core: volume-analysis — BitLocker/To-Go encryption + FAT/exFAT/NTFS serial#14
Merged
Conversation
The volume-analysis foundation for the scheme-agnostic layering (usb-forensic
ADR 0003/0004): the BitLocker/FVE forensic knowledge belongs in the knowledge
base, next to the filesystem-signature catalog, because a volume's encryption is
a property of the volume — identical over USB, FireWire, Thunderbolt, or SATA,
and independent of the MBR/GPT/APM partition table.
`detect_encryption(volume) -> Option<VolumeEncryption>`: `-FVE-FS-` at offset 3 →
BitLocker (fixed drive); else the BitLocker identifier GUID scanned in the volume
header → BitLocker To Go (a FAT/exFAT discovery volume that a filesystem detector
cannot see). Panic-free, MSRV 1.75, spec-cited to libbde. Non-false-positive
control validated against the real NIST CFReDS rm2 FAT stick (returns None).
Next: volume_serial() (FAT BS_VolID / NTFS-serial offsets), then the partition
crates populate {fs, serial, encryption} per partition uniformly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The second half of the volume-analysis foundation (usb-forensic ADR 0003): the
volume serial is a forensic join key (a FAT BS_VolID matches the EMDMgmt/Shell-Link
serial for the same volume) and is a volume property, not a partition-scheme one.
`volume_serial(volume) -> Option<VolumeSerial>`, keyed off the FS signature: NTFS
8-byte serial at 0x48, exFAT at 0x64, FAT32 BS_VolID at 0x43, FAT12/16 at 0x27.
`VolumeSerial::{Short(u32), Long(u64)}` renders XXXX-XXXX / XXXXXXXX-XXXXXXXX.
Panic-free, MSRV 1.75, offsets cited to the Microsoft FAT/exFAT/NTFS specs.
Validated on the real CFReDS rm2 FAT32 stick: reads B4D8-5399 (ground-truth match).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…e_serial Adding two public modules changed the surface; regenerate the committed baseline (cargo public-api 0.52.0) so the public-api tripwire passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jul 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The scheme-agnostic volume-analysis foundation for usb-forensic's layering (ADR 0003/0004). Volume encryption and volume serial are properties of a volume, not the bus or partition table, so the forensic knowledge belongs here in the knowledge base.
volume_encryption::detect_encryption()→ BitLocker (-FVE-FS-) / BitLocker To Go (identifier-GUID scan). A To Go discovery volume looks like plain FAT to a filesystem detector; the GUID is the only tell.volume_serial::volume_serial()→ FATBS_VolID(0x43/0x27), exFAT (0x64), NTFS 8-byte serial (0x48);VolumeSerial::{Short,Long}.Panic-free, MSRV 1.75, offsets/signatures cited to libbde + the Microsoft FAT/exFAT/NTFS specs. Validated on the real NIST CFReDS rm2 stick (encryption None, serial B4D8-5399 — ground-truth match). 35 core tests pass.
Once published, the mbr/gpt/apm partition crates call these to populate {fs, serial, encryption} on every partition uniformly, disk-forensic surfaces it, and usb-forensic's device_image thins to a consumer.
🤖 Generated with Claude Code