BestCrypt Console Tool


BestCrypt Console Tool (also known as bctool) is a central BestCrypt user interaction application for console users. It allows you to perform container creation and management (adding, changing and removing passwords for example) as well as some advanced operations.

The following sections describe BestCrypt Console Tool functions grouped together by the task they perform starting from the most useful functions.

General Overview

The main executable for BestCrypt Console Tool is called bctool. It has no configuration file, expecting all the configuration needed be passed in command parameters.

You can execute it without parameters to see a complete list of commands and parameters with short descriptions. Commands in the output will be sorted by their names. The sections below will group them by task they perform. You can also see the full list of available commands at the end of the guide.

Creating a new container

Command template

bctool new path/to/secret.jbc -s size -a algorithm [-M mode] [-d description] [-t fstype]

Description

Use the command above to create a new container. Let's describe each parameter in more details.

The first parameter is container file name, optionally with full path. If no path is specified, container will be created in current directory. You should have write access to the directory specified.

Size parameter should contain the desired size for container virtual disk. If specified with no modifiers, the size is considered the amount of bytes. You can specify one of the modifiers K/M/G to avoid typing errors when entering large value. For example, 10M will be 10*1024*1024 = 10485760 bytes.

Algorithm and mode parameters describes used encryption algorithm and encryption mode. The recommended values are Rijndael algorithm with XTS encryption mode. The full list of the algorithms available can be got by executing the command below:

ls /sys/class/misc/bestcrypt/plugins

The BestCrypt encryption modules are separated from the virtual disk driver itself and if you, by some reason, want to implement your own algorithm, nothing will prevent you to use it. But, for most of tasks, there is no reason to do it.

You can create a BestCrypt container that covers an entire block device. Please refer to Advanced Commands section for detailed description.

Example

$ bctool new ~/secret.jbc -a rijndael -M XTS -s 100M -t msdos

In this example, container with name secret.jbc will be created at the home directory of current user.

Mounting of existing container

Command template

bctool mount secret.jbc path [-t fstype] [-o mountoptions]

Description

The command is used to mount an existing container to specified location in file system. General description of the mounting process can be found in Basic Concepts guide.

BestCrypt uses Linux mount command as background worker to actually mount a container. The main difference between mounting from Console Tool and from Control Panel is that you can pass additional -t and -o parameters to the mount process. That gives you a bit more control on the process, if you need this.

Example

$ bctool mount path/to/secret.jbc ~/secret-data/

In the example above, container secret.jbc becomes mounted to the secret-data subfolder in the home directory for current user.

Passwords Management

Command templates

bctool addpassword path/to/secret.jbc
bctool delpasswd path/to/secret.jbc
bctool passwd path/to/secret.jbc

Description

This group of commands can be used to add, remove or change existing container password.

When adding a new password, you should enter an existing one. The newly added password will have the same parameters as the one you entered.

One thing should be mentioned about adding passwords: they cannot be used to differenciate access levels. But you can use UNIX-style permission management. If you want someone to have read-only access to a container data, you can do one of the following: Please be careful about not to mount one container twise. BestCrypt checks that container is not using before mounting it, but it protects you only if this container is mounted on the same machine.

Backing up container header

Command templates

bctool backup path/to/container.jbc path/to/backup.kbb
restore path/to/container.jbc path/to/backup.kbb

Description

Commands above can be used for creating header backup. Please see the description about backup proces in the Basic Concepts guide.

Advanced functions

Reencryption

Command template

bctool reencrypt path/to/container.jbc [-a algorithm] [-M mode]

Description

Reencryption changes the encryption key, that is actually used to encrypt your container. It can optionally change the encryption cipher and mode.

Reencryption is a powerful feature, when used with caution. See the description of how the reencryption works in this guide.

Linking

Command template

bctool link path/to/container.jbc [-r]
unlink device_name

Description

The link command creates a BestCrypt virtual disk device without mounting it. If -r option is specified, read-only access will be granted.

The unlink command is an opposite command, it unlinks device from a container. The command will fail, if some program working with specified device.

File system check

Command template

bctool fsck path/to/container.jbc [-t fs_type]

Description

The command above checks file system on specified container using Linux fsck utility. Parameter -t is passed to the utility.

Format container

Command template

bctool format path/to/container.jbc -t fs_type

Description

The command above formats specified container using Linux mkfs utility. Parameter -t is passed to the utility.

Raw linking of file

Command template

bctool rawlink path/to/some-file.bin

Please be careful, this command will destroy all the contents of specified file!

Description

When working with security data, you should be careful, as some peaces of it can be found on your hard drive in swap and /tmp even after you completed your work and unmounted your encrypted container.

The command above is useful for this case. It is designed for creating of a temporary storage, that will handle a security-sensitive data until it is disconnected. After device is unlinked with bctool unlink command, all the data inside it becomes unavailable, because random encryption key is destroyed.

The command creates a BestCrypt virtual block device that will contain a specified file, but uses a random encryption parameters. All existing data in the specified file will be destroyed.

Command List

BestCrypt Console Tool has a variety of commands. Some of them are required for user to have special knowledge. Such commands considered advanced and will be described in Advanced Commands section.

Each command also has a variety of parameters. Each of them will be described in Command Parameters section of the guide.

Below you can see the full list of the commands available with brief description. Also the list can be found by executing bctool without parameters or in manual page by command man bctool.

Optional parameters are placed in square brackets, for example: [-d description] .

Commands

Command Parameters