BestCrypt Console Tool (also known as bctool) is a central BestCrypt user interaction application for console users. It allows you to perform container creation and management (adding, changing and removing passwords for example) as well as some advanced operations.
The following sections describe BestCrypt Console Tool functions grouped together by the task they perform starting from the most useful functions.
The main executable for BestCrypt Console Tool is called bctool. It has no configuration file, expecting all the configuration needed be passed in command parameters.
You can execute it without parameters to see a complete list of commands and parameters with short descriptions. Commands in the output will be sorted by their names. The sections below will group them by task they perform. You can also see the full list of available commands at the end of the guide.
bctool new path/to/secret.jbc -s size -a algorithm [-M mode] [-d description] [-t fstype]
Use the command above to create a new container. Let's describe each parameter in more details.
The first parameter is container file name, optionally with full path. If no path is specified, container will be created in current directory. You should have write access to the directory specified.
Size parameter should contain the desired size for container virtual disk. If specified with no modifiers, the size is considered the amount of bytes. You can specify one of the modifiers K/M/G to avoid typing errors when entering large value. For example, 10M will be 10*1024*1024 = 10485760 bytes.
Algorithm and mode parameters describes used encryption algorithm and encryption mode. The recommended values are Rijndael algorithm with XTS encryption mode. The full list of the algorithms available can be got by executing the command below:
ls /sys/class/misc/bestcrypt/plugins
The BestCrypt encryption modules are separated from the virtual disk driver itself and if you, by some reason, want to implement your own algorithm, nothing will prevent you to use it. But, for most of tasks, there is no reason to do it.
You can create a BestCrypt container that covers an entire block device. Please refer to Advanced Commands section for detailed description.
$ bctool new ~/secret.jbc -a rijndael -M XTS -s 100M -t msdos
In this example, container with name secret.jbc will be created at the home directory of current user.
bctool mount secret.jbc path [-t fstype] [-o mountoptions]
The command is used to mount an existing container to specified location in file system. General description of the mounting process can be found in Basic Concepts guide.
BestCrypt uses Linux mount command as background worker to actually mount a container. The main difference between mounting from Console Tool and from Control Panel is that you can pass additional -t and -o parameters to the mount process. That gives you a bit more control on the process, if you need this.
$ bctool mount path/to/secret.jbc ~/secret-data/
In the example above, container secret.jbc becomes mounted to the secret-data subfolder in the home directory for current user.
bctool addpassword path/to/secret.jbc
bctool delpasswd path/to/secret.jbc
bctool passwd
path/to/secret.jbc
This group of commands can be used to add, remove or change existing container password.
When adding a new password, you should enter an existing one. The newly added password will have the same parameters as the one you entered.
bctool backup path/to/container.jbc
path/to/backup.kbb
restore path/to/container.jbc
path/to/backup.kbb
Commands above can be used for creating header backup. Please see the description about backup proces in the Basic Concepts guide.
bctool reencrypt path/to/container.jbc [-a algorithm] [-M mode]
Reencryption changes the encryption key, that is actually used to encrypt your container. It can optionally change the encryption cipher and mode.
Reencryption is a powerful feature, when used with caution. See the description of how the reencryption works in this guide.
bctool link path/to/container.jbc [-r]
unlink
device_name
The link command creates a BestCrypt virtual disk device without mounting it. If -r option is specified, read-only access will be granted.
The unlink command is an opposite command, it unlinks device from a container. The command will fail, if some program working with specified device.
bctool fsck path/to/container.jbc [-t fs_type]
The command above checks file system on specified container using Linux fsck utility. Parameter -t is passed to the utility.
bctool format path/to/container.jbc -t fs_type
The command above formats specified container using Linux mkfs utility. Parameter -t is passed to the utility.
bctool rawlink path/to/some-file.bin
When working with security data, you should be careful, as some peaces of it can be found on your hard drive in swap and /tmp even after you completed your work and unmounted your encrypted container.
The command above is useful for this case. It is designed for creating of a temporary storage, that will handle a security-sensitive data until it is disconnected. After device is unlinked with bctool unlink command, all the data inside it becomes unavailable, because random encryption key is destroyed.
The command creates a BestCrypt virtual block device that will contain a specified file, but uses a random encryption parameters. All existing data in the specified file will be destroyed.
BestCrypt Console Tool has a variety of commands. Some of them are required for user to have special knowledge. Such commands considered advanced and will be described in Advanced Commands section.
Each command also has a variety of parameters. Each of them will be described in Command Parameters section of the guide.
Below you can see the full list of the commands available with brief description. Also the list can be found by executing bctool without parameters or in manual page by command man bctool.
Optional parameters are placed in square brackets, for example: [-d description] .