Conversation
There was a problem hiding this comment.
Pull request overview
Adds support for parsing BitLocker (FVE) recovery information objects from NTDS and exposes them via the existing NTDS object model.
Changes:
- Introduces a new
MSFVERecoveryInformationNTDS object with convenience accessors for volume/recovery GUIDs, recovery password, and key package. - Adds
Computer.fve_recovery_information()to enumeratemsFVE-RecoveryInformationchild objects for a computer. - Exports
MSFVERecoveryInformationfrom the NTDS objects package.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
dissect/database/ese/ntds/objects/msfve_recoveryinformation.py |
New object wrapper for msFVE-RecoveryInformation with attribute accessors and parent computer linkage. |
dissect/database/ese/ntds/objects/computer.py |
Adds an iterator to yield BitLocker recovery info child objects for a computer. |
dissect/database/ese/ntds/objects/__init__.py |
Registers/exports the new MSFVERecoveryInformation class. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
71cfcba to
b4a462d
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #44 +/- ##
=====================================
Coverage 0.00% 0.00%
=====================================
Files 151 152 +1
Lines 4163 4191 +28
=====================================
- Misses 4163 4191 +28
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
joost-j
left a comment
There was a problem hiding this comment.
Other than a small typing remark and a request to add a simple test to show the usage and functionality, LGTM
| return UUID(bytes_le=self.get("msFVE-RecoveryGuid")) | ||
|
|
||
| @property | ||
| def recovery_password(self) -> str: |
There was a problem hiding this comment.
| def recovery_password(self) -> str: | |
| def recovery_password(self) -> str | None: |
There was a problem hiding this comment.
Either change the typing, or if the msFVE-RecoveryPassword attribute is always present, always return something
Adds parsing of FVE (BitLocker) recovery information. Currently depends on #43 to correctly iterate children objects.