Creating Encrypted Removable Drives with Virtual PDO and GenDisk

By /

Listen to this Post

Featured Image
A small tool for creating removable, encrypted drives has been developed, utilizing a virtual Physical Device Object (PDO) with a GenDisk CompatibleID. This causes `disk.sys` to create a Functional Device Object (FDO) for the device. The disk image is based on an AES-128 encrypted file, making it appear as a standard removable drive from the system’s perspective.

Tool Link: Encrypted Removable Drive Tool

You Should Know:

How It Works

  1. Virtual PDO Creation: The tool generates a virtual PDO with a GenDisk identifier, allowing Windows to recognize it as a removable disk.
  2. Encrypted Disk Image: The storage is backed by an AES-128 encrypted file, ensuring data security.
  3. FDO by disk.sys: Windows’ `disk.sys` driver creates an FDO, enabling standard disk operations.

Practical Implementation

Creating an Encrypted Disk Image

 Create a blank encrypted disk image (1GB) 
fsutil file createnew encrypted.img 1073741824 
cipher /e encrypted.img

Mounting the Encrypted Drive

 Use DiskPart to attach the VHD 
diskpart 
select vdisk file="C:\path\to\encrypted.img" 
attach vdisk 
exit

Using BitLocker for Additional Security (Windows)

 Enable BitLocker on the mounted drive 
Enable-BitLocker -MountPoint "E:" -EncryptionMethod Aes128 -UsedSpaceOnly

Linux Alternative: LUKS Encryption

 Create a LUKS-encrypted container 
dd if=/dev/zero of=encrypted_disk.img bs=1M count=1024 
cryptsetup luksFormat encrypted_disk.img 
cryptsetup open encrypted_disk.img secure_drive 
mkfs.ext4 /dev/mapper/secure_drive 
mount /dev/mapper/secure_drive /mnt/secure

Debugging & Kernel-Level Analysis

For developers working on similar tools, debugging is crucial.

WinDbg Commands for Disk.sys Analysis

!devobj <PDO_address>  Check PDO details 
!drvobj disk.sys  Analyze disk.sys driver 
!irp  Inspect IRP requests

Linux Kernel Debugging

dmesg | grep sd  Check disk detection 
lsblk  List block devices 
cryptsetup status secure_drive  Verify LUKS status

What Undercode Say

This tool demonstrates how kernel-level drivers and encryption can create secure, portable storage. Future enhancements could include:
– Multi-platform support (Linux/macOS via FUSE)
– Stronger encryption (AES-256, XTS mode)
– Automated mounting scripts for enterprise deployment

For job seekers in low-level Windows development, mastering these concepts is essential. Companies working on cybersecurity, forensics, or secure storage solutions will highly value such expertise.

Prediction

The demand for encrypted, portable storage solutions will grow as remote work increases. Expect more tools integrating hardware-backed encryption (TPM) and cloud synchronization.

Expected Output:

  • Encrypted virtual disk functioning as a removable drive
  • Secure data storage with AES-128
  • Debugging and kernel analysis capabilities for developers

IT/Security Reporter URL:

Reported By: Alex S – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: