Add NTDS BitLocker recovery information#44
Conversation
There was a problem hiding this comment.
Pull request overview
Adds support for parsing BitLocker (FVE) recovery information objects from NTDS and exposes them via the existing NTDS object model.
Changes:
- Introduces a new
MSFVERecoveryInformationNTDS object with convenience accessors for volume/recovery GUIDs, recovery password, and key package. - Adds
Computer.fve_recovery_information()to enumeratemsFVE-RecoveryInformationchild objects for a computer. - Exports
MSFVERecoveryInformationfrom the NTDS objects package.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
dissect/database/ese/ntds/objects/msfve_recoveryinformation.py |
New object wrapper for msFVE-RecoveryInformation with attribute accessors and parent computer linkage. |
dissect/database/ese/ntds/objects/computer.py |
Adds an iterator to yield BitLocker recovery info child objects for a computer. |
dissect/database/ese/ntds/objects/__init__.py |
Registers/exports the new MSFVERecoveryInformation class. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
71cfcba to
b4a462d
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #44 +/- ##
=====================================
Coverage 0.00% 0.00%
=====================================
Files 150 151 +1
Lines 4293 4325 +32
=====================================
- Misses 4293 4325 +32
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
joost-j
left a comment
There was a problem hiding this comment.
Other than a small typing remark and a request to add a simple test to show the usage and functionality, LGTM
b4a462d to
1f84281
Compare
Adds parsing of FVE (BitLocker) recovery information. Currently depends on #43 to correctly iterate children objects.