开发者

Which API is used for encryption of hibernation files on Windows?

开发者 https://www.devze.com 2023-04-09 14:12 出处:网络
The following is quoted from the \"Security improvements\" section of th开发者_JAVA百科is article.

The following is quoted from the "Security improvements" section of th开发者_JAVA百科is article.

"In response to our public complaint regarding the missing API for encryption of Windows hibernation files, Microsoft began providing a public API for encryption of hibernation files on Windows Vista and later versions of Windows..."

However, googling failed to reveal more information such as the name of the API. Perhaps I am googling on the wrong terms... Does anybody has any ideas?


From IRP_MN_DEVICE_USAGE_NOTIFICATION

System components send this IRP to ask the drivers for a device whether the device can support a special file. Special files include paging files, dump files, and hibernation files. If all the drivers for the device succeed the IRP, the system creates the special file. The system also sends this IRP to inform drivers that a special file has been removed from the device.

Of course, this only matters if you write a Crash Dump Filter Driver like TrueCrypt and handle file system driver operations like IRP_MJ_READ/IRP_MJ_WRITE and encrypt the file data somehow.


I'm pretty sure MS uses BitLocker to encrypt the system volume including system and hibernation files.

http://technet.microsoft.com/en-us/library/cc734125%28WS.10%29.aspx

The necessary file to include is called fveapi.dll

0

精彩评论

暂无评论...
验证码 换一张
取 消