I have all my VMs encrypted, i wanted to drag/drop data from VM A to VM B.
I added VM A´s VDI into VM B´s VDI (virtual box manager gui)
Noticed bitlocker was still active on VM A (dont worry this in itself is not the issue), shut down VM B so i can undo Bitlocker.
Boot VM A, error disk/boot manager cant be found.
Check VM A status, says not encrypted.
So during boot it doesnt prompt me with the usual password window = everything stays encrypted.
Well i still know the password i gave it, i used to use this VM for half a year without issues.
Is there any way i can save this?
If you need any logs or more info please let me know, thank you!
Help, VDI file lost its encryption status = cant boot anymore
Re: Help, VDI file lost its encryption status = cant boot anymore
You would need to explain this much more precisely. You talk about bitlocker which has nothing to do with the VDI encryption. The key store for VDIs is kept in the VM config file. If you lost it then that's really bad, because the image encryption by VirtualBox is really secure. The only way would be to brute force a randomly generated binary key with at least 128 bits. Not feasible within any reasonable budget.
Re: Help, VDI file lost its encryption status = cant boot anymore
The bitlocker part was just to explain why i did certain things in that order.
I have not manually decrypted the VM at all, i only added it to my new VM to move files over.
After this i noticed upon boot it doesnt ask me for a password anymore, which leads to a failed boot (obviously).
Then i checked the the vbox file, CRYPT/KEYSTORE entries are completely missing.
I already thought that this would be the end but it would be nice to know what i did wrong to avoid such problems in the future.
Here is exactly what i did:
1. I used the "Storage" option to add VM1 VDI (encrypted) to VM2 (encrypted)
2. Upon VM2 boot i expected the program to ask me for both passwords. It only asked for one (VM2). Thought it might be because of bitlocker so i wanted to disable that on VM1.
3. Wanted to boot VM1 again
4. No password - says unencrypted while contents are still encrypted / missing CRYPT/KEYSTORE entries.
I have not manually decrypted the VM at all, i only added it to my new VM to move files over.
After this i noticed upon boot it doesnt ask me for a password anymore, which leads to a failed boot (obviously).
Then i checked the the vbox file, CRYPT/KEYSTORE entries are completely missing.
I already thought that this would be the end but it would be nice to know what i did wrong to avoid such problems in the future.
Here is exactly what i did:
1. I used the "Storage" option to add VM1 VDI (encrypted) to VM2 (encrypted)
2. Upon VM2 boot i expected the program to ask me for both passwords. It only asked for one (VM2). Thought it might be because of bitlocker so i wanted to disable that on VM1.
3. Wanted to boot VM1 again
4. No password - says unencrypted while contents are still encrypted / missing CRYPT/KEYSTORE entries.
Re: Help, VDI file lost its encryption status = cant boot anymore
I'm sure it's pretty obvious now, but always, always, always back up your .vbox file after encrypting a VDI. You can also just back up the key somewhere (like in a password manager). Then if something goes wrong you can paste it back into the .vbox file.
Whenever the .vbox file is saved, the previous version is stored in the VM folder with the extension .vbox-prev, but unless you grab it immediately upon noticing a problem, it will likely already have been overwritten again.
I have recovered from this situation in the past, but it takes a long time. You can use a hex editor to scan the entire physical disk for something unique in the .vbox file (e.g. the name or UUID). Then you can hopefully find a deleted copy of it with the encryption key intact. This won't work if deleted files get zeroed out though (like on an SSD with TRIM support).
A few additional observations for the devs:
1. There is no technical reason why you shouldn't be able to add the VDI to another VM, provided you don't remove it from the original. Alternatively, it could simply be prohibited. I feel this is a bug that it doesn't do one or the other.
2. Trying to remove an encrypted VDI from a VM is as bad as deleting it. In fact, any operation that will cause the key to be lost should cause a sufficiently-scary warning to the user.
3. The encryption key should never have been in the .vbox file to begin with. It makes far more sense, and would be far safer, if the VDI spec were updated to include it. A separate key file with a different extension would work as well, but is less ideal.
Whenever the .vbox file is saved, the previous version is stored in the VM folder with the extension .vbox-prev, but unless you grab it immediately upon noticing a problem, it will likely already have been overwritten again.
I have recovered from this situation in the past, but it takes a long time. You can use a hex editor to scan the entire physical disk for something unique in the .vbox file (e.g. the name or UUID). Then you can hopefully find a deleted copy of it with the encryption key intact. This won't work if deleted files get zeroed out though (like on an SSD with TRIM support).
A few additional observations for the devs:
1. There is no technical reason why you shouldn't be able to add the VDI to another VM, provided you don't remove it from the original. Alternatively, it could simply be prohibited. I feel this is a bug that it doesn't do one or the other.
2. Trying to remove an encrypted VDI from a VM is as bad as deleting it. In fact, any operation that will cause the key to be lost should cause a sufficiently-scary warning to the user.
3. The encryption key should never have been in the .vbox file to begin with. It makes far more sense, and would be far safer, if the VDI spec were updated to include it. A separate key file with a different extension would work as well, but is less ideal.
Re: Help, VDI file lost its encryption status = cant boot anymore
(Just my 2c on why the key store was placed in the .vbox file and not in the images: VirtualBox supports multiple image formats, and disk encryption is entirely format agnostic. Adding the key store to just VDI images would not have achieved this flexibility. Besides, a typical multi-disk VM will use one key for multiple disk images.)
Re: Help, VDI file lost its encryption status = cant boot anymore
Yeah klaus, I think you are right about why it is the way is. The different virtual disk formats already have different feature sets, but every situation in which they can be treated the same simplifies the code.
Every encrypted disk has a KeyId and KeyStore in the .vbox file. You only get a single password prompt for any disks with a matching KeyId (which is the VM name by default). But I think the KeyId could be a UUID instead, and placed alongside the KeyStore in a separate key file (e.g. "NameOfVirtualDisk.key" or whatever). Then a single password prompt could still be shown whenever the KeyIds match, even if disks get moved around to different VMs. And instead of the KeyId, the password prompt could just list all the disk names the prompt is for. It would be so much safer to pull that stuff out of the .vbox file. Anyway, just a thought.
Every encrypted disk has a KeyId and KeyStore in the .vbox file. You only get a single password prompt for any disks with a matching KeyId (which is the VM name by default). But I think the KeyId could be a UUID instead, and placed alongside the KeyStore in a separate key file (e.g. "NameOfVirtualDisk.key" or whatever). Then a single password prompt could still be shown whenever the KeyIds match, even if disks get moved around to different VMs. And instead of the KeyId, the password prompt could just list all the disk names the prompt is for. It would be so much safer to pull that stuff out of the .vbox file. Anyway, just a thought.