Is the volume a full-volume BitLocker volume or a BitLocker To Go volume?
Which protectors are recorded: recovery password, startup key, TPM or password?
Is the volume master key stored only in encrypted form, or as a clear key?
03Format and versions
Format
Volume header: 3-byte boot entry point, the 8-byte signature -FVE-FS- at offset 3, and the 0x55 0xAA sector signature at offset 510. Metadata blocks are found through offsets in the header.
Applies to
Windows 7 and later, as stated in the source. BitLocker To Go volumes carry MSWIN4.1 in the same position. Vista uses a different boot entry point.
04Key fields
Field
What it tells you
-FVE-FS- signature
Eight bytes at offset 3 of the volume header, labelled as the file system signature in the source; BitLocker To Go uses MSWIN4.1 there.
Metadata block offsets
Three offsets in the volume header (bytes 176, 184 and 192 on Windows 7 and later) that point to the FVE metadata blocks.
Protection type
Value that states how the volume master key is protected: recovery password (0x0800), startup key (0x0200), TPM (0x0100), password (0x2000), or clear key.
05Examination workflow
Read the first 512 bytes of the volume from the image, without mounting it, and record the signature and its offset.
Read the three metadata block offsets and check the protection types before any other step.
Record which key material is lawfully available, such as a recovery key the owner provides, and its source; do not guess keys.
06Interpretation pitfalls
The header identifies the scheme; it does not show whether the volume was unlocked, used or wiped. Those states come from other records.
Protection types come from metadata; they do not show who enabled the protection.
MSWIN4.1 marks BitLocker To Go, not a full-volume BitLocker volume; do not read it as a full-volume signature.
Vista uses a different boot entry point, so check the Windows version before applying the offsets above.
Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.
