. You must have saved the password for that mount for this to work. The path will continue to automount until you manually mount it with "Auto mount" unchecked.

For technical details of the cryptographic design of gocryptfs, please visit the gocryptfs project page . When you are finished using the drive letter, go to the "Mount" tab and select the drive letter and click on "Dismount" or click "Dismount All". The drive letter(s) will be dismounted, and the encryption keys will be erased from memory. You can mount as many gocryptfs filesystems as you have unused drive letters available.

Passwords and keys are locked in memory using VirtualLock(). When they are no longer needed, they are erased using SecureZeroMemory() and then unlocked. If you never hibernate your computer, then you don't have to worry about your passwords or keys ever being written to the hard drive. If you close the cppcryptfs window, then it will hide itself in the system tray. To exit cppcryptfs, use the Exit button on the mount page or the context menu of the system tray icon.

Changing values on the settings tab affects all filesystems that are subsequently mounted. Any filesystems that are already mounted will not be affected. The current settings are stored in the Windows registry and will be used the next time a filesystem is mounted, even from the command line.

This setting controls the maximum size of reads and writes that cppcryptfs does on the underlying filesystem. cppcryptfs actually does I/O in multiples of the encrypted block size, which is 4,128 bytes. So when you specify 4KB, the buffer size is really 4,128 bytes, and when you specify 1024KB, the buffer size is really 1,056,768 bytes. 4. Practical Deployment, Analysis & Case Studies cppcryptfs caches information about the filesystem. If an entry in a cache is older than the time to live, then that entry is re-validated before it is used.

Increasing the cache time to live or setting it to infinite will result in better performance. However, if you are constantly syncing your cppcryptfs filesystem with another copy of the filesystem that is on a another computer running under another instance of cppcryptfs or gocryptfs, then setting the time to live to too high of a value may result in errors if the filesystem is modified on the other computer.

If you are not syncing the filesystem between two concurrently running instances of cppcryptfs or between an instance of cppcryptfs and an instance of gocryptfs, then there is no reason to not set the cache time to live to a high value or to infinite. If this option is on, then more than one thread can process requests for each filesystem. This may result in improved performance. Dokany automatically chooses the number of threads it will use.

If this option is disabled, then only one thread per-filesystem will be used to process requests. This option has effect only in forward mode and only when encrypted file names are used. Reverse-mode filesystems with encrypted file names are always case-sensitive, and filesystems with plain text file names are always case-insensitive. Normally, when file name encryption is used, cppcryptfs requires that files and directories be opened using the same case that was used when the files and directories were created.

If the case insensitive option is checked, then cppcryptfs will ignore the case of file and directory names, in forward mode, even when file name encryption is used. This is how the Windows API normally operates. Also, performance will be a little slower. This setting is not currently enabled when either Defaults or Recommended settings are chosen. You must enable it separately if you wish to use it. It has not been tested thoroughly.

This setting enables the Windows Mount Manager on the encrypted volume. Enabling mount manager enables the recycle bin. This setting works only if cppcryptfs is run as administrator. If you try to mount a filesystem with this setting checked and cppcryptfs is not running as administrator, then cppcyrptfs will display a warning dialog (which can be disabled) and will not enable the mount manager.

This setting has no effect on reverse filesystems or when filesystems are mounted read-only. Note: If you are syncing the encrypted files of your filesystem with Dropbox, then if you enable mount manger (recycle bin), then Dropbox will not be able to sync the files in the recycle bin because it does not have sufficient privileges. You should either run Dropbox as Administrator, or you should determine which encrypted folder name is the name of the recycle bin and exclude it using the selective sync feature of Dropbox. If you are using plaintext file names, then the recycle bin will be simply "$RECYCLE.BIN". The --list command line switch, if given the (unencrypted) path to the root directory of the filesystem as an argument, can be used to find the encrypted name of the recycle bin.

This setting enables the saving of passwords. Please see the section on Saved Passwords below for more information about saved passwords. When this setting is on, the "Save password" checkbox in the mount tab will be usable. If the "Enable saved passwords" setting is changed from checked to unchecked, then cppcryptfs asks if all saved passwords should be deleted.

This setting prevents cppcryptfs from saving any values in the Windows registry except the values described on this page. E.g. it will prevent the saving of paths in the history and from saving passwords even if saved passwords has been enabled. When this setting is checked, all values stored by cppcryptfs in the Windows registry will be deleted except for the settings described on this page except for saved passwords. However, no new passwords will be saved while this setting is in effect.

This setting was created for #62 . It was reported that Google Drive can create hidden desktop.ini files in every directory in the source folder of encrypted files. These files were preventing users from deleting directories from the un-encrypted side. If the filesystem is mounted with this setting on, then cppcryptfs will automatically delete unencrypted desktop.ini files when deleting a directory.

This setting has effect only in forward mode and only if encrypted filenames are used. If this setting is enabled, then when an encrypted volume is mounted, it will automatically be opened using the default Windows file management program which is is normally File Explorer. When this setting is enabled, cppcryptfs keeps the encryption keys (the primary key and any derived keys) encrypted using the Windows Data Protection API (DPAPI) when they are not needed. The keys are encrypted using DPAPI, and they are unencrypted when needed and then the unencrypted copies are zeroed out when not needed. See the section on "Saved Passwords" below for more information about DPAPI.

This setting reduces the chance of malicious software being able to read the unencrypted keys from cppcyrptfs's process memory. Also, this setting prevents the unencrypted keys from ending up on disk in the hibernation file if the system goes into hibernation.

This setting is brand new, and any bugs in its implementation could cause data loss . It is recommened to use this setting only if you make frequent backups of your encrypted filesystems. It is recommended to use "Cache Keys in Memory" (see below) with this setting. Otherwise there will be a signficant impact on performance if you do not enable "Cache Keys in Memory".

When this setting is enabled and encrypt keys in memory is also enabled, then cppcryptfs will cache the unencrypted keys between uses for up to one second. This setting reduces the performance impact of "Encrypt Keys in Memory" to essentially zero. Without this setting enabled, encrypt keys in memory significantly reduces performance.

When the system is about to enter standby or hibernation modes, cppcryptfs automatically disables the cache so when the system enters the low power mode, the unencrypted keys won't be in memory. The cache is automatically re-enabled when the system wakes up. Previously, cppcryptfs would always wait for Dokany to call back to indicate whether or not a mount operation succeeded or failed.

5. Performance Evaluation & Extended Technical Observations Dokany was taking typically 5 seconds to call back. However, the filesystem appeared to be mounted and available almost instantly. When Enable fast mounting is turned on, cppcryptfs will both wait for Dokany's callback and periodically check (poll) to see if the filesystem is mounted. If cppcryptfs discovers that the filesystem appears to be mounted, then cppcryptfs will stop waiting on Dokany and assume the mount operation succeeded. If this setting is disabled, then cppcryptfs will only wait for the callback from Dokany.

With this setting enabled, a successful mount operation is indicated as such on the developer's machine in about 31 milliseconds instead of 5 seconds as before. Note: this setting has no effect when the mount point is an empty NTFS directory and not a drive letter. Dokany signals a successful mounting quickly if the mount point is a directory, and polling doesn't make sense in this case.

If this setting is on, then if there are still any open files or directories on a mounted filesystem when the user tries to dismount the filesystem, dismount all filesystems, or exit the program, then cppcryptfs will notify the user and ask if it should proceed with dismounting. If this setting is on, then the --force flag is needed on the command line when dismounting filesystems that are in use.

If this setting is enabled, then encrypted volumes will be accessible only in the session that started the instance of cppcryptfs that mounted them. Any drive letters used for mounting will still be visible to other sessions, but they will not be accessible to them. The check is done only in calls to the CreateFile API (which both creates new files and directories and opens existing ones).

Denying access to other sessions only in CreateFile appears to be sufficient. The scope of testing of this feature makes the developer confident that this setting makes a mounted volume safe from access by an another ordinary logged-on user who is sharing the same computer and logged into a different session. However, it is not certain that a determined and knowlegable attacker would not be able to find a way to circumvent this protection.

If this setting is enabled, then encrypted volumes will not be accessible by Windows services running in session 0. It is possible for Windows services running under the system account or processes created by users with the "Act as part of the operating system" user right to create access tokens and set whatever session id they want in them. So this protection is not absolute but should prevent Windows services from accessing mounted filesystems in normal use situations.

These buttons restore all settings to either the default settings or the recommended settings. Pressing the Reset Warnings button will turn back on any warning dialogs which were previously disabled by selecting "don't show this message again". A user reported that they were getting timeouts when copying lots of data to an external drive that was formatted using the exFAT filesystem.

The workaround is to enable flush after write. When this setting is on, cppcryptfs will force Windows to write data to disk after every write operation cppcryptfs is asked to do. This option reduces write performance noticeably. For copying large files, it's about 50% worse. For lots of small files, it's much worse than that.

The setting is on if any of the condidtions are true, so to enable it always, one could check both the "NTFS" and "Not NTFS" boxes. Here you can change the language of the interface. After changing it, you must go to the mount tab and exit the program and then restart it for the change to take effect.

If the "Enable saved passwords" setting is enabled in the settings tab, then the "Save passwords" check box on the mount tab will be usable. When cppcryptfs saves passwords, it uses the Windows Data Protection API (DPAPI) to encrypt the passwords. The Windows DPAPI is described here.

Data encrypted using Windows DPAPI is only as secure as the strength and security of the password used for logging into Windows. To save a password, make sure the "Save password" box is checked when you mount the filesystem. To mount the filesystem without typing the password, make sure "Save password" is checked, and then either select the path from the path history, in which case the password for that path (if found) will be filled in (displaying as dots) in the password field. Or, if instead of selecting the path, you type it in the path field and press the mount button without typing a password, then if the saved password for that path is found, it will be used.

The -P command line option can be used to mount filesystems from the command line using the saved password for that path. In reverse mode, the source (root) directory used for the filesystem consists of unencrypted files. When this directory is mounted, then the cppcryptfs drive letter provides an on-the-fly encrypted view of these files. Reverse mode also gives a view of the config file (as gocryptfs.conf), and if encrypted file names are used, a gocryptfs.diriv file in each directory. And if long file names are used with encrypted file names, then the special long file name files are also presented.

When you create a reverse mode filesystem, the root directory of the filesystem doesn't have to be empty (unlike in the case of creating a normal forward mode filesystem). cppcryptfs will create the config file in the root directory of the filesystem. This is a hidden file named .gocryptfs.reverse.conf (instead of an unhidden gocryptfs.conf which is used in normal/forward mode). When you go to mount a filesystem, cppcryptfs first looks for .gocryptfs.reverse.conf, and if it finds it, then it will mount the filesystem in reverse mode. If it doesn't find .gocryptfs.reverse.conf, then it will try to open gocryptfs.conf, and if it succeeds, then the filesysem will mounted in forward (normal) mode.

If you specified a custom path for the config file, then you must check "reverse" to mount the filesystem in reverse mode. If you mount a reverse filesystem and then copy the whole directory tree to some other location, you can then mount that copy (which contains encrypted files and the normal mode config file and other support files) as a forward (normal) filesystem. Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/VirtualBox • https://en.wikipedia.org/wiki/USB%20flash%20drive • https://en.wikipedia.org/wiki/BitLocker • https://github.com/bailey27/cppcryptfs