gugli / keelocker

KeePass2 plugin to open BitLocker volumes

KeeLocker

KeePass2 plugin to open BitLocker volumes when you open your KeePass database.

Should also work for USB sticks or portable drives.

The feature

This plugin adds the following tab to entries :

How to use

If you have a static drive (let's say a HDD bound to "D:") encrypted with bitlocker, you should :

• create a new entry, choose a title you want
• put the password for the drive in the entry usual password field
• Select "D:" as drive mountpoint in the KeeLocker tab

You can the either tick the checkbox "Unlock volume on opening" that will do so when the Database is opened (but that requires to close then open the DB). Or you can click "Unlock Volume Now" to test it right now.

When should I use Drive GUID ?

The Drive GUID feature is for more complex scenarios.

For example : if you use the same DB on multiple machines, along with a USB stick cyphered using BitLocker. The issue is that on the first machine, you USB stick mounts as "D:", but on another one, it mounts as "E:".

In such cases, the "Drive Mountpoint" is not super useful, so instead of using it, you can use the "GUID", that should work in such scenarios.

keelocker's Issues

Unlock drive when connected if KeePass database is open

If possible, it would be useful to have an option to unlock a drive automatically when it's connected, similar to how it unlocks drives automatically that are already connected when unlocking the database.

Trying to unlock a volume with the context menu has no effect.

Trying to unlock a volume with the context menu has no effect.
Using "Unlock volume now" in the properties page, does work.

I tracked the problem to this line:
https://github.com/Gugli/KeeLocker/blob/main/KeeLocker/Plugin.cs#L257

In my case this is false, as I do not want to open my volumes when starting keepass.

Unlock using recovery key instead of password

I have a few drives that don't have passwords, only identifiers and recovery keys, and the recovery key must be used to unlock them. I'm fairly certain this is due to the drive's being set up to unlock via TPM, and unfortunately passwords can't be added without disabling and reenabling BitLocker. KeeLocker doesn't work with recovery keys, only passwords, and it would be nice if it could either automatically tell if the "password" for a drive is a key and unlock it that way, or if there was a setting to tell it to use the password as a key.

Database opening very slow when unlocking volumes on open

When using KeeLocker to unlock drives upon opening the database, it slows the loading of the database as KeePass becomes unresponsive while the drives are being unlocked. Before using this option, the database would open within a couple seconds, whereas now it takes ~10+ seconds, with KeePass not being responsive and the database not loading until all the drives are unlocked. This feature has been tremendously useful, and I intend to keep using it even with this delay, but it would be nice if something could be done about it, whether optimizing it so it doesn't cause KeePass to essentially lock up or at least delaying the unlocking of the drives until the database is loaded.

it always unlocks automatically

I configured using the GUID and removed Unlock volume on opening but it continues to unlock automatically as soon as I enter DB.
This way it shouldn't unlock the drive without me running

Not working or not using correctly

I don't know how exactly this is supposed to work since there's no documentation, but when I click "Fill drive GUID" it says "Unable to get GUID." I've tried entering the drive letter first, I've tried finding the GUID manually and entering that in there, but nothing makes this plugin work.

This plugin badly misbehaves

When this plugin is used with KeePass, it automatically opens the configured Bitlocker volume when KeePass is opened, even when the "Unlock volume on opening" in its properties is unchecked. This behaviour does not change when not only KeePass but even the system is restarted. I regard this as a major and a very much unwelcome bug, because the Bitlocker-protected volume gets silently opened and stays open without direct knowledge of the user! This is very much bad and dangerous. I'm on Win 11 Ent, latest update, x64.

Alternate methods for unlocking drives

For easily unlocking drives manually, a couple additional methods could be used by KeeLocker. Currently, there are three methods:

• Set it to unlock the drive when unlocking the DB
• Find and open the entry, switch to the KeeLocker tab, and use the "Unlock Volume Now" button
• Find the entry, copy the password, then open File Explorer and open the drive to bring up the BitLocker password box and paste the password into it

I propose the following:

• If possible, have KeePass/KeeLocker auto-detect the BitLocker password boxes and auto-fill them with the appropriate entry's password, or at least enable auto-fill via hotkeys
• Add menu entries to KeePass, one for individual entries to unlock specific drives (including if more than one entry is selected), and one in the (Tools?) menu to unlock all available drives. It might be preferable to open a dialog window to select the drives to unlock, starting with all locked drives checked so the user can uncheck any they don't want to unlock before continuing.
• If the first isn't possible, add an entry to Explorer's context menu to unlock the drive

"Incompatible" error on KeePass 2.50