A partition adjustment method, apparatus, device, and computer-readable storage medium

Abstract

This invention discloses a partition reorganization method, apparatus, device, and computer-readable storage medium, applied in the field of disk partition management technology. The method includes: parsing a BitLocker partition to obtain the BitLocker disk boot record location; determining the encrypted NTFS disk boot record location based on the BitLocker disk boot record location using a mapping relationship; parsing the encrypted NTFS disk boot record location based on the full-volume decryption key to obtain the actual file partition; and performing partition reorganization on the actual file partition based on a partition reorganization task and a partition reorganization strategy to obtain the target reorganized partition. The partition reorganization strategy includes a BitLocker metadata fragmentation-free strategy. This application allows for partitioning operations without decrypting the entire partition and protects the BitLocker metadata area, thus improving the efficiency and security of partition reorganization.

Description

Technical Field

[0001] This invention relates to the field of disk partitioning management technology, and in particular to a partitioning adjustment method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] Existing partition management technologies, when dealing with BitLocker-encrypted partitions (BitLocker is a full-disk encryption feature built into the Windows operating system by Microsoft), cannot directly parse the encrypted data structure and employ the following steps: 1. Disable BitLocker encryption using Windows (operating system) management tools; 2. Wait for the partition to be completely decrypted (this may take several hours to several days); 3. Perform a regular Resize / Move operation; 4. After the operation is complete, re-enable BitLocker encryption; 5. Wait for the partition to be re-encrypted. Third-party partitioning software attempting to resize or move such partitions must first disable BitLocker before performing the operation, which is inefficient and fails to maintain BitLocker encryption.

[0003] It is evident that improving the efficiency of partition adjustments is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a partition adjustment method, apparatus, device and computer-readable storage medium, which solves the technical problem of low efficiency in partition adjustment in the prior art.

[0005] To solve the above-mentioned technical problems, the present invention provides a partition adjustment method, comprising:

[0006] Obtain the full-volume encryption key for the BitLocker partition corresponding to the partition resizing task;

[0007] The BitLocker partition is parsed to obtain the location of the BitLocker disk boot record. Based on the location of the BitLocker disk boot record, the location of the encrypted NTFS disk boot record is determined using a mapping relationship.

[0008] Based on the full-volume decryption key, the location of the encrypted NTFS disk boot record is parsed to obtain the actual file partition;

[0009] Based on the partition adjustment task, the actual file partition is adjusted using a partition adjustment strategy to obtain the target adjusted partition; wherein, the partition adjustment strategy includes the BitLocker metadata fragmentation-free strategy.

[0010] Optionally, obtain the full-volume encryption key for the BitLocker partition corresponding to the partition resizing task, including:

[0011] After obtaining the created partition resizing task, determine whether the end position of the NTFS partition to be resized is located in the BitLocker metadata location;

[0012] If it is located in BitLocker's metadata, then the tail position of the NTFS partition to be adjusted is adjusted until the tail position is no longer located in BitLocker's metadata.

[0013] The BitLocker partition is disabled for protection via the BitLocker interface, and a plaintext key is created for the BitLocker partition so that the full-volume encryption key can be deciphered from the plaintext key.

[0014] Optionally, the BitLocker partition is parsed to obtain the location of the BitLocker disk boot record, and the location of the encrypted NTFS disk boot record is determined based on the location of the BitLocker disk boot record using a mapping relationship, including:

[0015] The BitLocker partition is parsed to obtain the location of the BitLocker disk boot record, and the BitLocker disk boot record is determined based on the location of the BitLocker disk boot record;

[0016] The structure of the BitLocker disk boot record is parsed to determine the location and length of the disk boot record pointing to NTFS, and the location and length of the BitLocker metadata are also parsed.

[0017] The location and length of the NTFS disk boot record are determined based on the location and length of the disk boot record pointing to NTFS.

[0018] Optionally, based on the partition adjustment task, the actual file partition is adjusted using a partition adjustment strategy to obtain the target adjustment partition, including:

[0019] Determine the type of the partition adjustment task;

[0020] If the type is to modify only the tail boundary of the partition, then perform a resizing operation to prevent power loss;

[0021] If the type is to correct the partition header, the size of the new partition to be adjusted is compared with the size of the corresponding old partition, and the corresponding partition adjustment strategy is determined based on the comparison result; wherein, the partition adjustment strategy includes moving first and then adjusting the size or adjusting the size first and then moving, and when performing the resizing operation, if the data to be moved belongs to BitLocker metadata, it is adjusted in a fragment-free manner.

[0022] Optionally, if the type is to correct the partition header, the size of the new partition to be adjusted is compared with the size of the corresponding old partition, and the corresponding partition adjustment strategy is determined based on the comparison result, including:

[0023] When performing a move operation, if it is determined that NTFS is to be parsed, then the encryption and decryption functions based on the plaintext key are initiated;

[0024] When it is determined that block data transfer is to be performed, the encryption and decryption functions based on the plaintext key are turned off.

[0025] Optionally, if the type is to correct the partition header, the sizes of the new partition to be adjusted and the old partition are compared, and the corresponding partition adjustment strategy is determined based on the comparison result, including:

[0026] When the size of the new partition to be adjusted is larger than the size of the old partition, it is determined to move it first and then adjust its size.

[0027] If the size of the new partition to be adjusted is not greater than the size of the old partition, then the size is adjusted first and then the partition is moved.

[0028] Optionally, after performing partition adjustment on the actual file partition using the partition adjustment strategy based on the partition adjustment task to obtain the target adjustment partition, the method further includes:

[0029] Based on the target partition adjustment, determine the location of the new BitLocker metadata, and regenerate the new BitLocker metadata and the new BitLocker disk boot record based on the location of the new BitLocker metadata;

[0030] Delete the plaintext key to restore the encryption protection state.

[0031] This invention also provides a partition adjustment method, including:

[0032] Obtain the full-volume encryption key for the BitLocker partition corresponding to the partition resizing task;

[0033] The BitLocker partition is parsed to obtain the location of the BitLocker disk boot record. Based on the location of the BitLocker disk boot record, the location of the encrypted NTFS disk boot record is determined using a mapping relationship.

[0034] Based on the full-volume decryption key, the location of the encrypted NTFS disk boot record is parsed to obtain the actual file partition;

[0035] Based on the partition adjustment task, the actual file partition is adjusted using a partition adjustment strategy to obtain the target adjusted partition; wherein, the partition adjustment strategy includes the BitLocker metadata fragmentation-free strategy.

[0036] This invention also provides a partition adjustment device, comprising:

[0037] Memory, used to store computer programs;

[0038] A processor for executing the computer program to implement the steps of the partition adjustment method described above.

[0039] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the partition adjustment method described above.

[0040] The invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the partition adjustment method described above.

[0041] As can be seen, this invention obtains the full-volume encryption key of the BitLocker partition corresponding to the partition remodeling task; parses the BitLocker partition to obtain the location of the BitLocker disk boot record; determines the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record using a mapping relationship; parses the location of the encrypted NTFS disk boot record based on the full-volume decryption key to obtain the actual file partition; and performs partition remodeling on the actual file partition based on the partition remodeling task using a partition remodeling strategy to obtain the target remodeled partition; wherein, the partition remodeling strategy includes a BitLocker metadata fragmentation-free strategy.

[0042] The beneficial effects of this invention are as follows: Compared with the current method of needing to close BitLocker before performing operations, this application does not require closing BitLocker. It can obtain the actual file partition based on the plaintext key. When adjusting the actual file partition, it can identify and protect the BitLocker metadata area, ensuring that the metadata is not fragmented. Furthermore, it can perform partitioning operations without decrypting the entire partition, thus improving the efficiency and security of partition adjustment.

[0043] In addition, the present invention also provides a partition adjustment device, equipment and computer-readable storage medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0045] Figure 1 A flowchart of a partition adjustment method provided in an embodiment of the present invention;

[0046] Figure 2 A schematic diagram of a technical framework using BitLocker parsing and IO takeover provided in an embodiment of the present invention;

[0047] Figure 3 A flowchart illustrating a partition adjustment method provided in an embodiment of the present invention;

[0048] Figure 4 A schematic diagram of a mapping method provided in an embodiment of the present invention;

[0049] Figure 5 This is a schematic diagram of a power failure prevention operation process provided in an embodiment of the present invention;

[0050] Figure 6 This is a schematic diagram of a resize operation process provided in an embodiment of the present invention;

[0051] Figure 7 This is a schematic diagram of a Move operation process provided in an embodiment of the present invention;

[0052] Figure 8 This is a schematic diagram of the structure of a partition adjustment system provided in an embodiment of the present invention;

[0053] Figure 9 This is a schematic diagram of the structure of a partition adjustment device provided in an embodiment of the present invention;

[0054] Figure 10 This is a schematic diagram of a partition adjustment device provided in an embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Some terms that appear in the description of the embodiments of this application are subject to the following interpretation:

[0057] Protector: The authentication method set during BitLocker encryption and decryption, including the user-defined "user key", "recovery key", TPM (Trusted Platform Module) key, etc.

[0058] VMK (Volume Master Key): An intermediate key used to decrypt FVEK.

[0059] FVEK (Full Volume Encryption Key): The key actually used for encrypting / decrypting data sectors.

[0060] DBR (DOS Boot Record): A boot information structure stored in the first sector of a partition.

[0061] Plaintext Key: An unencrypted key used for debugging or special operation scenarios.

[0062] Metadata: A data structure that stores BitLocker configuration, status, and key information.

[0063] IO mapping: A technique that redirects access to a specific sector to another location.

[0064] BitLocker is a full disk encryption (FDE) feature built into Microsoft's Windows operating systems (Professional, Enterprise, and Education editions). Its main purpose is to protect all data stored on a computer's hard drive and prevent data leakage in the event of device loss, theft, or unauthorized access.

[0065] Please refer to Figure 1 , Figure 1 A flowchart illustrating a partition adjustment method provided in an embodiment of the present invention. The method may include:

[0066] S101, Obtain the full-volume encryption key for the BitLocker partition corresponding to the partition resizing task.

[0067] Each step in this embodiment can be performed by a designated electronic device, which can be a server, portable terminal, or other form. The partition resizing task in this embodiment includes at least one of Resize and Move operations on the NTFS partition. This embodiment does not limit the specific method of obtaining the global encryption key. The user-defined protector information (user password, recovery key, external key BEK, plaintext key, etc.) is extracted, and the FVEK (full volume encryption key) is decrypted based on the current protector. For example, this embodiment can determine the plaintext key of the BitLocker partition corresponding to the partition resizing task, and obtain the full volume encryption key corresponding to the BitLocker partition based on the plaintext key. The plaintext key is the key created by BitLocker for the partition during the preparation phase. The full volume encryption key in this embodiment is the key used for NTFS data sector encryption / decryption. NTFS (New Technology File System) is the file system for the Windows NT environment. The New Technology File System is a Windows-restricted file system (the file system of the drive where the operating system is located must be formatted as an NTFS file system in a 4096-cluster environment). NTFS replaced the older FAT file system. It should be noted that this embodiment does not limit the order of the steps, as long as they are logically consistent. For example, S101 and S102 can be processed in parallel.

[0068] It should be further noted that, based on any of the above embodiments, the acquisition of the full-volume encryption key of the BitLocker partition corresponding to the partition adjustment task may include:

[0069] S1011, After obtaining the created partition remodeling task, determine whether the end position of the NTFS partition to be remodeled is located in the BitLocker metadata position;

[0070] S1012, if it is located in BitLocker's metadata location, then adjust the tail position of the NTFS partition to be adjusted until the tail position is no longer located in BitLocker's metadata location.

[0071] S1013 disables protection for the BitLocker partition through the BitLocker interface and creates a plaintext key for the BitLocker partition so that the full-volume encryption key can be deciphered from the plaintext key.

[0072] After creating the task, this embodiment determines whether the relative position of the partition's tail falls exactly on the BitLocker metadata location. If so, it performs fine-tuning to avoid fragmentation of the BitLocker metadata. This metadata is a piece of data that will be referred to as a "metadata file" when performing file operations. This step is achieved by analyzing the overlap between the new boundary position of the partition (i.e., the NTFS partition to be adjusted) and the BitLocker metadata storage area.

[0073] S102, parse the BitLocker partition to obtain the location of the BitLocker disk boot record, and use the mapping relationship to determine the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record.

[0074] In this embodiment, the location of BitLocker's disk boot record is the same as the location of BitLocker's DBR. The mapping relationship in this embodiment is a mapping relationship between the location of BitLocker's disk boot record and the corresponding location of the encrypted NTFS disk boot record.

[0075] It should be further explained that, based on any of the above embodiments, the above-described parsing of the BitLocker partition to obtain the location of the BitLocker disk boot record, and determining the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record using a mapping relationship, may include: parsing the BitLocker partition to obtain the location of the BitLocker disk boot record; determining the BitLocker disk boot record based on the location of the BitLocker disk boot record; parsing the structure of the BitLocker disk boot record to determine the location and length of the disk boot record pointing to NTFS, and parsing out the location and length of the BitLocker metadata; and determining the location and length of the NTFS disk boot record based on the location and length of the disk boot record pointing to NTFS. This embodiment parses the BitLocker DBR structure, finds the location and length of the DBR pointing to the original file system (NTFS), and parses out the location and length (usually 16 sectors) where the BitLocker metadata is stored. This embodiment provides a specific process for parsing the location and length of the NTFS disk boot record, improving the accuracy of determining the location and length of the NTFS disk boot record.

[0076] S103, based on the full-volume decryption key, parses the location of the encrypted NTFS disk boot record to obtain the actual file partition.

[0077] In this embodiment, the global decryption key is obtained by decrypting the intermediate key VMK used to decrypt FVEK. The actual file partition in this embodiment describes NTFS information. User-defined protector information (user password, recovery key, etc.) is extracted from BitLocker metadata. Based on the currently available protectors, FVEK (full volume encryption key) is decrypted. The encrypted original file system (NTFS) DBR is decrypted using FVEK to obtain the actual structure information of the file system.

[0078] S104, Based on the partition adjustment task, the actual file partition is adjusted using the partition adjustment strategy to obtain the target adjustment partition; wherein, the partition adjustment strategy includes the BitLocker metadata fragmentation-free strategy.

[0079] This embodiment does not limit the specific adjustments made to the actual file partitions based on the partition adjustment strategy. For example, the adjustment in this embodiment can be a resizing adjustment, or a moving adjustment; or the adjustment in this embodiment can also be a combination of resizing and moving adjustments.

[0080] It should be further explained that, based on any of the above embodiments, the above-mentioned partition adjustment task, which utilizes a partition adjustment strategy to adjust the actual file partition to obtain the target adjusted partition, may include: determining the type of the partition adjustment task; if the type is to only modify the tail boundary of the partition, then performing a power-loss-resistant resizing operation; if the type is to correct the partition header, then comparing the size of the new partition to be adjusted with the size of the corresponding old partition, and determining the corresponding partition adjustment strategy based on the comparison result; wherein, the partition adjustment strategy includes moving first and then resizing or resizing first and then moving, and when performing the resizing operation, if the data to be moved belongs to BitLocker metadata, it is adjusted in a fragment-free manner. In this embodiment, if the partition only modifies the tail boundary, a resize operation with power-loss protection is preferentially attempted, which is safer and faster. If the partition header position is modified, or the power-loss protection method fails, then the sizes of the new partition and the old partition are compared.

[0081] It should be further explained that, based on any of the above embodiments, if the type is to correct the partition header, the size of the new partition to be adjusted is compared with the size of the corresponding old partition. Based on the comparison result, the corresponding partition adjustment strategy is determined, which may include: when performing a move operation, if it is determined that NTFS is being parsed, then the encryption / decryption function based on the plaintext key is enabled; if it is determined that block data is being moved, then the encryption / decryption function based on the plaintext key is disabled. In this embodiment, when performing a Move operation, the mapping and encryption / decryption functions of the IO module are only enabled when parsing the file system (NTFS) structure. When moving large blocks of data, the encryption / decryption function is disabled, and encrypted data is directly manipulated, improving performance efficiency.

[0082] It should be further explained that, based on any of the above embodiments, if the type is to modify the partition header, the sizes of the new partition to be adjusted and the old partition are compared, and the corresponding partition adjustment strategy is determined based on the comparison result. This can include: when the size of the new partition to be adjusted is greater than the size of the old partition, determining to move first and then adjust the size; when the size of the new partition to be adjusted is not greater than the size of the old partition, determining to adjust the size first and then move. In this embodiment, if the partition header position is modified, or the power failure prevention method fails, the sizes of the new partition and the old partition are compared. If the new partition is larger, a Move operation is performed first to move the data, and then a Resize operation is performed to expand the partition. If the new partition is smaller, a Resize operation is performed first to shrink the partition, and then a Move operation is performed to move the data. When performing the Resize operation, it is determined whether the data block to be moved belongs to BitLocker metadata. If so, new storage space is allocated in a fragment-free manner, and new location information is recorded to ensure the integrity of the metadata.

[0083] It should be further explained that, based on any of the above embodiments, after performing partition adjustment on the actual file partition using the partition adjustment strategy based on the partition adjustment task to obtain the target adjustment partition, it may further include: determining the location of the new BitLocker metadata according to the target adjustment partition; regenerating the new BitLocker metadata and the new BitLocker disk boot sector based on the location of the new BitLocker metadata; deleting the plaintext key and restoring the encryption protection state. In this embodiment, after the Resize / Move operation is completed, the BitLocker disk boot sector and metadata are regenerated according to the new BitLocker metadata location and the new location information of the partition, ensuring that the BitLocker encryption function is available and in the correct state. The user's original protector configuration is retained from the parsed original structure, and the complete BitLocker metadata structure is reconstructed by combining the new partition size and the new metadata location. If a plaintext key is created during the processing, the plaintext key of the partition is deleted after the operation is completed, restoring the original encryption protection state and ensuring the reliability of the partition encryption state.

[0084] This invention provides a partition adjustment method, which may include: S101, obtaining the full-volume encryption key of the BitLocker partition corresponding to the partition adjustment task; S102, parsing the BitLocker partition to obtain the location of the BitLocker disk boot record, and determining the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record using a mapping relationship; S103, parsing the location of the encrypted NTFS disk boot record based on the full-volume decryption key to obtain the actual file partition; S104, performing partition adjustment on the actual file partition based on the partition adjustment task using a partition adjustment strategy to obtain the target adjusted partition; wherein, the partition adjustment strategy includes a BitLocker metadata fragmentation-free strategy. Compared with the current method that requires closing BitLocker before performing the operation, this application does not require closing BitLocker, can obtain the actual file partition based on the plaintext key, can identify and protect the BitLocker metadata area when performing adjustment on the actual file partition, ensures that the metadata is not fragmented, and can perform partitioning operations without decrypting the entire partition, thus improving the efficiency and security of partition adjustment.

[0085] The existing solution of disabling BitLocker before resizing / moving has the following technical drawbacks: 1. Long processing time: It requires completely decrypting the entire partition, performing the resize / move operation, and finally re-encrypting, which takes a very long time, especially for large-capacity disks, which may take several days; 2. High data security risk: During decryption, sensitive data is stored in plaintext, posing a risk of data leakage and violating the original intention of encryption protection; 3. High operational complexity: Users need to manually manage the opening and closing of BitLocker, which is cumbersome and prone to errors; 4. Compatibility issues: In some enterprise environments, BitLocker policies restrict users from disabling encryption, making it impossible to use the traditional solution; 5. High system resource consumption: The encryption / decryption process consumes a lot of CPU and disk I / O resources, affecting normal system use.

[0086] Based on the above-mentioned technical shortcomings, the purpose of this invention is to provide a method that can directly perform Resize / Move operations on NTFS partitions while maintaining BitLocker encryption, achieving a technical solution with short operation time, no need for additional storage space, maintaining data security, simple operation, and strong compatibility.

[0087] For easier understanding, please refer to Figure 2 , Figure 2This is a schematic diagram of a technical framework using BitLocker parsing and IO takeover provided by an embodiment of the present invention. Specifically, it may include: partition management software obtaining the structural information of the encrypted partition through the BitLocker parsing module; the IO (input / output) mapping and conversion layer being responsible for data conversion between the underlying file system and the upper-layer application, enabling the original Resize / Move algorithm to operate on the encrypted partition transparently; special processing for the location of BitLocker's metadata; and finally, ensuring that the partition after the operation can be normally recognized by the Windows system through BitLocker metadata reconstruction.

[0088] For a clearer understanding of this invention, please refer to the following details. Figure 3 , Figure 3 A flowchart illustrating a partition adjustment method provided in an embodiment of the present invention may specifically include:

[0089] Step 1: Task creation and initial judgment:

[0090] The process begins by creating a Resize or Move task. The system first performs a crucial check: it checks if the new partition's tail boundary falls precisely on the BitLocker metadata location. If so, the end sector position of the partition is fine-tuned to avoid fragmentation caused by cutting the metadata location, thus ensuring the integrity of the BitLocker metadata. If not, it proceeds directly to the next step. It's important to note that before executing the operation, a plaintext key needs to be created for the partition to ensure that the BitLocker parsing algorithm can correctly parse the encrypted data. The plaintext key is created by calling the Windows BitLocker management interface. The partition's protection is disabled through the BitLocker interface, thus creating the plaintext key. This interface call does not trigger a complete decryption process; it only temporarily disables encryption protection. This ensures that the BitLocker parsing algorithm can parse the VMK (Volume Master Key) and FVEK (Full Volume Encryption Key) from the plaintext key. The FVEK is used for encryption / decryption during I / O read / write operations.

[0091] Step 2: Key Acquisition and I / O Preparation

[0092] In this step, the system begins preparing the necessary keys and control for the operation: a plaintext key is created for the partition. Encryption protection on the partition is temporarily disabled by calling the Windows BitLocker management interface. This operation does not decrypt data, but rather allows the system access to the key. The BitLocker volume master key (VMK) and full volume encryption key (FVEK) are parsed. The FVEK is the key directly used for data encryption and decryption. I / O mapping and conversion mechanisms are established. This means the system begins to take over read and write requests to the partition. The BitLocker DBR (Boot Record) structure is parsed to find the actual location of the encrypted original NTFS DBR. For easier understanding, please refer to [link to documentation]. Figure 4 , Figure 4 This is a schematic diagram of a mapping method provided in an embodiment of the present invention. When the application layer requests to read sector 0, the IO module does not directly access the physical disk, but instead uses the BitLocker parser for conversion. The parser first reads the BitLocker DBR to obtain the real location of the NTFS DBR, then reads and decrypts the NTFS DBR, and finally returns it to the application layer. The BitLocker DBR structure is parsed to find the location and length of the DBR pointing to the original file system (NTFS), and the location and length of the BitLocker metadata (usually 16 sectors) are also parsed. User-defined protector information (user password, recovery key, etc.) is extracted from the BitLocker metadata, and the FVEK (full volume encryption key) is decrypted based on the currently available protectors. The encrypted original file system (NTFS) DBR is decrypted using the FVEK to obtain the actual structure information of the file system. It takes over the read and write operations in the IO module, performs special conversion processing when accessing sectors 0-16, and returns the decrypted original file system DBR. For other sectors, it uses FVEK to read, decrypt, and encrypt the data before writing it, so that the upper-layer application can operate on the original file system "without being aware".

[0093] Step 3: Adjusting Strategy Decisions:

[0094] The system intelligently selects the safest and most efficient operation path based on the type of partition change: It determines if only the tail of the partition has been modified; if so, it prioritizes a power-loss-protected resize operation. This is a safer and faster approach. If the partition head has been moved or the power-loss protection method fails, it proceeds to a branch decision: comparing the sizes of the new and old partitions. If the new partition is larger, it uses a move-then-resize order. If the new partition is smaller, it uses a resize-then-move order. For better understanding, please refer to [link to documentation / reference]. Figure 5 , Figure 5This is a schematic diagram of a power-loss protection operation process provided by an embodiment of the present invention. Specifically, it may include: determining the new boundary location of the partition; reading the core metadata of the NTFS file system to obtain all parsed Dataruns (data runs), where a Datarun is a metadata structure in NTFS used to describe the specific storage location of file data on the disk; determining if any Dataruns fall outside the new partition; if no Dataruns fall outside the new partition, no further operation is required; if Dataruns fall outside the new partition, it means that these data are at risk of being truncated and lost, and must be moved; the process continues to the next step; counting the number and size of Dataruns falling outside the new partition; parsing the $Bitmap (bitmap file) to obtain unused space, and finding a location for each Datarun within the new partition; determining if it is a BitLocker metadata Datarun; if the Datarun belongs to BitLocker metadata, the file system will use a forced fragmentation-free method to allocate a new location for it, ensuring the continuity and integrity of its data, which is crucial for the recovery of encryption functions; if it does not belong to BitLocker metadata, space will be allocated using the conventional method; checking whether the operation of allocating a new location for the Datarun in the previous step was successful; if the search fails, it is determined that the Resize failed. If the search is successful, move the Datarun to the new location. After the data is moved, update the $Bitmap file to reflect the new occupied and free status of the data blocks, ensuring the consistency of file system metadata.

[0095] For easier understanding, please refer to Figure 6 , Figure 6This is a schematic diagram of a resize operation process provided by an embodiment of the present invention, which specifically includes: obtaining the input / output interfaces required for low-level data read / write with the disk; realigning the partition size according to the cluster size; recalculating and setting the new start and end boundary positions of the partition based on the new capacity specified or calculated by the user; reading the $MFT and attempting to parse it, reading the core metadata of the NTFS file system and attempting to parse its contents. The $MFT records information about all files and directories on the volume, including their data storage locations; obtaining all parsed Dataruns, which are metadata structures in NTFS used to describe the specific storage location (a sequence of clusters) of file data on the disk; determining whether any Dataruns fall outside the new partition; if no Dataruns fall outside the new partition, it means that these data are at risk of being truncated and lost, and must be moved; counting the Dataruns falling outside the new partition; the system counts the number and size of all Dataruns that need to be moved; parsing the Bitmap to obtain unused space; reading the NTFS bitmap file ($Bitmap). The purpose of this step is to find free space inside the new partition to accommodate the data to be moved. Within the new partition, locate a position for each Datarun. Determine if it belongs to BitLocker metadata. If so, the system uses a forced, fragment-free method to allocate a new location, ensuring data continuity and integrity—crucial for encryption recovery. If it's ordinary user data, allocate space using the standard method. Determine if the location search was successful. If successful, move the Datarun to its new location, safely transferring data from outside the partition to the allocated location. After data transfer, update the $Bitmap file to reflect the new occupancy and free status of data blocks, ensuring file system metadata consistency.

[0096] For easier understanding, please refer to Figure 7 , Figure 7This is a schematic diagram of a Move operation flow provided by an embodiment of the present invention, which specifically includes: the program acquiring the input / output interfaces required for low-level data read / write with the disk. This is the foundation for all subsequent disk operations. The core metadata file $MFT of the NTFS file system is read and parsed. The bitmap of $Bitmap is obtained and parsed. The encryption / decryption function of the IO module is disabled. The system has already obtained the file's "map" ($MFT) and "free space table" ($Bitmap) through the first two steps, and no longer needs to view the data content itself. "$" is a naming convention and special identifier of the NTFS file system, representing a "metafile" in the NTFS file system. This type of file is only operated and accessed by the file system itself and is not perceived by the user. Therefore, the system disables the real-time encryption / decryption function of data blocks, and will directly perform physical transfer of encrypted data, which avoids a large amount of unnecessary encryption / decryption computation overhead and greatly improves efficiency. It determines whether the starting position of the new partition is before the old partition. If the starting position of the new partition is before the old partition, $Bitmap needs to be traversed from front to back to avoid overwriting. If the starting position of the new partition is after the old partition, $Bitmap needs to be traversed from back to front. This is to prevent overwriting data stored on the disk backend. The Bitmap is traversed, checking the status of each cluster. If the Bitmap traversal is complete, it checks if all clusters in the bitmap have been processed. If traversal is complete, all data has been processed, and the process jumps to the Move stage. If not, the next cluster to be processed is retrieved. The next cluster number is obtained according to the traversal order. The target cluster is checked for use. It is checked whether the currently processed cluster is occupied in the source partition. If the cluster is free, it is skipped, and the next cluster is processed. If the cluster is occupied, data transfer is required, and the process continues to the next step. Data from the target cluster is read from the old partition. Data is read from the cluster location in the source (old) partition. Since encryption / decryption is disabled, the data read is the original, encrypted data (ciphertext). The data is written to the target cluster location in the new partition, and the read encrypted data (ciphertext) is written verbatim to the corresponding cluster location in the target (new) partition.

[0097] Step 4: Execution and Closure

[0098] After completing the core Resize / Move operations, the process enters the final refactoring and cleanup phase:

[0099] Handle the transfer of BitLocker metadata itself. Regenerate the BitLocker boot sector and metadata based on the new location of all data, ensuring that encryption is fully available in the new location. Retain all user protector configurations (such as passwords and recovery keys) from the original structure, ensuring that users do not need to change any credentials. Delete the plaintext key created at the start of the process, completely restoring the partition to its full encryption protection state and eliminating any potential security risks.

[0100] The system device structure diagram corresponding to the above process is as follows: Figure 8 As shown, Figure 8This invention provides a schematic diagram of a partition rebalancing system, which includes four main components: a partition management system, a BitLocker processing core, an IO processing layer, and underlying storage. Each component has a clearly defined role, and the modular design enables transparent processing of BitLocker partitions. The partition management system includes a user interface module, a task scheduling module, and a partition analysis module. The user interface module provides a graphical or command-line interface for users to perform operations such as "partition rebalancing." It is the entry point for users to interact with the entire system. The task scheduling module receives instructions from the user interface module and converts them into specific tasks. The partition analysis module analyzes the partitions that need to be adjusted, determines their current state (such as the NTFS file system structure, BitLocker metadata location, data distribution, etc.), and provides a decision-making basis for the task scheduling module. The BitLocker processing core includes a BitLocker parser, a key management module, and a metadata processor. The BitLocker parser parses the BitLocker metadata structure (such as the DBR boot record) to find the true location of the encrypted NTFS file system. The key management module securely acquires, temporarily stores, and processes BitLocker encryption keys (VMK, FVEK). The system temporarily disables protection by calling the Windows interface to obtain the key and completely clears the key traces from memory after the operation is complete. The metadata processor is dedicated to handling BitLocker and NTFS metadata. After a Resize / Move operation, it regenerates the BitLocker boot sector and metadata based on the new partition layout, ensuring encryption functionality is available. The IO processing layer includes an IO mapping module, an encryption / decryption engine, and a sector cache. The IO mapping module handles system IO requests. Requests accessing sectors 0-16 (accessing metadata) are redirected and decrypted; other requests are either handed over to the encryption / decryption engine or allowed directly. The encryption / decryption engine uses the FVEK key obtained from the upper layer to encrypt and decrypt data in real time. This module operates when the file system structure needs to be parsed. The sector cache temporarily stores frequently read / written disk sector data to reduce direct access to the physical disk and improve operational efficiency. The underlying storage includes a partition operation engine, a disk driver interface, and physical disks. The partition operation engine executes specific partition management (adjustment) commands, such as directly adjusting the partition table and moving data blocks. The disk driver interface provides a standard interface with the operating system's disk drivers, ensuring that commands are correctly sent to the hard drive. It's worth noting that transparent access can also be achieved by creating a virtual file system layer, but this increases system complexity and performance overhead; or by implementing I / O interception and translation at the kernel driver level, which offers better performance but is more complex to develop and deploy; or by encapsulating the Windows BitLocker interface.

[0101] This invention clearly demonstrates a complex process for balancing security (key management, metadata protection), integrity (fragmentation prevention, power failure prevention), and functionality (seamless recovery of the encrypted state) when performing low-level operations on encrypted partitions. The entire process avoids the lengthy waiting time associated with traditional methods that involve decryption followed by encryption.

[0102] This invention performs resize / move operations on NTFS partitions without compromising BitLocker encryption. During the resize / move process, a BitLocker parsing method is used to adapt the resize / move algorithm, ensuring that the algorithm treats BitLocker partitions as ordinary NTFS partitions. Simultaneously, the resize / move algorithm is modified to correctly handle BitLocker-related characteristics. After the operation, the partition retains BitLocker encryption and will not exhibit any abnormal state. Compared to the original scheme that disables BitLocker before resize / move, the advantages of this invention are as follows:

[0103] 1. Time efficiency: No need for a complete decryption / re-encryption process, reducing operation time from hours / days to minutes;

[0104] 2. Space efficiency: No additional storage space is required to store the decrypted data, making it suitable for disks that are close to full capacity;

[0105] 3. Security: Data is always kept encrypted, avoiding the risk of plaintext exposure in traditional solutions;

[0106] 4. Compatibility: Applicable to various BitLocker policy environments, including enterprise environments that do not allow users to manually disable encryption.

[0107] This invention is compatible with BitLocker implementations on Windows 7 and above. In the test environment, the resize operation time for encrypted partitions using this solution is approximately the normal NTFS operation time, while traditional solutions require several hours. It has been thoroughly tested in Windows 7 and Windows 10 / 11 environments and supports all existing BitLocker encryption algorithms.

[0108] The partition adjustment device provided in the embodiments of the present invention will be described below. The partition adjustment device described below and the partition adjustment method described above can be referred to in correspondence.

[0109] Please refer to the details. Figure 9 , Figure 9A schematic diagram of a partition adjustment device provided in an embodiment of the present invention may include:

[0110] The full-volume encryption key determination module 100 is used to obtain the full-volume encryption key of the BitLocker partition corresponding to the partition adjustment task;

[0111] The encrypted NTFS disk boot record location determination module 200 is used to parse the BitLocker partition to obtain the location of the BitLocker disk boot record, and determine the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record using a mapping relationship.

[0112] The actual file partition determination module 300 is used to parse the location of the encrypted NTFS disk boot record based on the full volume decryption key to obtain the actual file partition;

[0113] The partition adjustment module 400 is used to perform partition adjustment on the actual file partition based on the partition adjustment task and a partition adjustment strategy to obtain the target adjusted partition; wherein, the partition adjustment strategy includes the BitLocker metadata fragmentation-free strategy.

[0114] Furthermore, based on the above embodiments, the full-volume encryption key determination module 100 may include:

[0115] The tail position determination unit is used to determine whether the tail position of the NTFS partition to be adjusted is located in the BitLocker metadata position after obtaining the partition adjustment task created.

[0116] The tail position adjustment unit is used to adjust the tail position of the NTFS partition to be adjusted if it is located in the BitLocker metadata position, until the tail position is no longer located in the BitLocker metadata position.

[0117] The plaintext key determination unit is used to disable protection for the BitLocker partition through the BitLocker interface, create a plaintext key for the BitLocker partition, and parse the full-volume encryption key from the plaintext key.

[0118] Furthermore, based on any of the above embodiments, the encrypted NTFS disk boot record location determination module 200 may include:

[0119] The BitLocker disk boot record determination unit is used to parse the BitLocker partition, obtain the location of the BitLocker disk boot record, and determine the BitLocker disk boot record based on the location of the BitLocker disk boot record.

[0120] The disk boot record determination unit pointing to NTFS is used to parse the structure of the disk boot record of BitLocker, determine the location and length of the disk boot record pointing to NTFS, and parse out the location and length of BitLocker metadata;

[0121] The NTFS disk boot record location and length determination unit is used to determine the NTFS disk boot record location and length based on the location and length of the disk boot record pointing to NTFS.

[0122] Furthermore, based on any of the above embodiments, the partition adjustment module 400 may include:

[0123] The task type determination unit is used to determine the type of the partition adjustment task;

[0124] The first adjustment unit is used to perform a power-loss-proof resizing operation if the type is only modifying the tail boundary of the partition.

[0125] The second adjustment unit is used to compare the size of the new partition to be adjusted with the size of the corresponding old partition if the type is to correct the partition header, and determine the corresponding partition adjustment strategy based on the comparison result; wherein, the partition adjustment strategy includes moving first and then adjusting the size or adjusting the size first and then moving, and when performing the resizing operation, if the data to be moved belongs to BitLocker metadata, it is adjusted in a fragment-free manner.

[0126] Furthermore, based on any of the above embodiments, the second adjustment unit may include:

[0127] The encryption / decryption function startup subunit is used to start the encryption / decryption function based on the plaintext key when it is determined that NTFS is being parsed during a move operation.

[0128] The encryption / decryption function shutdown subunit is used to determine when to disable the encryption / decryption function based on the plaintext key during block data transfer.

[0129] Furthermore, based on any of the above embodiments, the second adjustment unit may include:

[0130] The first adjustment subunit is used to determine that the new partition to be adjusted should be moved first and then the size adjusted when the size of the new partition to be adjusted is greater than the size of the old partition.

[0131] The second adjustment subunit is used to determine to adjust the size before moving the partition when the size of the new partition to be adjusted is not greater than the size of the old partition.

[0132] Furthermore, based on any of the above embodiments, the above-mentioned partition adjustment device may further include:

[0133] The update module is used to determine the location of the new BitLocker metadata based on the target partition adjustment, and regenerate the new BitLocker metadata and the new BitLocker disk boot record based on the location of the new BitLocker metadata;

[0134] The encryption state recovery module is used to delete the plaintext key and restore the encryption protection state.

[0135] It should be noted that the order of the modules and units in the above-mentioned partition adjustment device can be changed without affecting the logic.

[0136] This invention provides a partition adjustment device, which may include: a full-volume encryption key determination module 100, used to obtain the full-volume encryption key of the BitLocker partition corresponding to the partition adjustment task; an encrypted NTFS disk boot record location determination module 200, used to parse the BitLocker partition to obtain the location of the BitLocker disk boot record, and determine the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record using a mapping relationship; an actual file partition determination module 300, used to parse the location of the encrypted NTFS disk boot record based on the full-volume decryption key to obtain the actual file partition; and a partition adjustment module 400, used to perform partition adjustment on the actual file partition based on the partition adjustment task using a partition adjustment strategy to obtain the target adjustment partition; wherein, the partition adjustment strategy includes a BitLocker metadata fragmentation-free strategy. Compared to the current method that requires disabling BitLocker before performing operations, this application does not require disabling BitLocker. It can obtain the actual file partition based on the plaintext key, and can identify and protect the BitLocker metadata area when adjusting the actual file partition, ensuring that the metadata is not fragmented. Furthermore, it can perform partitioning operations without decrypting the entire partition, thus improving the efficiency and security of partition adjustments.

[0137] The following describes a partition adjustment device provided by an embodiment of the present invention. The partition adjustment device described below and the partition adjustment method described above can be referred to in correspondence.

[0138] Please refer to Figure 10 , Figure 10A schematic diagram of a partition adjustment device provided in an embodiment of the present invention may include:

[0139] Memory 10 is used to store computer programs;

[0140] Processor 20 is used to execute computer programs to implement the partition adjustment method described above.

[0141] The memory 10, processor 20, and communication interface 30 all communicate with each other through the communication bus 40.

[0142] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions:

[0143] Obtain the full-volume encryption key for the BitLocker partition corresponding to the partition resizing task;

[0144] The BitLocker partition is parsed to obtain the location of the BitLocker disk boot record. Based on the location of the BitLocker disk boot record, the location of the encrypted NTFS disk boot record is determined using a mapping relationship.

[0145] The location of the encrypted NTFS disk boot record is parsed based on the full-volume decryption key to obtain the actual file partitions;

[0146] The partition adjustment task utilizes partition adjustment strategies to perform partition adjustment on the actual file partitions to obtain the target adjusted partition; among which, the partition adjustment strategies include the BitLocker metadata fragmentation-free strategy.

[0147] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0148] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0149] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0150] The communication interface 30 can be an interface for the communication module, used to connect with other devices or systems.

[0151] Of course, it should be noted that, Figure 10 The structure shown does not constitute a limitation on the partition adjustment device in the embodiments of the present invention. In practical applications, the partition adjustment device may include more than Figure 10 More or fewer components as shown, or combinations of certain components.

[0152] The following describes the computer-readable storage medium provided in the embodiments of the present invention. The computer-readable storage medium described below can be referred to in correspondence with the partition adjustment method described above.

[0153] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the partition adjustment method described above.

[0154] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0155] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0156] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0157] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0158] The foregoing has provided a detailed description of a partition adjustment method, apparatus, device, and computer-readable storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for adjusting partitions, characterized in that, include: Obtain the full-volume encryption key for the BitLocker partition corresponding to the partition resizing task; The BitLocker partition is parsed to obtain the location of the BitLocker disk boot record. Based on the location of the BitLocker disk boot record, the location of the encrypted NTFS disk boot record is determined using a mapping relationship. Based on the full-volume encryption key, the location of the encrypted NTFS disk boot record is parsed to obtain the actual file partition; Based on the partition adjustment task, the actual file partition is partitioned using a partition adjustment strategy to obtain the target adjusted partition; wherein, the partition adjustment strategy includes the BitLocker metadata fragmentation-free strategy; This includes obtaining the full-volume encryption key for the BitLocker partition corresponding to the partition resizing task, including: After obtaining the created partition resizing task, determine whether the end position of the NTFS partition to be resized is located in the BitLocker metadata location; If it is located in BitLocker's metadata location, then adjust the tail position of the NTFS partition to be adjusted until the tail position is no longer located in BitLocker's metadata location. The BitLocker partition is disabled and protected via the BitLocker interface, and a plaintext key is created for the BitLocker partition so that the full-volume encryption key can be deciphered from the plaintext key. The process includes parsing the BitLocker partition to obtain the location of the BitLocker disk boot record, and using a mapping relationship to determine the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record, including: The BitLocker partition is parsed to obtain the location of the BitLocker disk boot record, and the BitLocker disk boot record is determined based on the location of the BitLocker disk boot record; The structure of the BitLocker disk boot record is parsed to determine the location and length of the disk boot record pointing to NTFS, and the location and length of the BitLocker metadata are also parsed. The location and length of the NTFS disk boot record are determined based on the location and length of the disk boot record pointing to NTFS.

2. The partition adjustment method according to claim 1, characterized in that, Based on the partition adjustment task, the actual file partition is adjusted using a partition adjustment strategy to obtain the target adjustment partition, including: Determine the type of the partition adjustment task; If the type is to modify only the tail boundary of the partition, then perform a resizing operation to prevent power loss; If the type is to correct the partition header, the size of the new partition to be adjusted is compared with the size of the corresponding old partition, and the corresponding partition adjustment strategy is determined based on the comparison result; wherein, the partition adjustment strategy includes moving first and then adjusting the size or adjusting the size first and then moving, and when performing the resizing operation, if the data to be moved belongs to BitLocker metadata, it is adjusted in a fragment-free manner.

3. The partition adjustment method according to claim 2, characterized in that, If the type is to correct the partition header, then the size of the new partition to be adjusted is compared with the size of the corresponding old partition, and the corresponding partition adjustment strategy is determined based on the comparison result, including: When performing a move operation, if it is determined that NTFS is to be parsed, then the encryption and decryption functions based on the plaintext key are initiated; When it is determined that block data transfer is to be performed, the encryption and decryption functions based on the plaintext key are turned off.

4. The partition adjustment method according to claim 2, characterized in that, If the type is to correct the partition header, the sizes of the new partition to be adjusted and the old partition are compared, and the corresponding partition adjustment strategy is determined based on the comparison result, including: When the size of the new partition to be adjusted is larger than the size of the old partition, it is determined to move it first and then adjust its size. When the size of the new partition to be adjusted is not greater than the size of the old partition, it is determined to adjust the size first and then move it.

5. The partition adjustment method according to claim 1, characterized in that, After performing partition adjustment on the actual file partition using the partition adjustment strategy based on the partition adjustment task to obtain the target adjustment partition, the process further includes: Based on the target partition adjustment, determine the location of the new BitLocker metadata, and regenerate the new BitLocker metadata and the new BitLocker disk boot record based on the location of the new BitLocker metadata; Delete the plaintext key to restore the encryption protection state.

6. A zone adjustment device, characterized in that, The partition adjustment method according to any one of claims 1 to 5 includes: The full-volume encryption key determination module is used to obtain the full-volume encryption key of the BitLocker partition corresponding to the partition adjustment task; The encrypted NTFS disk boot record location determination module is used to parse the BitLocker partition to obtain the location of the BitLocker disk boot record, and determine the location of the encrypted NTFS disk boot record based on the location of the BitLocker disk boot record using a mapping relationship. The actual file partition determination module is used to parse the location of the encrypted NTFS disk boot record based on the full-volume encryption key to obtain the actual file partition; The partition adjustment module is used to perform partition adjustment on the actual file partition based on the partition adjustment task and a partition adjustment strategy to obtain the target adjusted partition; wherein, the partition adjustment strategy includes the BitLocker metadata fragmentation-free strategy.

7. A zone adjustment device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the partition adjustment method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the partition adjustment method as described in any one of claims 1 to 5.

Images