BitLocker Drive Encryption
| Format | BitLocker Drive Encryption |
|---|---|
| Short name | BitLocker |
| Category | filesystem |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Windows full-volume encryption. The volume keeps a boot sector with the '-FVE-FS-' signature (BitLocker To Go on FAT media: 'MSWIN4.1') and three copies of the FVE metadata, which list the key protectors (TPM, PIN, password, recovery password, startup key) and when the volume was encrypted. The rest is ciphertext, except free space on volumes encrypted 'used space only'; without one of the protectors' secrets the files cannot be read — unless protection is suspended or not yet set up, in which case a clear key is stored unprotected on the volume. BitLocker To Go protects removable drives the same way.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 3 (0x3) | 2D 46 56 45 2D 46 53 2D | -FVE-FS- | BitLocker signature '-FVE-FS-' in the volume boot sector |
| offset unknown | 2D 46 56 45 2D 46 53 2D | -FVE-FS- | FVE metadata block signature (three copies; also on BitLocker To Go volumes) |
Known extensions
None recorded
References
- BitLocker Drive Encryption (BDE) format (libyal/libbde) https://github.com/libyal/libbde/blob/main/documentation/BitLocker%20Drive%20Encryption%20(BDE)%20format.asciidoc
- ForensicsWiki — BitLocker disk encryption https://forensics.wiki/bitlocker_disk_encryption/
- BitLocker overview (Microsoft) https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/
Cite this entry
Crush Format Reference, “BitLocker Drive Encryption”. https://kalink0.github.io/crush-forensics/formats/bitlocker/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction