Skip to content

Add NTDS BitLocker recovery information#44

Merged
Schamper merged 2 commits into
mainfrom
fve-recovery-information
May 5, 2026
Merged

Add NTDS BitLocker recovery information#44
Schamper merged 2 commits into
mainfrom
fve-recovery-information

Conversation

@Schamper
Copy link
Copy Markdown
Member

@Schamper Schamper commented Feb 24, 2026

Adds parsing of FVE (BitLocker) recovery information. Currently depends on #43 to correctly iterate children objects.

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds support for parsing BitLocker (FVE) recovery information objects from NTDS and exposes them via the existing NTDS object model.

Changes:

  • Introduces a new MSFVERecoveryInformation NTDS object with convenience accessors for volume/recovery GUIDs, recovery password, and key package.
  • Adds Computer.fve_recovery_information() to enumerate msFVE-RecoveryInformation child objects for a computer.
  • Exports MSFVERecoveryInformation from the NTDS objects package.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
dissect/database/ese/ntds/objects/msfve_recoveryinformation.py New object wrapper for msFVE-RecoveryInformation with attribute accessors and parent computer linkage.
dissect/database/ese/ntds/objects/computer.py Adds an iterator to yield BitLocker recovery info child objects for a computer.
dissect/database/ese/ntds/objects/__init__.py Registers/exports the new MSFVERecoveryInformation class.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread dissect/database/ese/ntds/objects/msfve_recoveryinformation.py
@Schamper Schamper force-pushed the fve-recovery-information branch from 71cfcba to b4a462d Compare February 24, 2026 21:40
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Feb 24, 2026

Merging this PR will not alter performance

✅ 6 untouched benchmarks


Comparing fve-recovery-information (da21adb) with main (0530d2a)

Open in CodSpeed

@codecov
Copy link
Copy Markdown

codecov Bot commented Feb 24, 2026

Codecov Report

❌ Patch coverage is 0% with 32 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.00%. Comparing base (0530d2a) to head (da21adb).

Files with missing lines Patch % Lines
...base/ese/ntds/objects/msfve_recoveryinformation.py 0.00% 22 Missing ⚠️
dissect/database/ese/ntds/objects/computer.py 0.00% 5 Missing ⚠️
dissect/database/ese/ntds/objects/object.py 0.00% 4 Missing ⚠️
dissect/database/ese/ntds/objects/__init__.py 0.00% 1 Missing ⚠️
Additional details and impacted files
@@          Coverage Diff          @@
##            main     #44   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files        150     151    +1     
  Lines       4293    4325   +32     
=====================================
- Misses      4293    4325   +32     
Flag Coverage Δ
unittests 0.00% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Copy Markdown
Contributor

@joost-j joost-j left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other than a small typing remark and a request to add a simple test to show the usage and functionality, LGTM

Comment thread dissect/database/ese/ntds/objects/msfve_recoveryinformation.py Outdated
@Schamper Schamper force-pushed the fve-recovery-information branch from b4a462d to 1f84281 Compare May 5, 2026 08:18
@Schamper Schamper requested a review from joost-j May 5, 2026 08:27
@Schamper Schamper merged commit d25481c into main May 5, 2026
41 of 42 checks passed
@Schamper Schamper deleted the fve-recovery-information branch May 5, 2026 08:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants