macOS: harden volume discovery and FUSE-T teardown

Run display discovery asynchronously and bound batched disk-image inventory
queries. Filter auxiliary mounts by basename, filesystem and owner, and
keep unresolved candidates separate from verified volumes. Allow targeted
dismounts despite incomplete discovery while requiring complete results
for slot allocation and empty-inventory decisions.

Use nonthrowing GUI snapshots with monotonic freshness, completion events
and safe window lifetimes. Suspend inactivity decisions while the snapshot
is stale, without restarting idle timers: activity counters are cumulative
per volume instance. Refresh logout targets and retry only failed ones.
Show a progress dialog for interactive unmounts, but keep automatic ones
synchronous, so a quit or logout request that arrives meanwhile is handled
afterwards rather than refused. Guard core operations against reentry and
route wait-dialog requests only from worker threads, so a main-thread
message cannot wait for itself.

Bind teardown to captured mount and service identities, including process
start time. Report a service exit that cannot be confirmed after auxiliary
mount removal as a distinct error that keeps the original details. Such
volumes are not retried, and a multi-volume unmount reports all of them
together with any other failure or a declined prompt. Warn about it after
automatic unmounts and at quit, and keep the background application until
the warning is acknowledged. Keep rollback responsive, and let services
remove their auxiliary directories without probing mounted paths. Preserve
released /control compatibility and perform best-effort cleanup for older
services.

Reap bounded subprocesses as soon as their output ends. A child that
survives SIGKILL is reaped by a later call, which starts no new child until
then. Keep subjects and subprocess command, status and error output when
formatting exceptions for wrapping and logs. Clarify discovery and rollback
diagnostics. Fix the localization-dependent busy-volume regression
assertion and extend discovery, snapshot, process identity, cleanup, GUI
lifecycle, inactivity and teardown coverage.

.gitattributes

@@ -1,4 +1,5 @@
 # Set the default behavior, in case people don't have core.autocrlf set.
+.gitattributes	text eol=lf
 *	text=auto
 
 # Explicitly declare text files that could be normalized and converted
@@ -24,6 +25,7 @@ Makefile	text eol=lf
 *.fbp	text eol=lf
 *.rgs	text eol=lf
 *.pkgproj	text eol=lf
+*.S	text eol=lf
 Sources	text eol=lf
 
 # Declare files that will always have LF line endings on checkout.
@@ -35,6 +37,8 @@ Sources	text eol=lf
 *.rc	text eol=crlf
 *.bat	text eol=crlf
 *.cmd	text eol=crlf
+*.hhc	-text whitespace=cr-at-eol
+*.hhp	-text whitespace=cr-at-eol
 
 # Denote all files that are truly binary and should not be modified.
 *.png	binary

.github/FUNDING.yml

@@ -0,0 +1 @@
+custom: "https://veracrypt.jp/en/Donation.html"

.github/ISSUE_TEMPLATE/bug.md

@@ -0,0 +1,34 @@
+---
+name: Bug Report
+about: Found a bug? Let us know! 🐛
+labels: bug, unreviewed
+
+---
+
+<!-- Please provide a general summary of the issue in the title above. -->
+
+# Expected behavior
+<!-- Describe here what you have expected to happen -->
+
+# Observed behavior
+<!-- Describe here what happened instead of the expected behavior -->
+
+# Steps to reproduce
+<!-- Tell use all the steps you did so we can reproduce the problem -->
+1. 
+2. 
+3. 
+4.
+
+# Screenshots
+<!-- Add additional screenshots -->
+
+# Your Environment
+
+Please tell us more about your environment
+
+**VeraCrypt version:** <!-- f.e. 1.24-Update7 -->
+
+**Operating system and version:** <!-- f.e. Windows 10 build 19042 -->
+
+**System type:** <!-- f.e. 64-bit -->

.github/ISSUE_TEMPLATE/change.md

@@ -0,0 +1,30 @@
+---
+name: Change
+about: Change or extend functionality that already exists.
+labels: change, unreviewed
+
+---
+
+<!-- Please provide a general summary of your change in the title above. -->
+
+# Current behavior
+<!-- Describe here how it actually works -->
+
+# Desired behavior
+<!-- Describe here the difference from current behavior-->
+
+# Screenshots/Mockup/Designs
+<!-- Add additional screenshots, mockups or design proposals -->
+
+# Additional information
+<!-- Are there any additional requirements? Further ideas, ... -->
+
+# Your Environment
+
+Please tell us more about your environment
+
+**VeraCrypt version:** <!-- f.e. 1.24-Update7 -->
+
+**Operating system and version:** <!-- f.e. Windows 10 build 19042 -->
+
+**System type:** <!-- f.e. 64-bit -->

.github/ISSUE_TEMPLATE/feature.md

@@ -0,0 +1,27 @@
+---
+name: Feature
+about: Add new functionality or suggest an idea to the project.
+labels: feature, unreviewed
+
+---
+
+<!-- Please provide a general summary of your feature in the title above. -->
+
+# Desired behavior
+<!-- Describe here what and why your feature should be added -->
+
+# Screenshots/Mockup/Designs
+<!-- Add additional screenshots, mockups or design proposals -->
+
+# Additional information
+<!-- Are there any additional requirements? Further ideas, ... -->
+
+# Your Environment
+
+Please tell us more about your environment
+
+**VeraCrypt version:** <!-- f.e. 1.24-Update7 -->
+
+**Operating system and version:** <!-- f.e. Windows 10 build 19042 -->
+
+**System type:** <!-- f.e. 64-bit -->

.github/stale.yml

@@ -0,0 +1,25 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 60
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - pinned
+  - security
+# Label to use when marking an issue as stale
+staleLabel: wontfix
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: >
+  This issue has been automatically closed because it has not had
+  recent activity. This probably means that it is not reproducible
+  or it has been fixed in a newer version. If it’s an enhancement
+  and hasn't been taken on for so long, then it seems no one has
+  the time to implement this.
+  Please reopen if you still encounter this issue with the [latest stable version](https://veracrypt.jp/en/Downloads.html).
+  You can also contribute directly by providing a pull request.
+  Thank you!

.github/workflows/build-linux.yml

@@ -0,0 +1,213 @@
+name: Build and test Linux
+
+on:
+  push:
+    branches: [ "master" ]
+    paths:
+      - 'src/Build/Include/Makefile.inc'
+      - 'src/Build/CMakeLists.txt'
+      - 'src/Build/build_cmake_deb.sh'
+      - 'src/Common/*.h'
+      - 'src/Common/*.cpp'
+      - 'src/Common/*.c'
+      - 'src/Core/**'
+      - 'src/Crypto/**'
+      - 'src/Driver/Fuse/**'
+      - 'src/Main/**'
+      - 'src/PKCS11/**'
+      - 'src/Platform/**'
+      - 'src/Resources/**'
+      - 'src/Setup/Linux/**'
+      - 'src/Volume/**'
+      - 'src/Makefile'
+      - '.github/workflows/build-linux.yml'
+  pull_request:
+    branches: [ "master" ]
+    paths:
+      - 'src/Build/Include/Makefile.inc'
+      - 'src/Build/CMakeLists.txt'
+      - 'src/Build/build_cmake_deb.sh'
+      - 'src/Common/*.h'
+      - 'src/Common/*.cpp'
+      - 'src/Common/*.c'
+      - 'src/Core/**'
+      - 'src/Crypto/**'
+      - 'src/Driver/Fuse/**'
+      - 'src/Main/**'
+      - 'src/PKCS11/**'
+      - 'src/Platform/**'
+      - 'src/Resources/**'
+      - 'src/Setup/Linux/**'
+      - 'src/Volume/**'
+      - 'src/Makefile'
+      - '.github/workflows/build-linux.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  WXWIDGETS_VERSION: 3.2.5
+
+jobs:
+  ubuntu-build:
+
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Generate cache key
+      id: cache-key
+      run: |
+        echo "cache_key=$(echo ${{ env.WXWIDGETS_VERSION }}-$(sha256sum src/Makefile .github/workflows/build-linux.yml | awk '{print $1}'))" >> $GITHUB_OUTPUT
+
+    - name: Cache wxBuildConsole
+      uses: actions/cache@v3
+      id: cache-wxbuildconsole
+      with:
+        path: /tmp/wxBuildConsole
+        key: wxBuildConsole-${{ steps.cache-key.outputs.cache_key }}
+
+    - name: Cache wxBuildGUI
+      uses: actions/cache@v3
+      id: cache-wxbuildgui
+      with:
+        path: /tmp/wxBuildGUI
+        key: wxBuildGUI-${{ steps.cache-key.outputs.cache_key }}
+
+    - name: Cache wxWidgets
+      uses: actions/cache@v3
+      id: cache-wxwidgets
+      with:
+        path: /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}
+        key: wxWidgets-${{ steps.cache-key.outputs.cache_key }}
+
+    - name: Install dependencies
+      run: sudo apt-get update && sudo apt-get install -y wget tar libpcsclite-dev libfuse-dev yasm libgtk-3-dev libayatana-appindicator3-dev cmake debhelper
+
+    - name: Download and extract wxWidgets to /tmp if build folders are missing
+      if: steps.cache-wxbuildconsole.outputs.cache-hit != 'true' || steps.cache-wxbuildgui.outputs.cache-hit != 'true' || steps.cache-wxwidgets.outputs.cache-hit != 'true'
+      run: |
+        wget https://github.com/wxWidgets/wxWidgets/releases/download/v${{ env.WXWIDGETS_VERSION }}/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2 -O /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2
+        mkdir -p /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}
+        tar -xjf /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2 -C /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }} --strip-components=1
+
+    - name: Build VeraCrypt .deb packages
+      run: |
+        chmod +x src/Build/build_cmake_deb.sh
+        src/Build/build_cmake_deb.sh WXSTATIC INDICATOR
+
+    - name: Upload GUI .deb packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: veracrypt-gui-debs
+        path: /tmp/VeraCrypt_Packaging/GUI/Packaging/veracrypt-*.*
+
+    - name: Upload Console .deb packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: veracrypt-console-debs
+        path: /tmp/VeraCrypt_Packaging/Console/Packaging/veracrypt-console-*.*
+
+    - name: Install and test VeraCrypt GUI .deb packages
+      run: |
+        sudo apt install -y /tmp/VeraCrypt_Packaging/GUI/Packaging/veracrypt-*.deb
+        veracrypt --text --test && veracrypt --text --version
+        sudo veracrypt --text --non-interactive Tests/test.sha256.hc --hash sha256 --slot 1 --password test --mount-options=ro
+        sudo veracrypt --text --non-interactive Tests/test.sha512.hc --hash sha512 --slot 2 --password test --mount-options=ro
+        sudo veracrypt --text --non-interactive Tests/test.streebog.hc --hash streebog --slot 3 --password test --mount-options=ro
+        sudo veracrypt --text --non-interactive Tests/test.whirlpool.hc --hash whirlpool --slot 4 --password test --mount-options=ro
+        sudo veracrypt --text --list
+        echo -n "Dummy" > /tmp/expected_content.txt
+        if cmp -s /media/veracrypt1/Dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.sha256.hc is valid."
+        else
+          echo "Content of test.sha256.hc is invalid!"
+          exit 1
+        fi
+        if cmp -s /media/veracrypt2/Dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.sha512.hc is valid."
+        else
+          echo "Content of test.sha512.hc is invalid!"
+          exit 1
+        fi
+        if cmp -s /media/veracrypt3/Dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.streebog.hc is valid."
+        else
+          echo "Content of test.streebog.hc is invalid!"
+          exit 1
+        fi
+        if cmp -s /media/veracrypt4/Dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.whirlpool.hc is valid."
+        else
+          echo "Content of test.whirlpool.hc is invalid!"
+          exit 1
+        fi
+        sudo veracrypt -d
+        sudo apt remove -y veracrypt
+
+    - name: Install and test VeraCrypt Console .deb packages
+      run: |
+        sudo apt install -y /tmp/VeraCrypt_Packaging/Console/Packaging/veracrypt-console-*.deb
+        veracrypt --test && veracrypt --version
+        sudo veracrypt --non-interactive Tests/test.sha256.hc --hash sha256 --slot 1 --password test --mount-options=ro
+        sudo veracrypt --non-interactive Tests/test.sha512.hc --hash sha512 --slot 2 --password test --mount-options=ro
+        sudo veracrypt --non-interactive Tests/test.streebog.hc --hash streebog --slot 3 --password test --mount-options=ro
+        sudo veracrypt --non-interactive Tests/test.whirlpool.hc --hash whirlpool --slot 4 --password test --mount-options=ro
+        sudo veracrypt --list
+        echo -n "Dummy" > /tmp/expected_content.txt
+        if cmp -s /media/veracrypt1/dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.sha256.hc is valid."
+        else
+          echo "Content of test.sha256.hc is invalid!"
+          exit 1
+        fi
+        if cmp -s /media/veracrypt2/dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.sha512.hc is valid."
+        else
+          echo "Content of test.sha512.hc is invalid!"
+          exit 1
+        fi
+        if cmp -s /media/veracrypt3/dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.streebog.hc is valid."
+        else
+          echo "Content of test.streebog.hc is invalid!"
+          exit 1
+        fi
+        if cmp -s /media/veracrypt4/dummy.txt /tmp/expected_content.txt; then
+          echo "Content of test.whirlpool.hc is valid."
+        else
+          echo "Content of test.whirlpool.hc is invalid!"
+          exit 1
+        fi
+        sudo veracrypt -d
+        sudo apt remove -y veracrypt-console
+
+    - name: Cleanup old caches
+      uses: actions/github-script@v6
+      if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        script: |
+          const caches = await github.rest.actions.getActionsCacheList({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+          })
+          for (const cache of caches.data.actions_caches) {
+            if (cache.key.startsWith('wxBuildConsole-') || cache.key.startsWith('wxBuildGUI-') || cache.key.startsWith('wxWidgets-')) {
+              if (cache.key !== `wxBuildConsole-${{ steps.cache-key.outputs.cache_key }}` &&
+                  cache.key !== `wxBuildGUI-${{ steps.cache-key.outputs.cache_key }}` &&
+                  cache.key !== `wxWidgets-${{ steps.cache-key.outputs.cache_key }}`) {
+                console.log(`Deleting cache with key: ${cache.key}`)
+                await github.rest.actions.deleteActionsCacheById({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  cache_id: cache.id,
+                })
+              }
+            }
+          }
+

.github/workflows/xmlvalidate.sh

@@ -0,0 +1,196 @@
+#!/bin/bash
+set -euo pipefail # Exit on error, undefined variable, or pipe failure
+
+# --- Configuration ---
+SCRIPT_NAME=$(basename "$0")
+FAIL_FLAG=false
+
+# --- Colors ---
+COLOR_RED='\033[0;31m'
+COLOR_GREEN='\033[0;32m'
+COLOR_YELLOW='\033[0;33m'
+COLOR_CYAN='\033[0;36m'
+COLOR_MAGENTA='\033[0;35m'
+COLOR_RESET='\033[0m' # No Color
+
+# --- Helper Functions for Output ---
+log_info() { echo -e "${COLOR_CYAN}$1${COLOR_RESET}"; }
+log_success() { echo -e "${COLOR_GREEN}$1${COLOR_RESET}"; }
+log_warning() { echo -e "${COLOR_YELLOW}Warning: $1${COLOR_RESET}"; }
+log_error() { echo -e "${COLOR_RED}Error: $1${COLOR_RESET}" >&2; }
+log_detail() { echo -e "  $1"; }
+log_detail_success() { echo -e "  ${COLOR_GREEN}$1${COLOR_RESET}"; }
+log_detail_error() { echo -e "  ${COLOR_RED}$1${COLOR_RESET}"; }
+log_detail_warning() { echo -e "  ${COLOR_YELLOW}$1${COLOR_RESET}"; }
+log_detail_magenta() { echo -e "    ${COLOR_MAGENTA}$1${COLOR_RESET}"; }
+
+# --- Parameter Validation ---
+if [ "$#" -ne 1 ]; then
+    log_error "Usage: $SCRIPT_NAME <Path_To_VeraCrypt_Root>"
+    log_error "Example: $SCRIPT_NAME /path/to/VeraCrypt"
+    exit 1
+fi
+
+ROOT_PATH="$1"
+
+if [ ! -d "$ROOT_PATH" ]; then
+    log_error "Root path '$ROOT_PATH' not found or is not a directory."
+    exit 1
+fi
+
+# Define the path to the common Language.xml
+COMMON_FILE="$ROOT_PATH/src/Common/Language.xml"
+
+# Check if the common Language.xml exists
+if [ ! -f "$COMMON_FILE" ]; then
+    log_error "Common Language.xml not found or is not a file at path: $COMMON_FILE"
+    exit 1
+fi
+
+log_info "Extracting keys from $COMMON_FILE"
+
+# Define regex pattern to extract 'key' attributes from <entry> elements
+KEY_EXTRACTION_PATTERN='<entry\s+lang="[^"]+"\s+key="([^"]+)"'
+
+# Extract all keys using grep with PCRE (-P) and only outputting the captured group (-o)
+# Use process substitution and readarray to populate the KEYS array
+# Ensure grep returns 0 even if no match, or handle non-zero for no match
+KEYS_STRING=$(grep -oP "$KEY_EXTRACTION_PATTERN" "$COMMON_FILE" | sed -E 's/.*key="([^"]+)".*/\1/' || true)
+if [ -z "$KEYS_STRING" ]; then
+    KEYS=()
+else
+    readarray -t KEYS < <(echo "$KEYS_STRING")
+fi
+
+
+if [ ${#KEYS[@]} -eq 0 ]; then
+    log_warning "No keys found in $COMMON_FILE using pattern: $KEY_EXTRACTION_PATTERN"
+    # If this should be an error, uncomment next lines:
+    # log_error "No keys found in $COMMON_FILE."
+    # exit 1
+else
+    log_info "Found ${#KEYS[@]} keys."
+fi
+
+# Define the regex for finding invalid escape sequences.
+# Valid sequences: \n, \r, \t, \\, \"
+INVALID_ESCAPE_REGEX='(?<!\\)(?:\\\\)*\\([^nrt\\"])' # This is better
+ALLOWED_ESCAPES_MESSAGE="Allowed sequences are: \\n, \\r, \\t, \\\\ (for literal backslash), \\\" (for literal quote)"
+
+# Retrieve all translation XML files in the Translations folder
+TRANSLATION_FOLDER="$ROOT_PATH/Translations"
+FILES_TO_PROCESS=()
+
+# Add common file first
+FILES_TO_PROCESS+=("$COMMON_FILE")
+
+if [ ! -d "$TRANSLATION_FOLDER" ]; then
+    log_warning "Translations folder not found at path: $TRANSLATION_FOLDER. Skipping translation files."
+else
+    # Use find to get translation files. nullglob helps avoid errors if no files match.
+    shopt -s nullglob
+    for lang_file in "$TRANSLATION_FOLDER"/Language.*.xml; do
+        FILES_TO_PROCESS+=("$lang_file")
+    done
+    shopt -u nullglob # Reset nullglob
+    if [ ${#FILES_TO_PROCESS[@]} -eq 1 ]; then # Only common file was added
+        log_warning "No Language.*.xml files found in $TRANSLATION_FOLDER."
+    fi
+fi
+
+if [ ${#FILES_TO_PROCESS[@]} -eq 0 ]; then
+    log_warning "No files found to process."
+    exit 0 # Or 1 if this is an error condition
+fi
+
+# Iterate through each file and perform validations
+for file in "${FILES_TO_PROCESS[@]}"; do
+    if [ ! -f "$file" ]; then
+        log_warning "File not found or is not a file, skipping: $file"
+        continue
+    fi
+    echo # Newline for readability
+    log_info "Processing file: $file"
+    CURRENT_FILE_PASSES=true
+
+    # 1. Validate XML using fxparser
+    log_detail "Validating XML structure..."
+    # Capture stdout and stderr, get exit code
+    FXPARSER_OUTPUT=$(fxparser -V "$file" 2>&1)
+    FXPARSER_EXIT_CODE=$?
+
+    if [ "$FXPARSER_EXIT_CODE" -ne 0 ]; then
+        CURRENT_FILE_PASSES=false
+        FAIL_FLAG=true
+        log_detail_error "XML Validation Failed for $file (fxparser exit code: $FXPARSER_EXIT_CODE):"
+        while IFS= read -r line; do
+            log_detail_error "    $line"
+        done <<< "$FXPARSER_OUTPUT"
+    else
+        log_detail_success "XML structure is valid."
+    fi
+
+    # 2. Check for invalid backslash escape sequences
+    log_detail "Checking for invalid escape sequences..."
+    # Use grep -P for PCRE, -n for line numbers. --color=never to avoid grep's own coloring here.
+    # We check grep's exit code: 0 if found, 1 if not found, >1 for error.
+    INVALID_ESCAPE_MATCHES=$(grep -P -n --color=never "$INVALID_ESCAPE_REGEX" "$file" || true)
+
+    if [ -n "$INVALID_ESCAPE_MATCHES" ]; then
+        log_detail_error "File '$file' contains potentially invalid backslash escape sequences."
+        log_detail_error "$ALLOWED_ESCAPES_MESSAGE"
+        log_detail_error "Instances found:"
+        while IFS= read -r line_match; do
+            # Extract line number and the line content from grep's output (e.g., "123:content")
+            LINE_NUMBER=$(echo "$line_match" | cut -d: -f1)
+            LINE_CONTENT=$(echo "$line_match" | cut -d: -f2-)
+            # Trim whitespace (optional, but PowerShell did it)
+            TRIMMED_LINE_CONTENT=$(echo "$LINE_CONTENT" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+            log_detail_magenta "Line $LINE_NUMBER: $TRIMMED_LINE_CONTENT"
+        done <<< "$INVALID_ESCAPE_MATCHES"
+        CURRENT_FILE_PASSES=false
+        FAIL_FLAG=true
+    else
+        log_detail_success "No invalid escape sequences found."
+    fi
+
+    # 3. Check for the presence of each key in the current file (if keys were found)
+    if [ ${#KEYS[@]} -gt 0 ]; then
+        log_detail "Checking for key completeness..."
+        KEYS_MISSING_IN_CURRENT_FILE=0
+        for key_entry in "${KEYS[@]}"; do
+            # Search for key="KEY_NAME"
+            SEARCH_PATTERN_FOR_KEY="key=\"$key_entry\""
+            if ! grep -q "$SEARCH_PATTERN_FOR_KEY" "$file"; then
+                log_detail_error "Key '$key_entry' (from $COMMON_FILE) not found in $file"
+                CURRENT_FILE_PASSES=false
+                FAIL_FLAG=true
+                ((KEYS_MISSING_IN_CURRENT_FILE++))
+            fi
+        done
+        if [ "$KEYS_MISSING_IN_CURRENT_FILE" -eq 0 ]; then
+            log_detail_success "All keys from $COMMON_FILE are present."
+        else
+            log_detail_error "$KEYS_MISSING_IN_CURRENT_FILE key(s) missing."
+        fi
+    else
+        log_detail_warning "Skipping key completeness check as no keys were extracted from $COMMON_FILE."
+    fi
+
+    # Output the result for the current file
+    if [ "$CURRENT_FILE_PASSES" = true ]; then
+        log_success "$file PASSED all checks."
+    else
+        log_error "$file FAILED one or more checks."
+    fi
+done
+
+# Exit with appropriate status code
+echo # Newline for readability
+if [ "$FAIL_FLAG" = true ]; then
+    log_error "Overall Result: One or more files failed validation."
+    exit 1
+else
+    log_success "Overall Result: All processed files passed all checks successfully."
+    exit 0
+fi

.github/workflows/xmlvalidate.yml

@@ -0,0 +1,36 @@
+name: Validate XML
+
+on:
+  push:
+    branches: [ "master" ]
+    paths:
+      - 'Translations/*'
+      - 'src/Common/Language.xml'
+      - '.github/workflows/xmlvalidate.*'
+  pull_request:
+    branches: [ "master" ]
+    paths:
+      - 'Translations/*'
+      - 'src/Common/Language.xml'
+      - '.github/workflows/xmlvalidate.*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: 'latest'
+    - name: Install fast-xml-parser
+      run: npm install fast-xml-parser@4.5.2 -g
+    - name: Run XML validator script
+      run: ${{ github.workspace }}/.github/workflows/xmlvalidate.sh "${{ github.workspace }}"

.gitignore

@@ -0,0 +1,131 @@
+# For those using Visual Studio Code for development
+.vscode/
+
+# CLion
+.idea/
+
+# Python build/test artifacts
+__pycache__/
+*.py[cod]
+
+# VC Linux build artifacts
+*.o
+*.o0
+*.d
+*.a
+*.bmp.h
+*.xml.h
+*.txt.h
+*.h.gch
+src/Main/veracrypt
+*.osse41
+*.ossse3
+*.oshani
+*.oaesni
+*.oavx2
+*.oarmv8crypto
+src/Setup/Linux/packaging/
+src/Setup/Linux/usr/
+src/Setup/Linux/veracrypt.AppDir/usr/
+src/Setup/Linux/veracrypt.AppDir/veracrypt.png
+src/Setup/Linux/veracrypt_*.tar.gz
+src/Setup/Linux/veracrypt-*-setup-*
+
+# VC macOS build artifacts
+src/Main/VeraCrypt
+src/Main/VeraCrypt.app
+src/Main/*.dmg
+src/Setup/MacOSX/*.pkg
+*.oo
+*.o.32
+*.o.64
+.DS_Store
+
+# wxWidgets Linux build artifacts
+src/wxrelease
+src/wxdebug
+
+# Arch Linux package build artifacts
+src/Build/Packaging/arch/pkg/
+src/Build/Packaging/arch/src/
+src/Build/Packaging/arch/PKGBUILD.release
+src/Build/Packaging/arch/*.pkg.tar*
+src/Build/Packaging/arch/*.log
+
+src/.vs
+
+src/Boot/Windows/obj
+src/Boot/Windows/Release
+src/Boot/Windows/Release_AES
+src/Boot/Windows/Release_AES_SHA2
+src/Boot/Windows/Release_Camellia
+src/Boot/Windows/Release_Camellia_SHA2
+src/Boot/Windows/Release_Serpent
+src/Boot/Windows/Release_Serpent_SHA2
+src/Boot/Windows/Release_SHA2
+src/Boot/Windows/Release_Twofish
+src/Boot/Windows/Release_Twofish_SHA2
+src/Boot/Windows/Rescue
+src/Boot/Windows/Rescue_AES
+src/Boot/Windows/Rescue_AES_SHA2
+src/Boot/Windows/Rescue_Camellia
+src/Boot/Windows/Rescue_Camellia_SHA2
+src/Boot/Windows/Rescue_Serpent
+src/Boot/Windows/Rescue_Serpent_SHA2
+src/Boot/Windows/Rescue_SHA2
+src/Boot/Windows/Rescue_Twofish
+src/Boot/Windows/Rescue_Twofish_SHA2
+
+src/Common/Debug
+src/Common/obj_driver_debug
+src/Common/obj_driver_release
+src/Common/Release
+src/Common/x64
+src/Common/ARM64
+src/Common/*.log
+
+src/Crypto/Debug
+src/Crypto/obj_driver_debug
+src/Crypto/obj_driver_release
+src/Crypto/Release
+src/Crypto/x64
+src/Crypto/ARM64
+
+src/Debug
+
+src/Driver/Debug
+src/Driver/obj
+src/Driver/obj_driver_debug
+src/Driver/obj_driver_release
+src/Driver/Release
+src/Driver/ARM64
+
+src/ExpandVolume/Debug
+src/ExpandVolume/Release
+src/ExpandVolume/x64
+src/ExpandVolume/ARM64
+src/ExpandVolume/*.tlb
+
+src/Format/Debug
+src/Format/Release
+src/Format/x64
+src/Format/ARM64
+src/Format/*.tlb
+src/Format/FormatCom_h.h
+src/Format/FormatCom_i.c
+
+src/Mount/Debug
+src/Mount/Release
+src/Mount/x64
+src/Mount/ARM64
+src/Mount/*.tlb
+src/Mount/MainCom_h.h
+src/Mount/MainCom_i.c
+
+src/Setup/Debug
+src/Setup/PortableDebug
+src/Setup/Release
+src/Setup/PortableRelease
+
+src/SetupDLL/Debug
+src/SetupDLL/Release

License.txt

@@ -1,3 +1,202 @@
+VeraCrypt License
+Software distributed under this license is distributed on an "AS
+IS" BASIS WITHOUT WARRANTIES OF ANY KIND. THE AUTHORS AND
+DISTRIBUTORS OF THE SOFTWARE DISCLAIM ANY LIABILITY. ANYONE WHO
+USES, COPIES, MODIFIES, OR (RE)DISTRIBUTES ANY PART OF THE
+SOFTWARE IS, BY SUCH ACTION(S), ACCEPTING AND AGREEING TO BE
+BOUND BY ALL TERMS AND CONDITIONS OF THIS LICENSE. IF YOU DO NOT
+ACCEPT THEM, DO NOT USE, COPY, MODIFY, NOR (RE)DISTRIBUTE THE
+SOFTWARE, NOR ANY PART(S) THEREOF.
+
+VeraCrypt is multi-licensed under Apache License 2.0 and
+the TrueCrypt License version 3.0, a verbatim copy of both
+licenses can be found below.
+
+This license does not grant you rights to use any
+contributors' name, logo, or trademarks, including IDRIX,
+AM Crypto, VeraCrypt and all derivative names.
+For example, the following names are not allowed: VeraCrypt,
+VeraCrypt+, VeraCrypt Professional, iVeraCrypt, etc. Nor any
+other names confusingly similar to the name VeraCrypt (e.g.,
+Vera-Crypt, Vera Crypt, VerKrypt, etc.)
+____________________________________________________________
+
+							Apache License
+					   Version 2.0, January 2004
+					https://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+  "License" shall mean the terms and conditions for use, reproduction,
+  and distribution as defined by Sections 1 through 9 of this document.
+
+  "Licensor" shall mean the copyright owner or entity authorized by
+  the copyright owner that is granting the License.
+
+  "Legal Entity" shall mean the union of the acting entity and all
+  other entities that control, are controlled by, or are under common
+  control with that entity. For the purposes of this definition,
+  "control" means (i) the power, direct or indirect, to cause the
+  direction or management of such entity, whether by contract or
+  otherwise, or (ii) ownership of fifty percent (50%) or more of the
+  outstanding shares, or (iii) beneficial ownership of such entity.
+
+  "You" (or "Your") shall mean an individual or Legal Entity
+  exercising permissions granted by this License.
+
+  "Source" form shall mean the preferred form for making modifications,
+  including but not limited to software source code, documentation
+  source, and configuration files.
+
+  "Object" form shall mean any form resulting from mechanical
+  transformation or translation of a Source form, including but
+  not limited to compiled object code, generated documentation,
+  and conversions to other media types.
+
+  "Work" shall mean the work of authorship, whether in Source or
+  Object form, made available under the License, as indicated by a
+  copyright notice that is included in or attached to the work
+  (an example is provided in the Appendix below).
+
+  "Derivative Works" shall mean any work, whether in Source or Object
+  form, that is based on (or derived from) the Work and for which the
+  editorial revisions, annotations, elaborations, or other modifications
+  represent, as a whole, an original work of authorship. For the purposes
+  of this License, Derivative Works shall not include works that remain
+  separable from, or merely link (or bind by name) to the interfaces of,
+  the Work and Derivative Works thereof.
+
+  "Contribution" shall mean any work of authorship, including
+  the original version of the Work and any modifications or additions
+  to that Work or Derivative Works thereof, that is intentionally
+  submitted to Licensor for inclusion in the Work by the copyright owner
+  or by an individual or Legal Entity authorized to submit on behalf of
+  the copyright owner. For the purposes of this definition, "submitted"
+  means any form of electronic, verbal, or written communication sent
+  to the Licensor or its representatives, including but not limited to
+  communication on electronic mailing lists, source code control systems,
+  and issue tracking systems that are managed by, or on behalf of, the
+  Licensor for the purpose of discussing and improving the Work, but
+  excluding communication that is conspicuously marked or otherwise
+  designated in writing by the copyright owner as "Not a Contribution."
+
+  "Contributor" shall mean Licensor and any individual or Legal Entity
+  on behalf of whom a Contribution has been received by Licensor and
+  subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+  this License, each Contributor hereby grants to You a perpetual,
+  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+  copyright license to reproduce, prepare Derivative Works of,
+  publicly display, publicly perform, sublicense, and distribute the
+  Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+  this License, each Contributor hereby grants to You a perpetual,
+  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+  (except as stated in this section) patent license to make, have made,
+  use, offer to sell, sell, import, and otherwise transfer the Work,
+  where such license applies only to those patent claims licensable
+  by such Contributor that are necessarily infringed by their
+  Contribution(s) alone or by combination of their Contribution(s)
+  with the Work to which such Contribution(s) was submitted. If You
+  institute patent litigation against any entity (including a
+  cross-claim or counterclaim in a lawsuit) alleging that the Work
+  or a Contribution incorporated within the Work constitutes direct
+  or contributory patent infringement, then any patent licenses
+  granted to You under this License for that Work shall terminate
+  as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+  Work or Derivative Works thereof in any medium, with or without
+  modifications, and in Source or Object form, provided that You
+  meet the following conditions:
+
+  (a) You must give any other recipients of the Work or
+	  Derivative Works a copy of this License; and
+
+  (b) You must cause any modified files to carry prominent notices
+	  stating that You changed the files; and
+
+  (c) You must retain, in the Source form of any Derivative Works
+	  that You distribute, all copyright, patent, trademark, and
+	  attribution notices from the Source form of the Work,
+	  excluding those notices that do not pertain to any part of
+	  the Derivative Works; and
+
+  (d) If the Work includes a "NOTICE" text file as part of its
+	  distribution, then any Derivative Works that You distribute must
+	  include a readable copy of the attribution notices contained
+	  within such NOTICE file, excluding those notices that do not
+	  pertain to any part of the Derivative Works, in at least one
+	  of the following places: within a NOTICE text file distributed
+	  as part of the Derivative Works; within the Source form or
+	  documentation, if provided along with the Derivative Works; or,
+	  within a display generated by the Derivative Works, if and
+	  wherever such third-party notices normally appear. The contents
+	  of the NOTICE file are for informational purposes only and
+	  do not modify the License. You may add Your own attribution
+	  notices within Derivative Works that You distribute, alongside
+	  or as an addendum to the NOTICE text from the Work, provided
+	  that such additional attribution notices cannot be construed
+	  as modifying the License.
+
+  You may add Your own copyright statement to Your modifications and
+  may provide additional or different license terms and conditions
+  for use, reproduction, or distribution of Your modifications, or
+  for any such Derivative Works as a whole, provided Your use,
+  reproduction, and distribution of the Work otherwise complies with
+  the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+  any Contribution intentionally submitted for inclusion in the Work
+  by You to the Licensor shall be under the terms and conditions of
+  this License, without any additional terms or conditions.
+  Notwithstanding the above, nothing herein shall supersede or modify
+  the terms of any separate license agreement you may have executed
+  with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+  names, trademarks, service marks, or product names of the Licensor,
+  except as required for reasonable and customary use in describing the
+  origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+  agreed to in writing, Licensor provides the Work (and each
+  Contributor provides its Contributions) on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+  implied, including, without limitation, any warranties or conditions
+  of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+  PARTICULAR PURPOSE. You are solely responsible for determining the
+  appropriateness of using or redistributing the Work and assume any
+  risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+  whether in tort (including negligence), contract, or otherwise,
+  unless required by applicable law (such as deliberate and grossly
+  negligent acts) or agreed to in writing, shall any Contributor be
+  liable to You for damages, including any direct, indirect, special,
+  incidental, or consequential damages of any character arising as a
+  result of this License or out of the use or inability to use the
+  Work (including but not limited to damages for loss of goodwill,
+  work stoppage, computer failure or malfunction, or any and all
+  other commercial damages or losses), even if such Contributor
+  has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+  the Work or Derivative Works thereof, You may choose to offer,
+  and charge a fee for, acceptance of support, warranty, indemnity,
+  or other liability obligations and/or rights consistent with this
+  License. However, in accepting such obligations, You may act only
+  on Your own behalf and on Your sole responsibility, not on behalf
+  of any other Contributor, and only if You agree to indemnify,
+  defend, and hold each Contributor harmless for any liability
+  incurred by, or claims asserted against, such Contributor by reason
+  of your accepting any such warranty or additional liability.
+____________________________________________________________
+
 TrueCrypt License Version 3.0
 
 Software distributed under this license is distributed on an "AS
@@ -480,24 +679,143 @@ warranties in respect of its properties, including, but not
 limited to, correctness and/or fitness for purpose.
 ____________________________________________________________
 
-Copyright (C) 2002-2004 Mark Adler, all rights reserved
-version 1.8, 9 Jan 2004
+Copyright (C) 1995-2023 Jean-loup Gailly and Mark Adler
 
-This software is provided 'as-is', without any express or
-implied warranty.  In no event will the author be held liable
-for any damages arising from the use of this software.
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
 
-Permission is granted to anyone to use this software for any
-purpose, including commercial applications, and to alter it and
-redistribute it freely, subject to the following restrictions:
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
 
-1. The origin of this software must not be misrepresented; you
-   must not claim that you wrote the original software. If you
-   use this software in a product, an acknowledgment in the
-   product documentation would be appreciated but is not
-   required.
-2. Altered source versions must be plainly marked as such, and
-   must not be misrepresented as being the original software.
-3. This notice may not be removed or altered from any source
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+____________________________________________________________
+Copyright (C) 1999-2023 Dieter Baron and Thomas Klausner
+
+The authors can be contacted at <libzip@nih.at>
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in
+  the documentation and/or other materials provided with the
   distribution.
+
+3. The names of the authors may not be used to endorse or promote
+  products derived from this software without specific prior
+  written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS
+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+____________________________________________________________
+Copyright (c) 2013, Alexey Degtyarev. All rights reserved.
+
+____________________________________________________________
+Copyright (c) 2016. Disk Cryptography Services for EFI (DCS), Alex Kolotnikov
+This program and the accompanying materials are licensed and made available 
+under the terms and conditions of the GNU Lesser General Public License, 
+version 3.0 (LGPL-3.0).
+
+The full text of the license may be found at https://opensource.org/licenses/LGPL-3.0
+____________________________________________________________
+Copyright (c) 1999-2016 Jack Lloyd. 
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in
+  the documentation and/or other materials provided with the
+  distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS
+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+____________________________________________________________
+Copyright (c) 2013-2019 Stephan Mueller <smueller@chronox.de>
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, and the entire permission notice in its entirety, 
+   including the disclaimer of warranties.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+3. The name of the author may not be used to endorse or promote
+   products derived from this software without specific prior
+   written permission.
+
+ALTERNATIVELY, this product may be distributed under the terms of
+the GNU General Public License, in which case the provisions of the
+GPL2 are required INSTEAD OF the above restrictions. (This clause is
+necessary due to a potential bad interaction between the GPL and the
+restrictions contained in a BSD-style copyright.)
+
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF WHICH
+ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+____________________________________________________________
+Copyright (c) 1999-2023 Igor Pavlov
+
+LZMA SDK is written and placed in the public domain by Igor Pavlov.
+
+Some code in LZMA SDK is based on public domain code from another developers:
+  1) PPMd var.H (2001): Dmitry Shkarin
+  2) SHA-256: Wei Dai (Crypto++ library)
+
+Anyone is free to copy, modify, publish, use, compile, sell, or distribute the 
+original LZMA SDK code, either in source code form or as a compiled binary, for 
+any purpose, commercial or non-commercial, and by any means.
 ____________________________________________________________

README.md

@@ -1,9 +1,7 @@
 This archive contains the source code of VeraCrypt.
-It is based on original TrueCrypt 7.1a with security enhancements and modifications.
+It is based on the original TrueCrypt 7.1a with security enhancements and modifications.
 
-
-Important
-=========
+# Important
 
 You may use the source code contained in this archive only if you accept and
 agree to the license terms contained in the file 'License.txt', which is
@@ -12,266 +10,249 @@ included in this archive.
 Note that the license specifies, for example, that a derived work must not be
 called 'TrueCrypt' or 'VeraCrypt'
 
+# Contents
 
+[I. Windows](#i-windows)
 
-Contents
-========
+[II. Linux and Mac OS X](#ii-linux-and-mac-os-x)
 
-I. Windows
-   Requirements for Building VeraCrypt for Windows
-   Instructions for Building VeraCrypt for Windows
-	Instructions for Signing and Packaging VeraCrypt for Windows
+[III. FreeBSD and OpenBSD](#iii-freebsd-and-openbsd)
 
-II. Linux and Mac OS X
-    Requirements for Building VeraCrypt for Linux and Mac OS X
-    Instructions for Building VeraCrypt for Linux and Mac OS X
-	Mac OS X specifics
+[IV. Third-Party Developers (Contributors)](#iv-third-party-developers-contributors)
 
-III. FreeBSD and OpenSolaris
+[V. Legal Information](#v-legal-information)
 
-IV. Third-Party Developers (Contributors)
+[VI. Further Information](#vi-further-information)
 
-V. Legal Information
+# I. Windows
 
-VI. Further Information
+## Requirements for Building VeraCrypt for Windows:
 
-
-
-I. Windows
-==========
-
-Requirements for Building VeraCrypt for Windows:
-------------------------------------------------
-
-- Microsoft Visual C++ 2010 SP1 (Professional Edition or compatible)
-- Microsoft Visual C++ 1.52 (available from MSDN Subscriber Downloads)
-- Microsoft Windows SDK for Windows 7.1 (configured for Visual C++ 2010)
-- Microsoft Windows SDK for Windows 8.1 (needed for SHA-256 code signing)
-- Microsoft Windows Driver Kit 7.1.0 (build 7600.16385.1)
-- RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki) 2.20
-  header files (available at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20)
-- NASM assembler 2.08 or compatible
-- gzip compressor
-- upx packer (available at http://upx.sourceforge.net/)
+A detailed guide on how to build VeraCrypt on Windows can be found in
+the [documentation](./doc/html/en/CompilingGuidelineWin.html) in the repository and
+it is also available [online](https://veracrypt.jp/en/CompilingGuidelineWin.html) or on the [mirror](https://veracrypt.io/en/CompilingGuidelineWin.html).
 
 IMPORTANT:
 
 The 64-bit editions of Windows Vista and later versions of Windows, and in
-some cases (e.g. playback of HD DVD content) also the 32-bit editions, do not
+some cases (e.g. playback of HD DVD content) also the 32-bit editions do not
 allow the VeraCrypt driver to run without an appropriate digital signature.
 Therefore, all .sys files in official VeraCrypt binary packages are digitally
-signed with the digital certificate of the IDRIX, which was
-issued by Thawte certification authority. At the end of each official .exe and
+signed with the digital certificate of the IDRIX, which was issued by
+GlobalSign certification authority. At the end of each official .exe and
 .sys file, there are embedded digital signatures and all related certificates
 (i.e. all certificates in the relevant certification chain, such as the
 certification authority certificates, CA-MS cross-certificate, and the
 IDRIX certificate).
-Keep this in mind if you compile VeraCrypt
-and compare your binaries with the official binaries. If your binaries are
-unsigned, the sizes of the official binaries will usually be approximately
-10 KB greater than sizes of your binaries (there may be further differences
-if you use a different version of the compiler, or if you install a different
-or no service pack for Visual Studio, or different hotfixes for it, or if you
-use different versions of the required SDKs).
 
+Keep this in mind if you compile VeraCrypt and compare your binaries with the
+official binaries. If your binaries are unsigned, the sizes of the official
+binaries will usually be approximately 10 KiB greater than the sizes of your
+binaries (there may be further differences if you use a different version of
+the compiler, or if you install a different or no service pack for Visual
+Studio, or different hotfixes for it, or if you use different versions of
+the required SDKs).
 
-Instructions for Building VeraCrypt for Windows:
-------------------------------------------------
-
-1) Create an environment variable 'MSVC16_ROOT' pointing to the folder 'MSVC15'
-   extracted from the Visual C++ 1.52 self-extracting package.
-
-   Note: The 16-bit installer MSVC15\SETUP.EXE cannot be run on 64-bit Windows,
-   but it is actually not necessary to run it. You only need to extract the
-   folder 'MSVC15', which contains the 32-bit binaries required to build the
-   VeraCrypt Boot Loader.
-
-2) If you have installed the Windows Driver Development Kit in another
-   directory than '%SYSTEMDRIVE%\WinDDK', create an environment variable
-   'WINDDK_ROOT' pointing to the DDK installation directory.
-
-3) Copy the PKCS #11 header files to a standard include path or create an
-   environment variable 'PKCS11_INC' pointing to the directory where
-   the PKCS #11 header files are installed.
-
-4) Open the solution file 'VeraCrypt.sln' in Microsoft Visual Studio 2010.
-
-5) Select 'All' as the active solution configuration.
-
-6) Build the solution.
-
-7) If successful, there should be newly built VeraCrypt binaries in the
-   'Release' folder.
-
-Instructions for Signing and Packaging VeraCrypt for Windows:
--------------------------------------------------------------
+## Instructions for Signing and Packaging VeraCrypt for Windows:
 
 First, create an environment variable 'WSDK81' pointing to the Windows SDK
 for Windows 8.1 installation directory.
+
 The folder "Signing" contains a batch file (sign.bat) that will sign all
 VeraCrypt components using a code signing certificate present on the
-certificate store and also build the final installation setup.
-The batch file suppose that the code signing certificate is issued by Thawt.
-This is the case for IDRIX's certificate. If yours is issued by another CA,
-then you should put the Root and Intermediate certificates in the "Signing"
-folder and then modify sign.bat accordingly.
+certificate store and build the final installation setup and MSI package.
+The batch file assumes that the code signing certificate is issued by
+GlobalSign. This is the case for IDRIX's certificate. If yours is issued by
+another CA, then you should put its intermediate certificates in the "Signing"
+folder and modify sign.bat accordingly.
 
-VeraCrypt EFI Boot Loader:
---------------------------
+To generate MSI packages, WiX Toolset v3.11 must be installed.
+
+## VeraCrypt EFI Boot Loader:
 
 VeraCrypt source code contains pre-built EFI binaries under src\Boot\EFI.
 The source code of VeraCrypt EFI Boot Loader is licensed under LGPL and
 it is available at https://github.com/veracrypt/VeraCrypt-DCS.
 For build instructions, please refer to the file src\Boot\EFI\Readme.txt.
 
+# II. Linux and Mac OS X
 
-II. Linux and Mac OS X
-======================
+A detailed guide on how to build VeraCrypt on Linux can be found in
+the [documentation](./doc/html/en/CompilingGuidelineLinux.html) in the repository and
+it is also available [online](https://veracrypt.jp/en/CompilingGuidelineLinux.html) or on the [mirror](https://veracrypt.io/en/CompilingGuidelineLinux.html).
 
-Requirements for Building VeraCrypt for Linux and Mac OS X:
------------------------------------------------------------
+## Requirements for Building VeraCrypt for Linux and Mac OS X:
 
 - GNU Make
 - GNU C++ Compiler 4.0 or compatible
-- Apple Xcode (Mac OS X only)
-- NASM assembler 2.08 or compatible (x86/x64 architecture only)
+- Apple Xcode or Xcode command line tools (Mac OS X only)
+- YASM 1.3.0 or newer (Linux only, x86/x64 architecture only)
 - pkg-config
-- makeself (Linux only)
 - wxWidgets 3.0 shared library and header files installed or
-  wxWidgets 3.0 library source code (available at http://www.wxwidgets.org)
+  wxWidgets 3.0 library source code (available at https://www.wxwidgets.org)
 - FUSE library and header files (available at https://github.com/libfuse/libfuse
-  and https://osxfuse.github.io/)
-- RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki) 2.20
-  header files (available at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20).
-  They are already included in the source tree under the directory PKCS11 but
-  it is possible to override it using the environment variable 'PKCS11_INC'.
+  and https://macfuse.github.io/)
+- PCSC-lite library and header files (available at https://github.com/LudovicRousseau/PCSC)
 
+## Instructions for Building VeraCrypt for Linux and Mac OS X:
 
-Instructions for Building VeraCrypt for Linux and Mac OS X:
------------------------------------------------------------
+1. Change the current directory to the root of the VeraCrypt source code.
 
-1) Change the current directory to the root of the VeraCrypt source code.
-
-2) If you have no wxWidgets shared library installed, run the following
+2. If you have no wxWidgets shared library installed, run the following
    command to configure the wxWidgets static library for VeraCrypt and to
    build it:
 
-   $ make WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
+   `$ make WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild`
 
-   The variable WX_ROOT must point to the location of the source code of the
+   The variable `WX_ROOT` must point to the location of the source code of the
    wxWidgets library. Output files will be placed in the './wxrelease/'
    directory.
 
-3) To build VeraCrypt, run the following command:
+3. To build VeraCrypt, run the following command:
 
-   $ make
+   `$ make`
 
    or if you have no wxWidgets shared library installed:
 
-   $ make WXSTATIC=1
+   `$ make WXSTATIC=1`
 
-4) If successful, the VeraCrypt executable should be located in the directory
+4. If successful, the VeraCrypt executable should be located in the directory
    'Main'.
 
+Reproducible build note: when `SOURCE_DATE_EPOCH` is not set, a build from a
+git checkout uses the HEAD commit timestamp, while a build from a release
+tarball uses the release date in `src/Common/Tcdefs.h` at 00:00 UTC. To
+reproduce official release artifacts from a git checkout, set
+`SOURCE_DATE_EPOCH` explicitly or build from the release tarball. Vendored
+VeraCrypt sources tracked in another git checkout are treated the same way and
+use that checkout's HEAD timestamp.
+
+Both the generated `.deb` and `.rpm` packages are reproducible, including on older rpm (e.g. CentOS/RHEL 7) that lacks the `SOURCE_DATE_EPOCH`/`_buildhost` build macros.
+
 By default, a universal executable supporting both graphical and text user
 interface (through the switch --text) is built.
 On Linux, a console-only executable, which requires no GUI library, can be
 built using the 'NOGUI' parameter:
 
-   $ make NOGUI=1 WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild
-   $ make NOGUI=1 WXSTATIC=1
+`$ make NOGUI=1 WXSTATIC=1 WX_ROOT=/usr/src/wxWidgets wxbuild`
+
+`$ make NOGUI=1 WXSTATIC=1`
+
+## Arch Linux package build:
+
+Arch Linux users can build and install a package from the current checkout with
+makepkg:
+
+`$ cd src/Build/Packaging/arch`
+
+`$ makepkg -si`
 
 On MacOSX, building a console-only executable is not supported.
 
-Mac OS X specifics:
------------------------------------------------------------
+## Mac OS X specifics:
 
-Under MacOSX, the SDK for OSX 10.7 is used by default. To use another version
-of the SDK (i.e. 10.6), you can export the environment variable VC_OSX_TARGET:
+Under MacOSX, the latest installed SDK is used by default. To use a different version
+of the SDK when building using make, you can export the environment variable VC_OSX_SDK:
 
-	$ export VC_OSX_TARGET=10.6
+`$ export VC_OSX_SDK=13.0`
 
+For development dependencies management, you can use [homebrew](https://brew.sh).
 
-Before building under MacOSX, pkg-config must be installed if not yet available.
-Get it from http://pkgconfig.freedesktop.org/releases/pkg-config-0.28.tar.gz and
+`$ brew install pkg-config yasm wxwidgets`
+
+You also need system dependencies
+
+`$ brew install --cask macfuse packages`
+
+After installing dependencies via brew, you can build a local development build
+
+`$ ./src/Build/build_veracrypt_macosx.sh -b`
+
+If you want to build the package, you must pass `-p` to the build script above. The built
+executable will be in `.src/Main`
+
+If you prefer to build from sources, or without homebrew, pkg-config and packages must be installed.
+
+Get pkg-config from https://pkgconfig.freedesktop.org/releases/pkg-config-0.29.2.tar.gz and
 compile using the following commands:
 
-	$ ./configure --with-internal-glib
-	$ make
-	$ sudo make install
+`$ CFLAGS="-Wno-int-conversion" CXXFLAGS="-Wno-int-conversion" ./configure --with-internal-glib`
 
-After making sure pkg-config is available, download and install OSXFuse from
-https://osxfuse.github.io/ (MacFUSE compatibility layer must selected)
+`$ make`
 
-The script build_veracrypt_macosx.sh available under "src/Build" performs the
+`$ sudo make install`
+
+After making sure pkg-config is available, download and install macFUSE from
+https://macfuse.github.io/
+
+The [build_veracrypt_macosx.sh](./src/Build/build_veracrypt_macosx.sh) script performs the
 full build of VeraCrypt including the creation of the installer pkg. It expects
-to find the wxWidgets 3.0.2 sources at the same level as where you put
+to find the wxWidgets 3.2.5 sources at the same level as where you put
 VeraCrypt sources (i.e. if "src" path is "/Users/joe/Projects/VeraCrypt/src"
-then wxWidgets should be at "/Users/joe/Projects/wxWidgets-3.0.2")
+then wxWidgets should be at "/Users/joe/Projects/wxWidgets-3.2.5")
 
-The build process uses Code Signing certificates whose ID is specified in
-src/Main/Main.make (lines 167 & 169). You'll have to modify these lines to put
-the ID of your Code Signing certificates or comment them if you don't have one.
+The make build process uses Code Signing certificates whose ID is specified in
+src/Main/Main.make (look for lines containing "Developer ID Application" and
+"Developer ID Installer"). You'll have to modify these lines to put the ID of
+your Code Signing certificates or comment them out if you don't have one.
 
-Because of incompatibility issues with OSXFUSE, the SDK 10.9 generates a
-VeraCrypt binary that has issues communicating with the OSXFUSE kernel extension.
-Thus, we recommend to use the SDK 10.8 or earlier for building VeraCrypt.
+Because of incompatibility issues with macFUSE, the SDK 10.9 generates a
+VeraCrypt binary that has issues communicating with the macFUSE kernel extension.
+Thus, we recommend using a different macOS SDK version for building VeraCrypt.
 
+The Packages installer that is used for the VeraCrypt official build has been notarized by IDRIX and it is available at
+https://github.com/idrassi/packages/releases
 
+# III. FreeBSD and OpenBSD
 
-III. FreeBSD and OpenSolaris
-============================
+FreeBSD is supported starting from version 14.
+OpenBSD is supported starting from version 7.8.
+The build requirements and instructions are the same as Linux except that gmake
+should be used instead of make.
 
-FreeBSD and OpenSolaris are not yet supported.
-
-
-
-IV. Third-Party Developers (Contributors)
-=========================================
+# IV. Third-Party Developers (Contributors)
 
 If you intend to implement a feature, please contact us first to make sure:
 
-1) That the feature has not been implemented (we may have already implemented
+1. That the feature has not been implemented (we may have already implemented
    it, but haven't released the code yet).
-2) That the feature is acceptable.
-3) Whether we need help of third-party developers with implementing the feature.
+2. That the feature is acceptable.
+3. Whether we need the help of third-party developers with implementing the feature.
 
 Information on how to contact us can be found at:
-https://veracrypt.codeplex.com/
+https://veracrypt.jp or
+https://veracrypt.io (mirror)
 
+# V. Legal Information
 
-
-V. Legal Information
-====================
-
-Copyright Information
----------------------
+## Copyright Information
 
 This software as a whole:  
-Copyright (c) 2013-2016 IDRIX. All rights reserved.
+Copyright (c) 2026 AM Crypto. All rights reserved.  
 
 Portions of this software:  
-Copyright (c) 2013-2016 IDRIX. All rights reserved.
+Copyright (c) 2026 AM Crypto. All rights reserved.  
+Copyright (c) 2013-2025 IDRIX. All rights reserved.  
 Copyright (c) 2003-2012 TrueCrypt Developers Association. All rights reserved.  
 Copyright (c) 1998-2000 Paul Le Roux. All rights reserved.  
 Copyright (c) 1998-2008 Brian Gladman, Worcester, UK. All rights reserved.  
-Copyright (c) 2002-2004 Mark Adler. All rights reserved.
+Copyright (c) 1995-2023 Jean-loup Gailly and Mark Adler.  
 Copyright (c) 2016 Disk Cryptography Services for EFI (DCS), Alex Kolotnikov  
-Copyright (c) 1990-2002 Info-ZIP. All rights reserved.
+Copyright (c) 1999-2023 Dieter Baron and Thomas Klausner.  
 Copyright (c) 2013, Alexey Degtyarev. All rights reserved.  
+Copyright (c) 1999-2016 Jack Lloyd. All rights reserved.  
+Copyright (c) 2013-2019 Stephan Mueller <smueller@chronox.de>  
+Copyright (c) 1999-2023 Igor Pavlov  
 
 For more information, please see the legal notices attached to parts of the
 source code.
 
-Trademark Information
----------------------
+## Trademark Information
 
 Any trademarks contained in the source code, binaries, and/or in the
 documentation, are the sole property of their respective owners.
 
+# VI. Further Information
 
-
-VI. Further Information
-=======================
-
-http://www.veracrypt.fr
+https://veracrypt.jp  
+https://veracrypt.io (mirror)

Tests/README-macos-lifecycle.md

@@ -0,0 +1,69 @@
+# macOS lifecycle regression checks
+
+Run these checks on macOS with Xcode Command Line Tools and Python 3. They do not
+require administrator privileges, mounted containers, or an installed test app.
+
+Build the matching VeraCrypt sources first. Use a clean build after changing
+headers: the current makefiles do not track every header dependency. The archive
+architecture must match the compiler's default architecture.
+
+From the repository root, set `VC_TEST_BUILD_SRC` to the `src` directory of that
+build, then run:
+
+```sh
+VC_TEST_BUILD_SRC=/absolute/path/to/build/src
+python3 Tests/test_macos_discovery.py --platform-archive "$VC_TEST_BUILD_SRC/Platform/Platform.a"
+python3 Tests/test_fuset_cleanup.py --build-dir "$VC_TEST_BUILD_SRC"
+```
+
+The discovery runner compiles the production plist and batch-refresh methods
+with an in-memory inventory provider. It checks exact and legacy alias matches,
+unresolved inventory, stale-field invalidation, one query per refresh, and fresh
+discovery before destructive operations. It also runs `macos_process_test.cpp`
+against the real platform archive, checking subprocess deadlines, output limits,
+descriptor isolation, error reporting, and child reaping with its own helper
+processes. `macos_volume_state_test.cpp` includes production headers directly to
+check auxiliary mount owner/backend/basename filtering and initial, partial,
+invalidated, and stale snapshot decisions.
+
+The cleanup runner compiles production cleanup and rollback methods with mocked
+mount, service, and device operations. It checks failure ordering, reporting of
+unconfirmed service exits after auxiliary-mount removal, retryable busy
+unmounts, per-volume hidden-protection refresh, and responsive probes during
+busy startup rollback. It also runs the production multi-volume unmount loop
+with scripted outcomes: every unconfirmed service exit must be reported, even
+when another volume fails or a forced-unmount prompt is declined. Finally, it
+runs `macos_cleanup_state_test.cpp` against the real serialization code to
+check that cleanup failure details survive IPC and that local display state
+leaves the legacy `/control` bytes unchanged.
+
+These tests exercise state and serialization contracts. They do not establish
+real backend timing, GUI rendering, or filesystem behavior under forced unmount.
+
+For an ordinary integration check with a FUSE-T GUI build, close other VeraCrypt
+processes and dismount their volumes first. In a logged-in macOS desktop session:
+
+```sh
+python3 Tests/test_macos_gui_lifecycle.py --binary "$VC_TEST_BUILD_SRC/Main/VeraCrypt"
+python3 Tests/test_macos_gui_inactivity.py --binary "$VC_TEST_BUILD_SRC/Main/VeraCrypt"
+python3 Tests/test_macos_gui_teardown.py --binary "$VC_TEST_BUILD_SRC/Main/VeraCrypt"
+```
+
+These use isolated preferences and disposable file containers. The lifecycle
+check verifies write/fsync/remount integrity, background startup with a mounted
+volume, refresh after a CLI dismount, and automatic GUI exit. It checks service
+exit, closed backing-file handles, and removal of the auxiliary mount and
+shutdown endpoint. The inactivity check takes about two minutes: it verifies
+that automatically unmounting one idle volume does not restart another volume's
+idle timer. The teardown check needs an unsigned local build and clang, and
+takes about three minutes. It slows a service down with `fuset_startup_faults.c`
+and verifies two automatic-unmount cases: a normal quit request that arrives
+meanwhile is honored, including unmount on quit; and when service exit cannot be
+confirmed, a warning keeps the background application from exiting silently.
+That warning stays on screen until the test ends. Failed-run artifacts are
+retained for diagnosis; use `--keep-artifacts` to retain successful runs as well.
+
+Use disposable containers for ordinary create/write/fsync/unmount/remount checks,
+released-client compatibility, and user/root ownership combinations. Keep logs
+private and verify service exit, closed backing-file handles, removed auxiliary
+mounts and endpoints, and payload integrity after remounting.

Tests/bench.bat

@@ -1,274 +1,90 @@
 @echo off
+setlocal EnableDelayedExpansion
 
-setlocal
+:: Define constants
+set "VERACRYPT_PATH=c:\Program Files\VeraCrypt\veracrypt.exe"
+set "PASSWORD=test"
+set "HIDDEN_PASSWORD=testhidden"
 
-call :freedrive mydriveletter && goto :cont
+:: Find a free drive letter
+call :freedrive mydriveletter || (
     echo ERROR: No free drive letter found.
     goto :exit
-:cont
+)
 
-echo Using drive letter %mydriveletter%: for our tests
+echo Using drive letter !mydriveletter!: for our tests
 echo.
 
-IF NOT EXIST test.sha512.hc GOTO :whirlpool
+:: Define an array of hash algorithms and their corresponding container files
+set "algorithms[0]=sha512,test.sha512.hc"
+set "algorithms[1]=whirlpool,test.whirlpool.hc"
+set "algorithms[2]=sha256,test.sha256.hc"
+set "algorithms[3]=blake2s,test.blake2s.hc"
+set "algorithms[4]=streebog,test.streebog.hc"
 
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
+:: Loop through each algorithm
+for /L %%i in (0,1,4) do (
+    for /F "tokens=1,2 delims=," %%a in ("!algorithms[%%i]!") do (
+        set "hash=%%a"
+        set "container=%%b"
         
-rem Mount SHA-512 container (Normal)
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.sha512.hc /hash sha512 /l %mydriveletter% /password test /q /silent /m ro
-
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo SHA-512 (Normal) = %hh%:%mm%:%ss%,%cc%
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Mount SHA-512 container (Hidden)
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.sha512.hc /hash sha512 /l %mydriveletter% /password testhidden /q /silent /m ro
-
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo SHA-512 (Hidden) = %hh%:%mm%:%ss%,%cc%
+        if exist "!container!" (
+            call :mount_and_measure "!hash!" "!container!" "Normal" "!PASSWORD!"
+            call :mount_and_measure "!hash!" "!container!" "Hidden" "!HIDDEN_PASSWORD!"
             echo.
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-:whirlpool
-
-IF NOT EXIST test.whirlpool.hc GOTO :sha256
-
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
+        )
+    )
 )
 
-rem Mount Whirlpool container (Normal).
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.whirlpool.hc /hash whirlpool /l %mydriveletter% /password test /q /silent /m ro
+:: Autodetect test
+call :availablevolume testvolume || goto :exit
 
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
+call :measure_time "Wrong Password (PRF Auto-detection)" ^
+    "/volume !testvolume! /l !mydriveletter! /password wrongpassword /q /silent /m ro"
 
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo Whirlpool (Normal) = %hh%:%mm%:%ss%,%cc%
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Mount Whirlpool container (Hidden).
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.whirlpool.hc /hash whirlpool /l %mydriveletter% /password testhidden /q /silent /m ro
-
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo Whirlpool (Hidden) = %hh%:%mm%:%ss%,%cc%
 echo.
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-:sha256
-
-IF NOT EXIST test.sha256.hc GOTO :ripemd160
-
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Mount SHA-256 container (Normal)
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.sha256.hc /hash sha256 /l %mydriveletter% /password test /q /silent /m ro
-
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo SHA-256 (Normal) = %hh%:%mm%:%ss%,%cc%
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Mount SHA-256 container (Hidden)
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.sha256.hc /hash sha256 /l %mydriveletter% /password testhidden /q /silent /m ro
-
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo SHA-256 (Hidden) = %hh%:%mm%:%ss%,%cc%
-echo.
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-:ripemd160
-
-IF NOT EXIST test.ripemd160.hc GOTO :autodetect
-
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Mount RIPEMD-160 container (Normal)
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.ripemd160.hc /hash ripemd160 /l %mydriveletter% /password test /q /silent /m ro
-
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo RIPEMD-160 (Normal) = %hh%:%mm%:%ss%,%cc%
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Mount RIPEMD-160 container (Hidden)
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume test.ripemd160.hc /hash ripemd160 /l %mydriveletter% /password testhidden /q /silent /m ro
-
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
-
-rem Get elapsed time:
-set /A elapsed=end-start
-
-rem Show elapsed time:
-set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
-if %hh% lss 10 set hh=0%hh%
-if %mm% lss 10 set mm=0%mm%
-if %ss% lss 10 set ss=0%ss%
-if %cc% lss 10 set cc=0%cc%
-echo RIPEMD-160 (Hidden) = %hh%:%mm%:%ss%,%cc%
-echo.
-
-"c:\Program Files\VeraCrypt\veracrypt.exe" /dismount %mydriveletter% /silent /q
-
-:autodetect
-
-call :availablevolume testvolume && goto :contautodetect
 goto :exit
-:contautodetect
 
-rem Get start time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
+:: Subroutine to mount a volume and measure the time taken
+:mount_and_measure
+setlocal 
+set "hash=%~1"
+set "container=%~2"
+set "type=%~3"
+set "volumepassword=%~4"
+
+call :measure_time "%hash% (%type%)" ^
+    "/volume !container! /hash !hash! /l !mydriveletter! /password !volumepassword! /q /silent /m ro"
+
+if not exist !mydriveletter!:\ (
+    echo ERROR: Drive letter !mydriveletter!: does not exist after mount operation.
+    goto :exit
 )
 
-rem Try to mount with a wrong password and PRF autodetection
-"c:\Program Files\VeraCrypt\veracrypt.exe" /volume %testvolume% /l %mydriveletter% /password wrongpassword /q /silent /m ro
+"!VERACRYPT_PATH!" /unmount !mydriveletter! /silent /q
+exit /b
 
-rem Get end time:
-for /F "tokens=1-4 delims=:.," %%a in ("%time%") do (
-   set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
-)
+:: Subroutine to measure the time taken for a command to execute
+:measure_time
+setlocal 
+set "oper=%~1"
+set "command=%~2"
+
+for /F "tokens=1-4 delims=:.," %%a in ("!time!") do set /A "start=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
+
+"!VERACRYPT_PATH!" %command%
+
+for /F "tokens=1-4 delims=:.," %%a in ("!time!") do set /A "end=(((%%a*60)+1%%b %% 100)*60+1%%c %% 100)*100+1%%d %% 100"
 
-rem Get elapsed time:
 set /A elapsed=end-start
-
-rem Show elapsed time:
 set /A hh=elapsed/(60*60*100), rest=elapsed%%(60*60*100), mm=rest/(60*100), rest%%=60*100, ss=rest/100, cc=rest%%100
 if %hh% lss 10 set hh=0%hh%
 if %mm% lss 10 set mm=0%mm%
 if %ss% lss 10 set ss=0%ss%
 if %cc% lss 10 set cc=0%cc%
-echo Wrong Password (PRF Auto-detection)= %hh%:%mm%:%ss%,%cc%
-echo.
 
-
-goto :exit
+echo %oper% = %hh%:%mm%:%ss%,%cc%
+exit /b
 
 rem Finds a free drive letter.
 rem
@@ -303,11 +119,12 @@ set drive=
 :freedrive0
 endlocal & set "%output_var%=%drive%" & exit /b %exitcode%
 
+:: Subroutine to find an available volume
 :availablevolume
 setlocal EnableDelayedExpansion
 set exitcode=0
 set "output_var=%~1"
-for %%i in (test.sha512.hc,test.sha256.hc,test.whirlpool.hc,test.ripemd160.hc) do (
+for %%i in (test.sha512.hc,test.sha256.hc,test.whirlpool.hc,test.blake2s.hc) do (
     if exist %%i (
         set "volume=%%i"
         goto :availablevolume0
@@ -319,3 +136,5 @@ set volume=
 endlocal & set "%output_var%=%volume%" & exit /b %exitcode%
 
 :exit
+
+pause

Tests/fuset_startup_faults.c

@@ -0,0 +1,140 @@
+/* Scoped macOS fault injection for test_fuset_dismount.py --startup-faults
+ * and test_macos_gui_teardown.py (delayed service teardown).
+ * Copyright (c) 2026 AM Crypto. Licensed under the Apache License 2.0.
+ */
+#include <errno.h>
+#include <fcntl.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+static int mode_is (const char *mode)
+{
+	const char *fault = getenv ("VC_FUSET_TEST_FAULT");
+	return fault && strcmp (fault, mode) == 0;
+}
+
+static int fixture_path (const char *path, const char *suffix)
+{
+	const char *root = getenv ("VC_FUSET_TEST_ROOT");
+	size_t size = strlen (path), suffix_size = strlen (suffix);
+	return root && strncmp (path, root, strlen (root)) == 0
+		&& path[strlen (root)] == '/' && size >= suffix_size
+		&& strcmp (path + size - suffix_size, suffix) == 0;
+}
+
+static void mark_fault (void)
+{
+	const char *path = getenv ("VC_FUSET_TEST_FAULT_MARKER");
+	if (path)
+	{
+		int fd = open (path, O_WRONLY | O_CREAT, 0600);
+		if (fd != -1)
+			close (fd);
+	}
+}
+
+static int test_connect (int fd, const struct sockaddr *address, socklen_t length)
+{
+	static const char prefix[] = "/private/tmp/.veracrypt-shutdown-";
+	if ((mode_is ("refused") || mode_is ("rollback-blocked")) && address->sa_family == AF_UNIX
+		&& strncmp (((const struct sockaddr_un *) address)->sun_path, prefix, sizeof (prefix) - 1) == 0)
+	{
+		mark_fault();
+		const char *log = getenv ("VC_FUSET_TEST_SOCKET_LOG");
+		if (log)
+		{
+			int output = open (log, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+			if (output != -1)
+			{
+				const char *path = ((const struct sockaddr_un *) address)->sun_path;
+				write (output, path, strlen (path));
+				close (output);
+			}
+		}
+		errno = ECONNREFUSED;
+		return -1;
+	}
+	return connect (fd, address, length);
+}
+
+static int test_open (const char *path, int flags, ...)
+{
+	if (mode_is ("metadata") && fixture_path (path, "/shutdown-socket"))
+	{
+		mark_fault();
+		errno = EIO;
+		return -1;
+	}
+	if (flags & O_CREAT)
+	{
+		va_list args;
+		va_start (args, flags);
+		int mode = va_arg (args, int);
+		va_end (args);
+		return open (path, flags, mode);
+	}
+	return open (path, flags);
+}
+
+static int test_stat (const char *path, struct stat *value)
+{
+	if (mode_is ("control") && fixture_path (path, "/control"))
+	{
+		mark_fault();
+		errno = ENOENT;
+		return -1;
+	}
+	return stat (path, value);
+}
+
+static unsigned fault_delay (void)
+{
+	const char *delay = getenv ("VC_FUSET_TEST_DELAY");
+	return delay ? (unsigned) atoi (delay) : 10;
+}
+
+static int test_unmount (const char *path, int flags)
+{
+	const char *gate = getenv ("VC_FUSET_TEST_UNMOUNT_GATE");
+	if (mode_is ("rollback-blocked") && gate && fixture_path (path, "") && access (gate, F_OK) == 0)
+	{
+		mark_fault();
+		errno = EBUSY;
+		return -1;
+	}
+	if (mode_is ("unmount-delay") && fixture_path (path, ""))
+	{
+		/* The service removes SMB slowly; its caller waits for the reply. */
+		mark_fault();
+		sleep (fault_delay());
+	}
+	return unmount (path, flags);
+}
+
+static int test_unlinkat (int fd, const char *path, int flags)
+{
+	if (mode_is ("cleanup-delay") && (flags & AT_REMOVEDIR) && strstr (path, ".veracrypt_aux_mnt"))
+	{
+		/* The service outlives its caller's exit wait after SMB removal. */
+		mark_fault();
+		sleep (fault_delay());
+	}
+	return unlinkat (fd, path, flags);
+}
+
+#define INTERPOSE(replacement, original) \
+	__attribute__((used)) static const struct { const void *replace; const void *replacee; } \
+	interpose_##original __attribute__((section("__DATA,__interpose"))) = { \
+		(const void *) replacement, (const void *) original }
+
+INTERPOSE (test_connect, connect);
+INTERPOSE (test_open, open);
+INTERPOSE (test_stat, stat);
+INTERPOSE (test_unmount, unmount);
+INTERPOSE (test_unlinkat, unlinkat);

Tests/macos_cleanup_state_test.cpp

@@ -0,0 +1,66 @@
+// Exercise cleanup-failure IPC and preserve the released /control wire format.
+#include "Volume/VolumeInfo.h"
+#include "Core/CoreException.h"
+#include "Platform/MemoryStream.h"
+#include "Platform/StringConverter.h"
+#include <cstring>
+#include <iostream>
+#include <unistd.h>
+
+using namespace VeraCrypt;
+
+static void Require (bool condition, const char *message)
+{
+	if (!condition) throw std::runtime_error (message);
+}
+
+int main ()
+{
+	try
+	{
+		shared_ptr <VolumeInfo> volume (new VolumeInfo);
+		volume->EncryptionAlgorithmBlockSize = volume->EncryptionAlgorithmKeySize = volume->EncryptionAlgorithmMinBlockSize = 0;
+		volume->HeaderCreationTime = volume->VolumeCreationTime = 0;
+		volume->HiddenVolumeProtectionTriggered = volume->SystemEncryption = volume->MasterKeyVulnerable = false;
+		volume->MinRequiredProgramVersion = volume->Pkcs5IterationCount = volume->ProgramVersion = 0;
+		volume->Protection = VolumeProtection::None;
+		volume->SerialInstanceNumber = 123456789;
+		volume->Size = volume->TopWriteOffset = volume->TotalDataRead = volume->TotalDataWritten = 0;
+		volume->SlotNumber = 7;
+		volume->Type = VolumeType::Normal;
+		volume->Pim = 0;
+		volume->AuxMountPoint = "/private/tmp/unit-aux";
+		volume->Path = VolumePath (wstring (L"/private/tmp/unit-container"));
+		volume->VirtualDevice = "/dev/disk42";
+
+		shared_ptr <MemoryStream> controlBefore (new MemoryStream), controlAfter (new MemoryStream);
+		volume->Serialize (controlBefore);
+		volume->Discovery = VolumeInfo::ControlUnavailable;
+		volume->Serialize (controlAfter);
+		ConstBufferPtr before = *controlBefore, after = *controlAfter;
+		Require (before.Size() == after.Size() && memcmp (before.Get(), after.Get(), before.Size()) == 0, "local status changed the legacy control format");
+		shared_ptr <Stream> control (new MemoryStream (before));
+		Require (Serializable::DeserializeNew <VolumeInfo> (control)->Discovery == VolumeInfo::DiscoveryUnknown, "local hint unexpectedly serialized");
+
+		shared_ptr <VolumeInfo> clone = volume->Clone();
+		clone->VirtualDevice = DevicePath();
+		clone->Discovery = VolumeInfo::ImageAbsent;
+		Require (!volume->VirtualDevice.IsEmpty() && volume->Discovery == VolumeInfo::ControlUnavailable, "clone shared mutable fields");
+
+		// A core helper reports an unconfirmed service exit through the regular exception serializer.
+		DismountServiceCleanupFailed failure ("unit", L"pid=1234, auxiliary mount=/private/tmp/unit-aux");
+		shared_ptr <Stream> stream (new MemoryStream);
+		failure.Serialize (stream);
+		shared_ptr <DismountServiceCleanupFailed> restored = Serializable::DeserializeNew <DismountServiceCleanupFailed> (stream);
+		Require (restored->GetSubject() == failure.GetSubject() && string (restored->what()) == "unit", "lost cleanup failure details");
+
+		// Wrappers and background logs format errors with ToExceptionString.
+		Require (StringConverter::ToExceptionString (*restored).find (failure.GetSubject()) != wstring::npos, "formatting dropped cleanup failure details");
+		ExecutedProcessFailed inventory ("unit", "/usr/bin/hdiutil", 7, "inventory-error-detail\n");
+		wstring formatted = StringConverter::ToExceptionString (inventory);
+		Require (formatted.find (L"/usr/bin/hdiutil (7): inventory-error-detail") != wstring::npos, "formatting dropped subprocess failure details");
+		std::cout << "PASS: cleanup failure IPC and formatting, subprocess failure formatting, snapshot independence, unchanged control format\n";
+	}
+	catch (std::exception &e) { std::cerr << e.what() << '\n'; return 1; }
+	return 0;
+}

Tests/macos_process_test.cpp

@@ -0,0 +1,89 @@
+// Read-only subprocess tests. Every child is this test executable; no mounts,
+// privilege changes, or installed VeraCrypt services are involved.
+#include "Platform/Platform.h"
+#include "Platform/Unix/Process.h"
+#include <chrono>
+#include <fcntl.h>
+#include <iostream>
+#include <signal.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+using namespace VeraCrypt;
+
+static void Require (bool condition, const char *message)
+{
+	if (!condition) throw std::runtime_error (message);
+}
+
+static int DescriptorCount ()
+{
+	int count = 0;
+	for (int fd = 0; fd < 256; ++fd)
+		if (fcntl (fd, F_GETFD) != -1) ++count;
+	return count;
+}
+
+int main (int argc, char **argv)
+{
+	if (argc > 1)
+	{
+		std::string mode = argv[1];
+		if (mode == "success")
+		{
+			char byte;
+			if (read (STDIN_FILENO, &byte, 1) != 0 || fcntl (80, F_GETFD) != -1) return 9;
+			write (STDOUT_FILENO, "complete", 8);
+			return 0;
+		}
+		if (mode == "failure") { write (STDERR_FILENO, "expected", 8); return 7; }
+		if (mode == "closed") { close (STDOUT_FILENO); close (STDERR_FILENO); sleep (5); return 0; }
+		if (mode == "stream")
+		{
+			for (;;) { write (STDOUT_FILENO, ".", 1); usleep (100); }
+		}
+		if (mode == "large")
+		{
+			char data[8192] = {};
+			for (;;) write (STDOUT_FILENO, data, sizeof (data));
+		}
+		sleep (5);
+		return 0;
+	}
+	try
+	{
+		uint64 startTime = Process::GetProcessStartTime (getpid());
+		Require (startTime != 0 && Process::IsProcessRunning (getpid(), startTime), "own process instance not recognized");
+		Require (!Process::IsProcessRunning (getpid(), startTime + 1), "different process instance accepted");
+		Require (Process::IsProcessRunning (getpid()), "unknown birth time discarded a live process");
+		int nullFd = open ("/dev/null", O_RDONLY);
+		Require (nullFd >= 0 && dup2 (nullFd, 80) == 80, "test descriptor setup");
+		close (nullFd);
+		int before = DescriptorCount();
+		std::cout << "process: success" << std::endl;
+		Require (Process::ExecuteBounded (argv[0], { "success" }, 1000) == "complete", "output/descriptor isolation");
+		std::cout << "process: failure" << std::endl;
+		try { Process::ExecuteBounded (argv[0], { "failure" }, 1000); throw std::runtime_error ("missing child error"); }
+		catch (ExecutedProcessFailed &e) { Require (e.GetExitCode() == 7 && e.GetErrorOutput() == "expected", "child error details"); }
+		for (const auto &mode : { "silent", "closed", "stream" })
+		{
+			std::cout << "process: " << mode << std::endl;
+			auto start = std::chrono::steady_clock::now();
+			try { Process::ExecuteBounded (argv[0], { mode }, 150); throw std::runtime_error ("missing timeout"); }
+			catch (TimeOut &) { }
+			Require (std::chrono::steady_clock::now() - start < std::chrono::seconds (2), "deadline overrun");
+			int status;
+			Require (waitpid (-1, &status, WNOHANG) == -1 && errno == ECHILD, "timed-out child not reaped");
+		}
+		std::cout << "process: output cap" << std::endl;
+		try { Process::ExecuteBounded (argv[0], { "large" }, 1000, 64); throw std::runtime_error ("missing output cap"); }
+		catch (ParameterTooLarge &) { }
+		int status;
+		Require (waitpid (-1, &status, WNOHANG) == -1 && errno == ECHILD, "output-limited child not reaped");
+		Require (DescriptorCount() == before, "descriptor leak");
+		close (80);
+		std::cout << "PASS: output, errors, descriptor isolation, silent/closed/stream deadlines, output cap, reaping\n";
+	}
+	catch (std::exception &e) { std::cerr << e.what() << '\n'; return 1; }
+	return 0;
+}

Tests/macos_volume_state_test.cpp

@@ -0,0 +1,61 @@
+// Check production discovery policy without creating mounts or native windows.
+#include "Core/Unix/MountedFilesystem.h"
+#include "Main/VolumeSnapshot.h"
+#include <iostream>
+
+using namespace VeraCrypt;
+
+static void Require (bool condition, const char *message)
+{
+	if (!condition) throw std::runtime_error (message);
+}
+
+int main ()
+{
+	try
+	{
+		VolumeSnapshotState state;
+		using Clock = VolumeSnapshotState::Clock;
+		using std::chrono::seconds;
+		const Clock::time_point start = Clock::now();
+		Require (!state.HasSample() && !state.CanConfirmEmpty (true, start), "initial empty list was authoritative");
+		state.RecordSample (start, true);
+		Require (state.CanConfirmEmpty (true, start + seconds (1)), "fresh complete empty list ignored");
+		Require (!state.CanConfirmEmpty (false, start + seconds (1)), "nonempty list allowed auto-close");
+		Require (!state.IsFresh (start + seconds (8)) && !state.CanConfirmEmpty (true, start + seconds (8)), "stale empty list allowed auto-close");
+		state.RecordSample (start + seconds (8), true);
+		state.Invalidate();
+		Require (state.HasSample() && !state.IsFresh (start + seconds (9)) && !state.IsComplete(), "invalidated display sample remained authoritative");
+		state.RecordSample (start + seconds (10), false);
+		Require (state.IsFresh (start + seconds (11)) && !state.CanConfirmEmpty (true, start + seconds (11)), "partial inventory treated as complete absence");
+		state.RecordSample (start + seconds (12), true);
+		Require (state.HasSample() && !state.CanConfirmEmpty (true, start + seconds (18)), "slow result allowed auto-close");
+
+		MountedFilesystem mount;
+		const string prefix = ".veracrypt_aux_mnt";
+		mount.MountPoint = "/private/tmp/.veracrypt_aux_mnt-unit";
+		mount.Owner = 501;
+		for (const char *type : { "smbfs", "nfs", "macfuse", "osxfuse", "fusefs" })
+		{
+			mount.Type = type;
+			Require (mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "supported auxiliary backend ignored");
+		}
+		mount.Type = "apfs";
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "unrelated filesystem entered discovery");
+		mount.Type = "smbfs";
+		mount.MountPoint = "/private/tmp/.veracrypt_aux_mnt-parent/ordinary";
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "parent path qualified as auxiliary mount");
+		mount.MountPoint = "/private/tmp/ordinary.veracrypt_aux_mnt";
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "substring qualified as auxiliary basename");
+		mount.MountPoint = "/private/tmp/.veracrypt_aux_mnt-unit";
+		mount.Owner = 502;
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 502), "another user's mount entered discovery");
+		Require (mount.IsAuxiliaryMountCandidate (prefix, 0, 502), "elevated caller lost original user's mount");
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 0, 501), "root included unrelated user's mount");
+		mount.Owner = 0;
+		Require (mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "root-owned auxiliary mount ignored");
+		std::cout << "PASS: startup/partial/stale snapshot policy, auxiliary basename/backend/owner scope\n";
+	}
+	catch (std::exception &e) { std::cerr << e.what() << '\n'; return 1; }
+	return 0;
+}

Tests/test_fuset_cleanup.py

@@ -0,0 +1,330 @@
+#!/usr/bin/env python3
+"""Test production cleanup state transitions with an in-memory FUSE service.
+
+--build-dir is the src directory of a matching macOS build. All mount, process
+and discovery operations in this harness are mocked; it never operates on a
+real mount, service, or device.
+"""
+import argparse
+from pathlib import Path
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def check_rollback(work, build_dir):
+    source = (ROOT / "src/Driver/Fuse/FuseService.cpp").read_text()
+    worker = source[source.index("\tclass FuseServiceShutdownContext"):source.index("\n\t// Hold the original parent")]
+    worker = worker.replace("\tprivate:", "\tpublic:")  # Test access to Serve; Start is never called.
+    prelude = r'''
+#include "Platform/Platform.h"
+#include "Platform/Unix/Pipe.h"
+#include <chrono>
+#include <cstring>
+#include <fcntl.h>
+#include <iostream>
+#include <poll.h>
+#include <sys/mount.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <unistd.h>
+namespace VeraCrypt {
+using FuseServiceClock=std::chrono::steady_clock;
+static const uint64 VC_FUSE_SHUTDOWN_VERSION=3, VC_FUSE_SHUTDOWN_PROBE=0, VC_FUSE_SHUTDOWN_DISMOUNT=1, VC_FUSE_SHUTDOWN_FORCE=1;
+static const char *VC_FUSE_SHUTDOWN_DIRECTORY_PREFIX="/unused-unit-path/";
+static std::string FuseServiceShutdownDirectory;
+static bool Mounted=true, Busy=true;
+static int Attempts=0, Replies=0, Reply=-1, Polls=0, Finished=0;
+static uint64 Command=VC_FUSE_SHUTDOWN_PROBE;
+struct fuse {};
+struct FuseService {
+    static uid_t GetUserId(){return getuid();} static gid_t GetGroupId(){return getgid();}
+    static uint64 GetSerialInstanceNumber(){return 42;} static unsigned GetSlotNumber(){return 7;}
+};
+struct SystemLog { static void WriteError(const std::string &){} static void WriteException(const std::exception &){} };
+static void fuse_exit(fuse *){++Finished;}
+static void fuse_service_unmount(fuse *){}
+static bool fuse_service_find_mount(const char *,fsid_t &id){id.val[0]=101;id.val[1]=202;return Mounted;}
+static bool fuse_service_same_mount(const fsid_t &a,const fsid_t &b){return a.val[0]==b.val[0] && a.val[1]==b.val[1];}
+static sockaddr_un fuse_service_shutdown_address(const std::string &){return {};}
+static void fuse_service_configure_socket(int){}
+static bool fuse_service_socket_wait(int,short,int,int){return Polls++==0;}
+static bool fuse_service_socket_transfer(int,void *data,size_t size,bool sending,int=-1,int=10000){
+    if(!sending){
+        if(size!=sizeof(uint64)*8)throw std::runtime_error("unexpected mock request");
+        uint64 frame[8]={3,Command,static_cast<uint64>(getpid()),42,7,0,101,202};
+        memcpy(data,frame,size);
+    } else if(size==sizeof(int32)){++Replies;Reply=*static_cast<int32 *>(data);}
+    return true;
+}
+static int FakeUnmount(const char *,int flags){
+    ++Attempts;
+    if(flags!=MNT_FORCE)throw std::runtime_error("provisional rollback lost force mode");
+    if(Busy){errno=EBUSY;return -1;}Mounted=false;return 0;
+}
+static int FakePoll(struct pollfd *,nfds_t,int){return 1;}
+static ssize_t FakeRecv(int,void *,size_t,int){return 0;}
+static int FakeAccept(int,struct sockaddr *,socklen_t *){return open("/dev/null",O_RDWR);}
+static int FakePeer(int,uid_t *uid,gid_t *gid){*uid=getuid();*gid=getgid();return 0;}
+#define unmount FakeUnmount
+#define poll FakePoll
+#define recv FakeRecv
+#define accept FakeAccept
+#define getpeereid FakePeer
+'''
+    tests = r'''
+static void Require(bool value,const char *message){if(!value)throw std::runtime_error(message);}
+int Run(){
+    for(uint64 command:{VC_FUSE_SHUTDOWN_PROBE,VC_FUSE_SHUTDOWN_DISMOUNT}){
+        Mounted=Busy=true;Attempts=Replies=Polls=Finished=0;Reply=-1;Command=command;
+        int startup=1000;
+        FuseServiceShutdownContext worker(NULL,"/in-memory-unit-mount",startup);
+        worker.StopPipe.reset(new Pipe);
+        worker.StartupReported=true;
+        worker.Serve();
+        Require(worker.StartupAborted && Mounted && Finished==0,"busy rollback stopped FUSE");
+        Require(Replies==1 && Reply==(command==VC_FUSE_SHUTDOWN_PROBE?0:EBUSY),"busy rollback starved endpoint");
+        Require(Attempts==(command==VC_FUSE_SHUTDOWN_PROBE?1:2),"rollback request retry storm");
+        Busy=false;worker.NextRollbackAttempt=FuseServiceClock::time_point();
+        worker.Serve();
+        Require(worker.Unmounted && !Mounted && Finished==1,"rollback did not resume after busy cleared");
+    }
+    std::cout<<"PASS: busy provisional rollback remains probeable, reports busy, and completes on retry\n";
+    return 0;
+}
+}
+int main(){try{return VeraCrypt::Run();}catch(std::exception &e){std::cerr<<e.what()<<'\n';return 1;}}
+'''
+    unit = work / "rollback.cpp"
+    unit.write_text(prelude + worker + tests)
+    command = ["clang++", "-std=c++11", "-DTC_UNIX", "-DTC_MACOSX", "-I" + str(ROOT / "src"), str(unit), str(build_dir.resolve() / "Platform/Platform.a"), "-Wl,-dead_strip", "-o", str(work / "rollback")]
+    subprocess.run(command, check=True)
+    subprocess.run([str(work / "rollback")], check=True, timeout=10)
+
+
+def check_dismount_reporting(work, build_dir):
+    source = (ROOT / "src/Main/UserInterface.cpp").read_text()
+    end = source.index("\tvoid UserInterface::DisplayVolumeProperties")
+    start = source.index("\tvoid UserInterface::DismountVolumes")
+    helper = source.find("\tstatic void ThrowUnconfirmedCleanups")
+    method = source[helper if 0 <= helper < start else start:end]
+    prelude = r"""
+#include "Volume/VolumeInfo.h"
+#include "Volume/VolumeException.h"
+#include "Core/CoreException.h"
+#include "Platform/ForEach.h"
+#include "Platform/StringConverter.h"
+#include <deque>
+#include <iostream>
+#include <map>
+namespace VeraCrypt {
+struct wxString : std::wstring {
+    wxString () {}
+    wxString (const std::wstring &text) : std::wstring (text) {}
+    bool IsEmpty () const { return empty(); }
+    std::wstring ToStdWstring () const { return *this; }
+    wxString &operator+= (wchar_t c) { push_back (c); return *this; }
+    wxString &operator+= (const std::wstring &text) { append (text); return *this; }
+};
+struct StringFormatter {
+    StringFormatter (const std::wstring &format, const std::wstring &argument) : Text (format + L" " + argument) {}
+    operator std::wstring () const { return Text; }
+    std::wstring Text;
+};
+static struct { std::wstring operator[] (const char *key) const { return StringConverter::ToWide (std::string (key)); } } LangString;
+enum Outcome { Unmounted, Busy, Unconfirmed, Failed };
+static std::map <std::wstring, std::deque <Outcome> > Plan;
+static bool ForceAnswer;
+class UserInterface {
+public:
+    struct BusyScope { BusyScope (const UserInterface *) {} };
+    void DismountVolumes (VolumeInfoList volumes, bool ignoreOpenFiles, bool interactive, bool emergencyCleanupRequested = false) const;
+    shared_ptr <VolumeInfo> DismountVolumeThread (shared_ptr <VolumeInfo> volume, bool, bool = true) const {
+        std::deque <Outcome> &steps = Plan[wstring (volume->Path)];
+        Outcome outcome = steps.empty() ? Unmounted : steps.front();
+        if (!steps.empty()) steps.pop_front();
+        if (outcome == Busy) throw MountedVolumeInUse (SRC_POS);
+        if (outcome == Unconfirmed) throw DismountServiceCleanupFailed (SRC_POS, L"service of " + wstring (volume->Path));
+        if (outcome == Failed) throw ParameterIncorrect (SRC_POS);
+        return volume;
+    }
+    bool AskYesNo (const std::wstring &, bool, bool) const { return ForceAnswer; }
+    void ShowWarning (const std::wstring &) const {}
+    void ShowInfo (const std::wstring &) const {}
+    static wxString ExceptionToMessage (const exception &e) { return StringConverter::ToExceptionString (e); }
+    struct { bool Verbose; } Preferences = { false };
+};
+"""
+    tests = r"""
+static void Require (bool condition, const char *message) { if (!condition) throw std::runtime_error (message); }
+static VolumeInfoList Volumes () {
+    VolumeInfoList volumes;
+    for (int i = 0; i < 2; ++i) {
+        shared_ptr <VolumeInfo> volume (new VolumeInfo);
+        volume->Path = VolumePath (wstring (i == 0 ? L"A" : L"B"));
+        volume->SerialInstanceNumber = i + 1;
+        volume->HiddenVolumeProtectionTriggered = false;
+        volumes.push_back (volume);
+    }
+    return volumes;
+}
+// Returns the details reported for unconfirmed cleanups, or the name of the other outcome.
+static std::wstring Run (std::deque <Outcome> a, std::deque <Outcome> b, bool interactive, bool force = false) {
+    UserInterface ui; Plan.clear(); Plan[L"A"] = a; Plan[L"B"] = b; ForceAnswer = force;
+    try { ui.DismountVolumes (Volumes(), false, interactive); return L"<no error>"; }
+    catch (DismountServiceCleanupFailed &e) { return e.GetSubject(); }
+    catch (UserAbort &) { return L"<cancelled>"; }
+    catch (MountedVolumeInUse &) { return L"<busy>"; }
+    catch (ParameterIncorrect &) { return L"<failed>"; }
+}
+static bool Has (const std::wstring &text, const wchar_t *part) { return text.find (part) != std::wstring::npos; }
+int Run () {
+    std::wstring r = Run ({Unconfirmed}, {Unmounted}, false);
+    Require (Has (r, L"service of A"), "unconfirmed cleanup lost when the other volume unmounts");
+    r = Run ({Unconfirmed}, {Busy, Busy}, false);
+    Require (Has (r, L"service of A") && Has (r, L"MountedVolumeInUse"), "unconfirmed cleanup lost when the other volume stays busy");
+    r = Run ({Unconfirmed}, {Failed, Failed}, false);
+    Require (Has (r, L"service of A") && Has (r, L"ParameterIncorrect"), "unconfirmed cleanup lost when the other volume fails");
+    r = Run ({Unconfirmed}, {Busy}, true, false);
+    Require (Has (r, L"service of A"), "unconfirmed cleanup lost when forced unmount is declined");
+    r = Run ({Unconfirmed}, {Unconfirmed}, false);
+    Require (Has (r, L"service of A") && Has (r, L"service of B"), "only one of two unconfirmed cleanups reported");
+    Require (Run ({Unmounted}, {Busy, Busy}, false) == L"<busy>", "busy volume error changed without unconfirmed cleanup");
+    Require (Run ({Unmounted}, {Busy}, true, false) == L"<cancelled>", "cancellation changed without unconfirmed cleanup");
+    Require (Run ({Unmounted}, {Busy, Unmounted}, true, true) == L"<no error>", "forced second pass failed");
+    std::cout << "PASS: multi-volume unmount reports every unconfirmed cleanup with other failures and cancellation\n";
+    return 0;
+}
+}
+int main () { try { return VeraCrypt::Run(); } catch (std::exception &e) { std::cerr << e.what() << '\n'; return 1; } }
+"""
+    unit = work / "dismount_reporting.cpp"
+    unit.write_text(prelude + method + tests)
+    command = ["clang++", "-std=c++11", "-DTC_UNIX", "-DTC_MACOSX"]
+    command += ["-I" + str(ROOT / p) for p in ("src", "src/Crypto", "src/Common", "src/Crypto/Argon2/include")]
+    command += [str(unit)] + [str(build_dir.resolve() / name) for name in ("Volume/Volume.a", "Platform/Platform.a")]
+    command += ["-Wl,-dead_strip", "-o", str(work / "dismount_reporting")]
+    subprocess.run(command, check=True)
+    subprocess.run([str(work / "dismount_reporting")], check=True, timeout=20)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--build-dir", required=True, type=Path)
+    args = parser.parse_args()
+    source = (ROOT / "src/Core/Unix/MacOSX/CoreMacOSX.cpp").read_text()
+    dismount = source[source.index("\tshared_ptr <VolumeInfo> CoreMacOSX::DismountVolume"):source.index("\tstatic void ClearDiskImageInfo")]
+    # Reuse the fully initialized public metadata fixture from the IPC test.
+    fixture = (ROOT / "Tests/macos_cleanup_state_test.cpp").read_text()
+    fixture = fixture[fixture.index("\t\tshared_ptr <VolumeInfo> volume"):fixture.index("\n\t\tshared_ptr <MemoryStream> controlBefore")]
+    prelude = r"""
+#include "Volume/VolumeInfo.h"
+#include "Core/CoreException.h"
+#include "Platform/MemoryStream.h"
+#include <iostream>
+#include <unistd.h>
+namespace VeraCrypt {
+enum RequestMode { RequestOk, RequestBusy, RequestLostAfterUnmount };
+static bool Mounted=true, FailWait=true, FailDiscovery=false, FailPreflight=false;
+static RequestMode Request=RequestOk;
+static int Preflights=0, Requests=0, Waits=0, Discoveries=0, Commands=0, CapturedReads=0;
+static void FakeSync() {}
+#define sync FakeSync
+struct FuseService {
+    struct DismountRequest { pid_t ProcessId; uint64 ProcessStartTime, SerialInstanceNumber; unsigned SlotNumber; bool IgnoreOpenFiles, LegacyService; std::string SocketDirectory, AuxMountPoint; int32 MountId[2]; };
+    static DismountRequest PrepareDismount(const DirectoryPath &aux,uint64 serial,unsigned slot,bool force) {
+        ++Preflights;
+        if(!Mounted || FailPreflight)throw MountServiceUnavailable("mock preflight");
+        DismountRequest request={}; request.ProcessId=1234; request.ProcessStartTime=987654321; request.SerialInstanceNumber=serial; request.SlotNumber=slot;
+        request.AuxMountPoint=aux; request.IgnoreOpenFiles=force; request.MountId[0]=101; request.MountId[1]=202; return request;
+    }
+    static bool IsDismountMountPresent(const DismountRequest &) { return Mounted; }
+    static pid_t RequestDismount(const DismountRequest &request) {
+        ++Requests;
+        if(Request==RequestBusy)throw MountedVolumeInUse("mock busy");
+        Mounted=false;
+        if(Request==RequestLostAfterUnmount)throw MountServiceUnavailable("mock request", L"service reply lost");
+        return request.ProcessId;
+    }
+    static void WaitForDismount(pid_t pid,const DirectoryPath &,unsigned,int,uint64 startTime) {
+        ++Waits; if(pid!=1234 || startTime!=987654321)throw std::runtime_error("wrong service identity");
+        if(FailWait)throw DismountServiceCleanupFailed("mock timeout", L"pid=1234, auxiliary mount=/in-memory");
+    }
+    static void DismountLegacy(const DismountRequest &) { throw std::runtime_error("unexpected legacy path"); }
+};
+struct Process {
+    static std::string Execute(const std::string &,const std::list<std::string> &) { ++Commands; throw std::runtime_error("unexpected disk command"); }
+};
+class CoreMacOSX {
+public:
+    shared_ptr<VolumeInfo> DismountVolume(shared_ptr<VolumeInfo>, bool=false, bool=false);
+    void UpdateMountedVolumeInfo(shared_ptr<VolumeInfo> volume) {
+        ++Discoveries; if(FailDiscovery)throw VolumeDiscoveryFailed("mock inventory");
+        volume->VirtualDevice=DevicePath(); volume->MountPoint=DirectoryPath();
+    }
+    shared_ptr<VolumeInfo> ValidateMountedVolume(shared_ptr<VolumeInfo> volume) const { ++CapturedReads; return volume; }
+};
+"""
+    tests = r"""
+static void Require(bool condition,const char *message) { if(!condition)throw std::runtime_error(message); }
+int Run() {
+    auto volume=MakeVolume(); CoreMacOSX core;
+    FailPreflight=true;
+    try { core.DismountVolume(volume); throw std::runtime_error("preflight ignored"); }
+    catch(MountServiceUnavailable &) {}
+    Require(Discoveries==0 && Requests==0, "operation after failed preflight");
+    FailPreflight=false; FailDiscovery=true;
+    try { core.DismountVolume(volume); throw std::runtime_error("unknown inventory ignored"); }
+    catch(VolumeDiscoveryFailed &) {}
+    Require(Requests==0, "unmounted with unknown image ownership");
+    FailDiscovery=false;
+    try { core.DismountVolume(volume); throw std::runtime_error("cleanup reported as complete"); }
+    catch(DismountServiceCleanupFailed &e) {
+        Require(e.GetSubject().find(L"pid=1234, auxiliary mount=/in-memory")!=std::wstring::npos, "cleanup error lost service details");
+    }
+    Require(!Mounted && Requests==1 && Waits==1, "service exit was not awaited after SMB removal");
+    Mounted=true; FailWait=false; Request=RequestLostAfterUnmount;
+    try { core.DismountVolume(volume); throw std::runtime_error("lost request after SMB removal reported as complete"); }
+    catch(DismountServiceCleanupFailed &e) {
+        Require(e.GetSubject().find(L"service reply lost")!=std::wstring::npos, "cleanup error lost request details");
+    }
+    Mounted=true; Request=RequestBusy;
+    try { core.DismountVolume(volume); throw std::runtime_error("busy auxiliary unmount reported as complete"); }
+    catch(MountedVolumeInUse &) {}
+    Require(Mounted, "busy auxiliary unmount changed the mount");
+    Request=RequestOk; volume->Protection=VolumeProtection::HiddenVolumeReadOnly;
+    core.DismountVolume(volume);
+    Require(CapturedReads==1 && !Mounted && Commands==0, "hidden-protection refresh did not use captured volume");
+    std::cout << "PASS: preflight/discovery failures stop teardown, unconfirmed exits keep details, busy SMB stays retryable, per-volume hidden-protection refresh\n";
+    return 0;
+}
+}
+int main() { try { return VeraCrypt::Run(); } catch(std::exception &e) { std::cerr<<e.what()<<'\n'; return 1; } }
+"""
+    with tempfile.TemporaryDirectory(prefix="vc-cleanup-unit-") as temporary:
+        work = Path(temporary)
+        unit = work / "cleanup.cpp"
+        unit.write_text(prelude + dismount + "\nstatic shared_ptr<VolumeInfo> MakeVolume() {\n" + fixture + "\nreturn volume;\n}\n" + tests)
+        command = ["clang++", "-std=c++11", "-DTC_UNIX", "-DTC_MACOSX", "-DVC_MACOSX_FUSET"]
+        command += ["-I" + str(ROOT / p) for p in ("src", "src/Crypto", "src/Common", "src/Crypto/Argon2/include")]
+        command += [str(unit)] + [str(args.build_dir.resolve() / name) for name in ("Core/Core.a", "Volume/Volume.a", "Platform/Platform.a")]
+        command += ["-Wl,-dead_strip", "-o", str(work / "cleanup")]
+        subprocess.run(command, check=True)
+        subprocess.run([str(work / "cleanup")], check=True, timeout=20)
+        ipc_command = ["clang++", "-std=c++11", "-DTC_UNIX", "-DTC_MACOSX"]
+        ipc_command += ["-I" + str(ROOT / p) for p in ("src", "src/Crypto", "src/Common", "src/Crypto/Argon2/include")]
+        ipc_command += [str(ROOT / "Tests/macos_cleanup_state_test.cpp")]
+        # The test references no other symbol from the object that registers core
+        # exception types for IPC, so the archive alone would not link it.
+        ipc_command += [str(args.build_dir.resolve() / name) for name in ("Core/CoreException.o", "Core/Core.a", "Volume/Volume.a", "Platform/Platform.a")]
+        ipc_command += ["-Wl,-dead_strip", "-o", str(work / "ipc")]
+        subprocess.run(ipc_command, check=True)
+        subprocess.run([str(work / "ipc")], check=True, timeout=20)
+        check_rollback(work, args.build_dir)
+        check_dismount_reporting(work, args.build_dir)
+
+
+if __name__ == "__main__":
+    main()

Tests/test_fuset_dismount.py

@@ -0,0 +1,465 @@
+#!/usr/bin/env python3
+"""Exercise macOS FUSE-T dismount using a disposable file container, without sudo.
+
+Usage:
+  python3 Tests/test_fuset_dismount.py --binary /path/to/patched/VeraCrypt
+
+Optional compatibility checks use binaries built from these protocol generations:
+  --released-binary /Applications/VeraCrypt.app/Contents/MacOS/VeraCrypt
+  --file-protocol-binary /path/to/d7bc65be/VeraCrypt
+
+An unsigned/local build can also exercise startup rollback with --startup-faults
+(requires clang and permits DYLD injection only in the disposable test clients).
+
+Artifacts are retained in a private temporary directory. Every unmount targets
+the test container explicitly. Existing volumes are never dismounted by the test.
+The released-binary leg records legacy process remnants, then terminates only
+the captured test processes after their filesystems have been unmounted.
+"""
+
+import argparse
+import errno
+import hashlib
+import json
+import os
+import plistlib
+import signal
+import socket
+import struct
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+import time
+
+
+class DismountChecks:
+    def __init__(self, args):
+        self.binary = str(Path(args.binary).resolve())
+        self.released = str(Path(args.released_binary).resolve()) if args.released_binary else None
+        self.file_protocol = str(Path(args.file_protocol_binary).resolve()) if args.file_protocol_binary else None
+        self.startup_faults = getattr(args, "startup_faults", False)
+        self.root = Path(tempfile.mkdtemp(prefix="veracrypt-dismount-test-")).resolve()
+        self.volume = self.root / "test.hc"
+        self.mountpoint = self.root / "mount"
+        self.tmpdir = self.root / "tmp"
+        self.mountpoint.mkdir()
+        self.tmpdir.mkdir()
+        self.env = dict(os.environ, TMPDIR=str(self.tmpdir) + "/")
+        self.results = []
+        self.active = None
+        self.password = "Disposable-FUSE-T-test-only"
+        self.payload = bytes(range(256)) * 32769
+        self.digest = hashlib.sha256(self.payload).hexdigest()
+        print("Artifacts:", self.root, flush=True)
+
+    def record(self, entry):
+        self.results.append(entry)
+        (self.root / "results.json").write_text(json.dumps(self.results, indent=2))
+
+    def run(self, label, args, expected=0):
+        started = time.monotonic()
+        result = subprocess.run(list(map(str, args)), env=self.env, capture_output=True,
+                                text=True, timeout=90)
+        output = result.stdout + result.stderr
+        (self.root / (label + ".log")).write_text(output)
+        self.record(dict(label=label, returncode=result.returncode,
+                         seconds=round(time.monotonic() - started, 3), output=output))
+        print(label, "exit", result.returncode, flush=True)
+        if expected is not None and result.returncode != expected:
+            raise AssertionError(f"{label}: expected {expected}, got {result.returncode}: {output}")
+        return result
+
+    def vc(self, label, *args, binary=None, expected=0):
+        return self.run(label, [binary or self.binary, "--text", "--non-interactive", *args], expected)
+
+    def mount(self, label, binary=None, options=()):
+        binary = binary or self.binary
+        # Retain the cleanup client even if mount fails after creating its service.
+        self.active = dict(binary=binary)
+        self.vc(label, "--mount", self.volume, self.mountpoint,
+                "--password=" + self.password, "--pim=1", "--keyfiles=",
+                "--protect-hidden=no", *options, binary=binary)
+        auxiliaries = [p.parent for p in self.tmpdir.glob(".veracrypt_aux_mnt*/control")]
+        if len(auxiliaries) != 1:
+            raise AssertionError(f"Expected one test service, found {auxiliaries}")
+        aux = auxiliaries[0]
+        self.active.update(aux=aux)
+        identity = aux / "shutdown"
+        if identity.exists():
+            pid, serial, slot = map(int, identity.read_text().split())
+            self.active.update(pid=pid, serial=serial, slot=slot)
+        endpoint = aux / "shutdown-socket"
+        if endpoint.exists():
+            self.active["endpoint"] = Path(endpoint.read_text().strip())
+        self.active["holders"] = self.container_holders()
+
+    def container_holders(self):
+        result = subprocess.run(["/usr/sbin/lsof", "-t", str(self.volume)],
+                                capture_output=True, text=True)
+        if result.returncode not in (0, 1):
+            raise AssertionError(result.stderr)
+        return sorted(set(map(int, result.stdout.split())))
+
+    def image(self, path):
+        result = subprocess.run(["/usr/bin/hdiutil", "info", "-plist"],
+                                capture_output=True, check=True)
+        images = [image for image in plistlib.loads(result.stdout)["images"]
+                  if Path(image["image-path"]).resolve() == path.resolve()]
+        if len(images) > 1:
+            raise AssertionError(images)
+        return images[0] if images else None
+
+    def device(self):
+        image = self.image(self.active["aux"] / "volume.dmg")
+        if not image:
+            raise AssertionError("Test image is not attached")
+        return next(entity["dev-entry"] for entity in image["system-entities"]
+                    if "dev-entry" in entity)
+
+    def cleanup_released_service(self):
+        # The fallback restores unmounting; it cannot retrofit process teardown
+        # into an already-running released service. Record this limitation and
+        # clean only the captured test processes after all filesystems are gone.
+        assert not self.mounted_paths()
+        assert not self.image(self.active["aux"] / "volume.dmg")
+        holders = self.container_holders()
+        self.record(dict(label="released-service-remnants", holders=holders))
+        assert set(holders) <= set(self.active["holders"])
+        for pid in holders:
+            process = subprocess.run(["/bin/ps", "-p", str(pid), "-o", "uid=,args="],
+                                     capture_output=True, text=True)
+            if not process.stdout.strip():
+                continue
+            uid, command = process.stdout.strip().split(None, 1)
+            assert int(uid) == os.getuid()
+            assert self.released in command or ("go-nfsv4" in command and str(self.tmpdir) in command)
+            os.kill(pid, signal.SIGTERM)
+        time.sleep(0.5)
+        for pid in self.container_holders():
+            assert pid in holders
+            # Released signal handlers can also linger. All test filesystems
+            # are unmounted; these exact processes still hold only our fixture.
+            os.kill(pid, signal.SIGKILL)
+        self.confirm_closed("released-service-fixture-cleanup")
+
+    def mounted_paths(self):
+        return [line for line in subprocess.check_output(["/sbin/mount"], text=True).splitlines()
+                if str(self.tmpdir) + "/" in line or f" on {self.mountpoint} (" in line]
+
+    def confirm_closed(self, label):
+        deadline = time.monotonic() + 5
+        while True:
+            handles = subprocess.run(["/usr/sbin/lsof", "-nP", str(self.volume)],
+                                     capture_output=True, text=True)
+            if handles.returncode not in (0, 1):
+                raise AssertionError(handles.stderr)
+            processes = subprocess.check_output(["/bin/ps", "-axo", "pid=,args="], text=True)
+            backend = [line for line in processes.splitlines()
+                       if "go-nfsv4" in line and str(self.root) in line]
+            services = [line for line in processes.splitlines() if str(self.volume) in line]
+            inventory = plistlib.loads(subprocess.check_output(["/usr/bin/hdiutil", "info", "-plist"]))
+            images = [entry for entry in inventory["images"]
+                      if str(self.root) in entry.get("image-path", "")
+                      and entry["image-path"].endswith("/volume.dmg")]
+            alive = False
+            if "pid" in self.active:
+                try:
+                    os.kill(self.active["pid"], 0)
+                    alive = True
+                except ProcessLookupError:
+                    pass
+            endpoint = self.active.get("endpoint")
+            state = dict(label=label, mounts=self.mounted_paths(), handles=handles.stdout,
+                         service_alive=alive, endpoint_exists=bool(endpoint and endpoint.exists()),
+                         backend=backend, services=services, images=images)
+            if not any(state[key] for key in ("mounts", "handles", "service_alive", "endpoint_exists", "backend", "services", "images")):
+                self.record(state)
+                self.active = None
+                return
+            if time.monotonic() >= deadline:
+                self.record(state)
+                raise AssertionError(state)
+            time.sleep(0.1)
+
+    def unmount(self, label, binary=None, force=False):
+        options = ["--force"] if force else []
+        self.vc(label, *options, "--unmount", self.volume, binary=binary)
+        self.confirm_closed(label + "-closed")
+
+    def assert_volume_unchanged(self, before):
+        if self.mounted_paths() != before:
+            raise AssertionError("A failed preflight changed the mount table")
+        os.kill(self.active["pid"], 0)
+        if hashlib.sha256((self.mountpoint / "payload.bin").read_bytes()).hexdigest() != self.digest:
+            raise AssertionError("A failed preflight changed payload data")
+
+    def expect_incompatible(self, label, force=False):
+        before = self.mounted_paths()
+        options = ["--force"] if force else []
+        result = self.vc(label, *options, "--unmount", self.volume, expected=1)
+        if "version of VeraCrypt that mounted it" not in result.stdout + result.stderr:
+            raise AssertionError("Missing actionable compatibility message")
+        self.assert_volume_unchanged(before)
+
+    def check_device_reuse(self):
+        decoy = self.root / "decoy.dmg"
+        mountpoint = self.root / "decoy-mount"
+        mountpoint.mkdir()
+        self.run("decoy-create", ["/usr/bin/hdiutil", "create", "-size", "32m", "-fs", "HFS+",
+                                  "-layout", "NONE", "-volname", "VC-disposable-decoy", decoy])
+        for busy in (True, False):
+            label = "busy-device-reuse" if busy else "external-eject-device-reuse"
+            self.mount(label + "-mount")
+            old_device = self.device()
+            if busy:
+                with (self.active["aux"] / "control").open("rb") as held:
+                    held.read(1)
+                    result = self.vc(label + "-refused", "--unmount", self.volume, expected=1)
+                    # CLI errors are localized. Check the refusal and retained
+                    # service instead of its internal C++ exception name.
+                    os.kill(self.active["pid"], 0)
+                    if not any(f" on {self.active['aux']} (" in line for line in self.mounted_paths()):
+                        raise AssertionError("Busy unmount removed the auxiliary mount")
+            else:
+                self.run(label + "-detach", ["/usr/bin/hdiutil", "detach", old_device])
+            try:
+                self.run(label + "-decoy-attach", ["/usr/bin/hdiutil", "attach", decoy,
+                                                   "-mountpoint", mountpoint, "-nobrowse"])
+                attached = self.image(decoy)
+                devices = [entity.get("dev-entry") for entity in attached["system-entities"]]
+                if old_device not in devices:
+                    raise AssertionError(f"Device reuse was not exercised: {old_device}, {devices}")
+                listing = self.vc(label + "-list", "--list", "--verbose", self.volume).stdout
+                if old_device in listing or str(mountpoint) in listing:
+                    raise AssertionError("Listing retained a device now owned by another image")
+                marker = mountpoint / "keep-mounted.txt"
+                marker.write_text("This is a separate disposable disk image.\n")
+                with marker.open("rb") as held:
+                    self.unmount(label + "-retry", force=not busy)
+                    if not self.image(decoy) or not held.read():
+                        raise AssertionError("Retry detached the unrelated test image")
+            finally:
+                image = self.image(decoy)
+                if image:
+                    device = next(entity["dev-entry"] for entity in image["system-entities"]
+                                  if "dev-entry" in entity)
+                    self.run(label + "-decoy-cleanup", ["/usr/bin/hdiutil", "detach", device])
+
+    def check_socket_errors(self):
+        self.mount("socket-validation-mount")
+        state = self.active
+        mount_id = struct.unpack("=II", struct.pack("=Q", os.statvfs(state["aux"]).f_fsid))
+        frame = [3, 0, state["pid"], state["serial"], state["slot"], 0, *mount_id]
+        before = self.mounted_paths()
+        for name, index, value, expected in (("version", 0, 999, errno.EPROTONOSUPPORT),
+                                             ("identity", 3, state["serial"] + 1, errno.EINVAL),
+                                             ("mount-instance", 6, mount_id[0] ^ 1, errno.ESTALE)):
+            request = frame.copy()
+            request[index] = value
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+                client.settimeout(5)
+                client.connect(str(state["endpoint"] / "socket"))
+                client.sendall(struct.pack("=8Q", *request))
+                result = struct.unpack("=i", client.recv(4))[0]
+                if result != expected:
+                    raise AssertionError((name, result, expected))
+            self.assert_volume_unchanged(before)
+            self.record(dict(label="socket-rejected-" + name, error=result))
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+            client.settimeout(3)
+            client.connect(str(state["endpoint"] / "socket"))
+            client.sendall(b"\x03")
+            # A partial frame must expire without needing another request.
+            if client.recv(1):
+                raise AssertionError("Partial request did not expire")
+        self.unmount("socket-validation-unmount")
+
+    def check_path_aliases(self):
+        alias = self.root / "tmp-alias"
+        alias.symlink_to(self.tmpdir, target_is_directory=True)
+        original_tmpdir = self.env["TMPDIR"]
+        try:
+            self.env["TMPDIR"] = str(alias) + "/"
+            for force in (False, True):
+                label = "alias-force" if force else "alias-normal"
+                self.mount(label + "-mount")
+                image = self.image(self.active["aux"] / "volume.dmg")
+                if image["image-path"] != str(self.active["aux"] / "volume.dmg"):
+                    raise AssertionError("New image was attached through a noncanonical path")
+                device = self.device()
+                listing = self.vc(label + "-list", "--list", "--verbose", self.volume).stdout
+                if device not in listing or str(self.mountpoint) not in listing:
+                    raise AssertionError("Aliased TMPDIR lost the device or mount directory")
+                if force:
+                    with (self.mountpoint / "alias-write.bin").open("wb", buffering=0) as output:
+                        output.write(self.payload)
+                        self.unmount(label + "-unmount", force=True)
+                else:
+                    self.unmount(label + "-unmount")
+            self.mount("alias-integrity-remount", options=("--mount-options=ro",))
+            if hashlib.sha256((self.mountpoint / "alias-write.bin").read_bytes()).hexdigest() != self.digest:
+                raise AssertionError("Aliased forced dismount lost completed writes")
+            self.unmount("alias-integrity-cleanup")
+
+            if self.released:
+                # A released service retains the alias in hdiutil's inventory.
+                # New clients must resolve it even though new mounts are canonical.
+                self.mount("released-alias-mount", binary=self.released)
+                listing = self.vc("released-alias-list", "--list", "--verbose", self.volume).stdout
+                if self.device() not in listing or str(self.mountpoint) not in listing:
+                    raise AssertionError("Released service's image alias was not resolved")
+                self.vc("released-alias-unmount", "--unmount", self.volume)
+                self.cleanup_released_service()
+        finally:
+            self.env["TMPDIR"] = original_tmpdir
+
+    def check_startup_rollback(self):
+        library = self.root / "startup-faults.dylib"
+        source = Path(__file__).with_name("fuset_startup_faults.c")
+        self.run("build-startup-faults", ["/usr/bin/xcrun", "clang", "-dynamiclib", "-Wall", "-Wextra",
+                                         "-O2", source, "-o", library])
+        for fault in ("refused", "metadata", "control", "rollback-blocked"):
+            label = "startup-" + fault
+            socket_log = self.root / (label + "-socket.txt")
+            fault_marker = self.root / (label + "-fault-reached")
+            gate = self.root / (label + "-gate")
+            if fault == "rollback-blocked":
+                gate.touch()
+            self.active = dict(binary=self.binary)
+            fault_env = dict(DYLD_INSERT_LIBRARIES=str(library), VC_FUSET_TEST_FAULT=fault,
+                             VC_FUSET_TEST_ROOT=str(self.root), VC_FUSET_TEST_SOCKET_LOG=str(socket_log),
+                             VC_FUSET_TEST_UNMOUNT_GATE=str(gate), VC_FUSET_TEST_FAULT_MARKER=str(fault_marker))
+            old_env = self.env
+            self.env = dict(old_env, **fault_env)
+            try:
+                result = self.vc(label + "-mount", "--mount", self.volume, self.mountpoint,
+                                 "--password=" + self.password, "--pim=1", "--keyfiles=",
+                                 "--protect-hidden=no", expected=1)
+                if not fault_marker.exists():
+                    raise AssertionError("Fault injection was not reached; use an unsigned/local build")
+                if socket_log.exists():
+                    self.active["endpoint"] = Path(socket_log.read_text()).parent
+                if fault == "rollback-blocked":
+                    if "volume may still be accessible" not in result.stdout + result.stderr:
+                        raise AssertionError("Failed rollback did not report the remaining partial mount")
+                    if not self.container_holders():
+                        raise AssertionError("Rollback failure was not exercised")
+            finally:
+                self.env = old_env
+                gate.unlink(missing_ok=True)
+            # Removing the gate also checks that a failed rollback is retried
+            # by the service after the caller has already reported the failure.
+            self.confirm_closed(label + "-rolled-back")
+            self.mount(label + "-retry-mount")
+            self.unmount(label + "-retry-unmount")
+
+    def checks(self):
+        self.vc("create", "--create", self.volume, "--size=67108864", "--volume-type=normal",
+                "--encryption=AES", "--hash=sha512", "--filesystem=FAT",
+                "--password=" + self.password, "--pim=1", "--keyfiles=",
+                "--random-source=/dev/urandom")
+        self.mount("normal-mount")
+        with (self.mountpoint / "payload.bin").open("wb") as output:
+            output.write(self.payload)
+            output.flush()
+            os.fsync(output.fileno())
+        self.unmount("normal-unmount")
+
+        self.mount("readonly-mount", options=("--mount-options=ro",))
+        if hashlib.sha256((self.mountpoint / "payload.bin").read_bytes()).hexdigest() != self.digest:
+            raise AssertionError("Payload failed verification after remount")
+        self.unmount("readonly-unmount")
+
+        self.mount("no-filesystem-mount", options=("--filesystem=none",))
+        self.unmount("no-filesystem-unmount")
+
+        self.mount("external-eject-mount")
+        listing = self.vc("external-eject-properties", "--list", "--verbose", self.volume).stdout
+        device = re.search(r"^Virtual Device: (.+)$", listing, re.M).group(1)
+        self.run("external-eject", ["/usr/bin/hdiutil", "detach", device])
+        self.unmount("external-eject-cleanup")
+
+        self.mount("busy-mount")
+        with (self.active["aux"] / "control").open("rb") as held:
+            held.read(1)
+            self.vc("busy-unmount-refused", "--unmount", self.volume, expected=1)
+            os.kill(self.active["pid"], 0)
+        self.unmount("busy-release-retry")
+
+        self.mount("force-mount")
+        with (self.active["aux"] / "control").open("rb") as held:
+            held.read(1)
+            self.unmount("force-unmount", force=True)
+
+        for iteration in range(3):
+            label = f"force-integrity-{iteration}"
+            payload = bytes([iteration + 1]) * (16 * 1024 * 1024)
+            self.mount(label + "-mount")
+            with (self.mountpoint / "unsynced.bin").open("wb", buffering=0) as output:
+                output.write(payload)
+                self.unmount(label + "-unmount", force=True)
+            self.mount(label + "-remount", options=("--mount-options=ro",))
+            if (self.mountpoint / "unsynced.bin").read_bytes() != payload:
+                raise AssertionError("Forced dismount did not preserve completed writes")
+            self.unmount(label + "-verified")
+
+        self.check_device_reuse()
+        self.check_socket_errors()
+        self.check_path_aliases()
+        if self.startup_faults:
+            self.check_startup_rollback()
+
+        if self.released:
+            for force in (False, True):
+                label = "released-service-force" if force else "released-service-normal"
+                self.mount(label + "-mount", binary=self.released)
+                options = ["--force"] if force else []
+                self.vc(label + "-unmount", *options, "--unmount", self.volume)
+                self.cleanup_released_service()
+            self.mount("released-client-mount")
+            self.unmount("released-client-unmount", binary=self.released)
+
+        if self.file_protocol:
+            self.mount("file-client-mount")
+            self.unmount("file-client-unmount", binary=self.file_protocol)
+            self.mount("file-service-mount", binary=self.file_protocol)
+            self.expect_incompatible("file-service-preflight")
+            self.unmount("file-service-original-client-cleanup", binary=self.file_protocol)
+
+        self.record(dict(result="passed", payload_sha256=self.digest))
+
+    def cleanup(self):
+        if self.active is not None:
+            if not self.mounted_paths() and not self.container_holders():
+                self.confirm_closed("failure-already-cleaned")
+                return
+            # Older services cannot understand the new force request; use their
+            # original client for cleanup. Test file handles have been closed.
+            original = self.active["binary"]
+            if original == self.released:
+                self.vc("failure-cleanup", "--unmount", self.volume, binary=original, expected=None)
+                self.cleanup_released_service()
+            else:
+                self.unmount("failure-cleanup", binary=original, force=original == self.binary)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--binary", required=True)
+    parser.add_argument("--released-binary")
+    parser.add_argument("--file-protocol-binary")
+    parser.add_argument("--startup-faults", action="store_true")
+    args = parser.parse_args()
+    if sys.platform != "darwin" or os.geteuid() == 0:
+        parser.error("Run on macOS as an ordinary user with FUSE-T installed")
+    checks = DismountChecks(args)
+    try:
+        checks.checks()
+    finally:
+        checks.cleanup()
+
+
+if __name__ == "__main__":
+    main()

Tests/test_macos_discovery.py

@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""Unit checks for macOS discovery; no mounted volumes or sudo needed.
+
+Compiles the production plist helpers and batch-refresh methods with a fake
+inventory provider, so tests can supply incomplete inventories safely. Optional
+--platform-archive runs the real bounded process runner from a matching build.
+"""
+import argparse
+from pathlib import Path
+import plistlib
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--platform-archive", type=Path)
+    args = parser.parse_args()
+    with tempfile.TemporaryDirectory(prefix="vc-discovery-unit-") as temporary:
+        work = Path(temporary)
+        image = work / ".veracrypt_aux_mnt-test" / "volume.dmg"
+        image.parent.mkdir()
+        image.touch()
+        alias = work / "path-alias"
+        alias.symlink_to(work, target_is_directory=True)
+        exact = dict(**{"image-path": str(image.resolve()), "system-entities": [{"dev-entry": "/dev/disk42", "mount-point": "/Volumes/unit"}]})
+        alias_image = dict(exact, **{"image-path": str(alias / image.relative_to(work))})
+        unknown_alias = dict(exact, **{"image-path": str(work / "missing" / image.parent.name / image.name)})
+        cases = {
+            "exact": {"images": [exact]},
+            "alias": {"images": [alias_image]},
+            "absent": {"images": []},
+            "unrelated": {"images": [{"image-path": "/offline/unrelated.dmg"}]},
+            "exact_after_unknown": {"images": [unknown_alias, {}, exact]},
+            "unknown_alias": {"images": [unknown_alias]},
+            "unknown_record": {"images": [{}]},
+            "bad_entities": {"images": [{"image-path": str(image.resolve())}]},
+        }
+        for name, contents in cases.items():
+            (work / name).write_bytes(plistlib.dumps(contents))
+        (work / "broken").write_text("invalid plist")
+
+        source = (ROOT / "src/Core/Unix/MacOSX/CoreMacOSX.cpp").read_text()
+        helpers = source[source.index("\tclass CFHolder"):source.index("\tstatic bool AuxiliaryControlFileHasVirtualDevice")]
+        refresh = source[source.index("\tstatic void ClearDiskImageInfo"):source.index("\t// Strict /dev/diskN")]
+        prelude = r'''
+#include "Platform/Finally.h"
+#include <CoreFoundation/CoreFoundation.h>
+#include <fstream>
+#include <iostream>
+#include <stdexcept>
+#include <algorithm>
+#include <cstdlib>
+#define throw_sys_sub_if(condition, subject) do { if (condition) throw std::runtime_error(subject); } while(false)
+using DevicePath = std::string;
+struct DirectoryPath : std::string {
+    using std::string::string;
+    DirectoryPath() {}
+    DirectoryPath(const std::string &s) : std::string(s) {}
+    bool IsEmpty() const { return empty(); }
+};
+struct ParameterIncorrect : std::runtime_error { ParameterIncorrect(const std::string &s) : std::runtime_error(s) {} };
+struct VolumeDiscoveryFailed : std::runtime_error { VolumeDiscoveryFailed(const std::string &s, const std::wstring &) : std::runtime_error(s) {} };
+struct StringConverter {
+    static std::string Trim(std::string s) { size_t b=s.find_first_not_of(" \t\r\n"); if(b==std::string::npos)return ""; return s.substr(b,s.find_last_not_of(" \t\r\n")-b+1); }
+    static std::wstring ToExceptionString(const std::exception &) { return L"failure"; }
+};
+static std::string Inventory;
+static int Queries;
+struct Process { static std::string ExecuteBounded(const std::string &, const std::list<std::string> &, int deadline) { if(deadline!=2000)throw std::runtime_error("discovery deadline"); ++Queries; return Inventory; } };
+struct FuseService { static std::string GetVolumeImagePath() { return "/volume.dmg"; } };
+struct SystemLog { static void WriteException(const std::exception &) {} };
+#define foreach(declaration, collection) for (declaration : collection)
+struct VolumeInfo {
+    enum DiscoveryState { DiscoveryUnknown, ImageAttached, ImageAbsent, ControlUnavailable };
+    DiscoveryState Discovery = DiscoveryUnknown;
+    DirectoryPath AuxMountPoint, MountPoint;
+    DevicePath VirtualDevice;
+};
+using VolumeInfoList = std::list<std::shared_ptr<VolumeInfo>>;
+struct MountedFilesystem { DirectoryPath MountPoint; };
+using MountedFilesystemList = std::list<std::shared_ptr<MountedFilesystem>>;
+class CoreMacOSX {
+public:
+    void UpdateMountedVolumesInfo(VolumeInfoList &) const;
+    void UpdateMountedVolumeInfo(std::shared_ptr<VolumeInfo>) const;
+    void UpdateMountedVolumeInfo(std::shared_ptr<VolumeInfo>, const std::string &) const;
+    MountedFilesystemList GetMountedFilesystems(const DevicePath &) const { return {}; }
+};
+'''
+        # Production path types expose IsEmpty(); keep that interface in the mock.
+        prelude = prelude.replace("using DevicePath = std::string;", "")
+        prelude = prelude.replace("struct ParameterIncorrect", "using DevicePath = DirectoryPath;\nstruct ParameterIncorrect")
+        tests = r'''
+static void Require(bool condition, const char *message) { if(!condition)throw std::runtime_error(message); }
+static std::string Read(const std::string &path) { std::ifstream f(path); return std::string(std::istreambuf_iterator<char>(f), {}); }
+int main(int argc, char **argv) {
+    try {
+        std::string root=argv[1], image=argv[2];
+        for (const auto &name : {"exact", "alias", "exact_after_unknown"}) {
+            DevicePath device; DirectoryPath mount;
+            Require(FindDiskImageInfoByImagePath(Read(root+"/"+name),image,device,mount), "positive match lost");
+            Require(device=="/dev/disk42" && mount=="/Volumes/unit", "wrong mapping");
+        }
+        for (const auto &name : {"absent", "unrelated"}) {
+            DevicePath device; DirectoryPath mount;
+            Require(!FindDiskImageInfoByImagePath(Read(root+"/"+name),image,device,mount), "false match");
+        }
+        for (const auto &name : {"unknown_alias", "unknown_record", "bad_entities", "broken"}) {
+            bool failed=false; DevicePath device; DirectoryPath mount;
+            try { FindDiskImageInfoByImagePath(Read(root+"/"+name),image,device,mount); }
+            catch(std::exception &) { failed=true; }
+            Require(failed, "unknown inventory treated as absent");
+        }
+        VolumeInfoList volumes;
+        for(int i=0;i<3;++i) { auto volume=std::make_shared<VolumeInfo>(); volume->AuxMountPoint=image.substr(0,image.rfind('/')); volumes.push_back(volume); }
+        CoreMacOSX core;
+        Queries=0; Inventory=Read(root+"/exact"); core.UpdateMountedVolumesInfo(volumes);
+        Require(Queries==1, "more than one inventory per enumeration");
+        for(auto volume:volumes)Require(volume->Discovery==VolumeInfo::ImageAttached, "attached status");
+        Inventory=Read(root+"/broken"); core.UpdateMountedVolumesInfo(volumes);
+        for(auto volume:volumes)Require(volume->Discovery==VolumeInfo::DiscoveryUnknown && volume->VirtualDevice.empty() && volume->MountPoint.empty(), "stale device survived failure");
+        Inventory=Read(root+"/absent"); core.UpdateMountedVolumesInfo(volumes);
+        for(auto volume:volumes)Require(volume->Discovery==VolumeInfo::ImageAbsent, "absent status");
+        Inventory=Read(root+"/exact"); core.UpdateMountedVolumeInfo(volumes.front());
+        Require(Queries==4 && volumes.front()->VirtualDevice=="/dev/disk42", "destructive lookup reused display snapshot");
+        std::cout << "PASS: exact/alias matches, unrelated and incomplete inventories, batch query count, unknown/absent states, fresh lookup\n";
+    } catch(std::exception &e) { std::cerr << e.what() << '\n'; return 1; }
+}
+'''
+        unit = work / "discovery.cpp"
+        unit.write_text(prelude + helpers + refresh + tests)
+        command = ["clang++", "-std=c++11", "-I" + str(ROOT / "src"), str(unit), "-framework", "CoreFoundation", "-o", str(work / "discovery")]
+        subprocess.run(command, check=True)
+        subprocess.run([str(work / "discovery"), str(work), str(image)], check=True, timeout=20)
+        if args.platform_archive:
+            command = ["clang++", "-std=c++11", "-DTC_UNIX", "-DTC_MACOSX", "-I" + str(ROOT / "src"), str(ROOT / "Tests/macos_process_test.cpp"), str(args.platform_archive.resolve()), "-Wl,-dead_strip", "-o", str(work / "process")]
+            subprocess.run(command, check=True)
+            subprocess.run([str(work / "process")], check=True, timeout=20)
+            command = ["clang++", "-std=c++11", "-DTC_UNIX", "-DTC_MACOSX", "-I" + str(ROOT / "src"), str(ROOT / "Tests/macos_volume_state_test.cpp"), str(args.platform_archive.resolve()), "-Wl,-dead_strip", "-o", str(work / "state")]
+            subprocess.run(command, check=True)
+            subprocess.run([str(work / "state")], check=True, timeout=20)
+
+
+if __name__ == "__main__":
+    main()

Tests/test_macos_gui_inactivity.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Inactivity auto-dismount in the background GUI; no sudo required.
+
+Requires a logged-in macOS desktop and no other VeraCrypt processes or mounts.
+Two disposable containers are mounted without a filesystem, so nothing else
+reads or writes them. The GUI's automatic unmount of the first volume must not
+restart the idle timer of the second. Takes about two minutes.
+"""
+import argparse
+import os
+from pathlib import Path
+import plistlib
+import shutil
+import subprocess
+import tempfile
+import time
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--binary", required=True, type=Path)
+    parser.add_argument("--keep-artifacts", action="store_true")
+    args = parser.parse_args()
+    binary = args.binary.resolve(strict=True)
+    mounts = lambda: subprocess.check_output(["/sbin/mount"], text=True)
+    if ".veracrypt_aux_mnt" in mounts():
+        raise RuntimeError("Dismount existing VeraCrypt volumes before this isolated GUI test")
+    processes = subprocess.check_output(["/bin/ps", "-axo", "comm="], text=True)
+    if any(Path(line.strip()).name.lower() == "veracrypt" for line in processes.splitlines()):
+        raise RuntimeError("Close other VeraCrypt processes before this isolated GUI test")
+
+    root = Path(tempfile.mkdtemp(prefix="vc-gui-inactivity-")).resolve()
+    print("Artifacts:", root, flush=True)
+    temporary = root / "tmp"
+    config = root / "config" / "VeraCrypt"
+    temporary.mkdir(mode=0o700)
+    config.mkdir(parents=True)
+    prefs = dict(BackgroundTaskEnabled=1, CloseBackgroundTaskOnNoVolumes=1, DismountOnInactivity=1,
+                 MaxVolumeIdleTime=1, ForceAutoDismount=1, DismountOnLogOff=0, WipeCacheOnAutoDismount=0,
+                 MountFavoritesOnLogon=0, MountDevicesOnLogon=0, OpenExplorerWindowAfterMount=0, SaveHistory=0)
+    (config / "Configuration.xml").write_text("<VeraCrypt><configuration>" + "".join(
+        f'<config key="{key}">{value}</config>' for key, value in prefs.items()
+    ) + "</configuration></VeraCrypt>")
+    env = dict(os.environ, TMPDIR=str(temporary) + "/", XDG_CONFIG_HOME=str(root / "config"))
+    contents = root / "VeraCryptTest.app" / "Contents"
+    executable = contents / "MacOS" / "VeraCrypt"
+    executable.parent.mkdir(parents=True)
+    shutil.copy2(binary, executable)
+    (contents / "Info.plist").write_bytes(plistlib.dumps(dict(
+        CFBundleExecutable="VeraCrypt", CFBundleName="VeraCrypt Inactivity Test",
+        CFBundleIdentifier=f"org.idrix.veracrypt.inactivity-test.{os.getpid()}",
+        CFBundlePackageType="APPL", NSHighResolutionCapable=True)))
+    password = "Disposable-inactivity-only"
+    volumes = {name: root / f"{name}.hc" for name in ("first", "second")}
+    gui = None
+    succeeded = False
+
+    def vc(label, *options):
+        result = subprocess.run([str(binary), "--text", "--non-interactive", *map(str, options)],
+                                env=env, capture_output=True, text=True, timeout=90)
+        (root / (label + ".log")).write_text(result.stdout + result.stderr)
+        if result.returncode:
+            raise RuntimeError(f"{label} failed; see {root / (label + '.log')}")
+
+    def aux_mounts():
+        return {line for line in mounts().splitlines() if str(temporary) in line and ".veracrypt_aux_mnt" in line}
+
+    def mount(name):
+        before = aux_mounts()
+        vc("mount-" + name, "--mount", volumes[name], "--filesystem=none", "--password=" + password,
+           "--pim=1", "--keyfiles=", "--protect-hidden=no")
+        added = aux_mounts() - before
+        assert len(added) == 1, "Expected one new auxiliary mount"
+        return added.pop()
+
+    try:
+        for name, volume in volumes.items():
+            vc("create-" + name, "--create", volume, "--size=33554432", "--volume-type=normal",
+               "--encryption=AES", "--hash=sha512", "--filesystem=FAT", "--password=" + password,
+               "--pim=1", "--keyfiles=", "--random-source=/dev/urandom")
+        first = mount("first")
+        with (root / "gui.log").open("w") as log:
+            gui = subprocess.Popen([str(executable), "--background-task"], env=env,
+                                   stdout=log, stderr=log, start_new_session=True)
+        start = time.monotonic()
+        time.sleep(30)
+        second = mount("second")
+        second_mounted = time.monotonic()
+        gone = {}
+        while time.monotonic() - start < 150 and len(gone) < 2:
+            current = aux_mounts()
+            for name, line in (("first", first), ("second", second)):
+                if name not in gone and line not in current:
+                    gone[name] = time.monotonic()
+            time.sleep(0.5)
+        assert "first" in gone, "First idle volume was not unmounted automatically"
+        assert "second" in gone, "Second idle volume was not unmounted automatically"
+        idle = gone["second"] - second_mounted
+        print(f"first unmounted after {gone['first'] - start:.0f} s; second after {idle:.0f} s idle", flush=True)
+        # One minute limit plus discovery and timer granularity. A restarted
+        # timer would add the time between the two mounts (about 30 s).
+        assert idle < 80, "Automatic unmount of one volume restarted another volume's idle timer"
+        assert gui.wait(timeout=20) == 0, "Background app did not exit cleanly"
+        succeeded = True
+        print("PASS: independent idle timers, automatic unmounts, automatic exit", flush=True)
+    finally:
+        if gui and gui.poll() is None:
+            gui.terminate()
+            gui.wait(timeout=10)
+        for name, volume in volumes.items():
+            if aux_mounts():
+                subprocess.run([str(binary), "--text", "--non-interactive", "--unmount", str(volume)],
+                               env=env, capture_output=True, text=True, timeout=90)
+        if succeeded and not args.keep_artifacts:
+            assert not aux_mounts(), "Disposable mount remains"
+            shutil.rmtree(root)
+
+
+if __name__ == "__main__":
+    main()

Tests/test_macos_gui_lifecycle.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""Ordinary FUSE-T container and background GUI lifecycle; no sudo required.
+
+Requires a logged-in macOS desktop and no other VeraCrypt processes or mounts.
+Uses only a disposable container, isolated preferences, and a local app bundle.
+No fault injection, device reassignment, or forced unmount is performed.
+"""
+import argparse
+import hashlib
+import os
+from pathlib import Path
+import plistlib
+import shutil
+import subprocess
+import tempfile
+import time
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--binary", required=True, type=Path)
+    parser.add_argument("--keep-artifacts", action="store_true")
+    args = parser.parse_args()
+    binary = args.binary.resolve(strict=True)
+    mounts = lambda: subprocess.check_output(["/sbin/mount"], text=True)
+    if ".veracrypt_aux_mnt" in mounts():
+        raise RuntimeError("Dismount existing VeraCrypt volumes before this isolated GUI test")
+    processes = subprocess.check_output(["/bin/ps", "-axo", "comm="], text=True)
+    if any(Path(line.strip()).name.lower() == "veracrypt" for line in processes.splitlines()):
+        raise RuntimeError("Close other VeraCrypt processes before this isolated GUI test")
+
+    root = Path(tempfile.mkdtemp(prefix="vc-gui-lifecycle-")).resolve()
+    print("Artifacts:", root, flush=True)
+    temporary = root / "tmp"
+    mountpoint = root / "mount"
+    config = root / "config" / "VeraCrypt"
+    temporary.mkdir(mode=0o700)
+    mountpoint.mkdir()
+    config.mkdir(parents=True)
+    prefs = dict(BackgroundTaskEnabled=1, CloseBackgroundTaskOnNoVolumes=1,
+                 DismountOnInactivity=0, DismountOnLogOff=1, DismountOnPowerSaving=0,
+                 MountFavoritesOnLogon=0, MountDevicesOnLogon=0,
+                 OpenExplorerWindowAfterMount=0, SaveHistory=0)
+    (config / "Configuration.xml").write_text("<VeraCrypt><configuration>" + "".join(
+        f'<config key="{key}">{value}</config>' for key, value in prefs.items()
+    ) + "</configuration></VeraCrypt>")
+    env = dict(os.environ, TMPDIR=str(temporary) + "/", XDG_CONFIG_HOME=str(root / "config"))
+    contents = root / "VeraCryptTest.app" / "Contents"
+    executable = contents / "MacOS" / "VeraCrypt"
+    executable.parent.mkdir(parents=True)
+    shutil.copy2(binary, executable)
+    (contents / "Info.plist").write_bytes(plistlib.dumps(dict(
+        CFBundleExecutable="VeraCrypt", CFBundleName="VeraCrypt Lifecycle Test",
+        CFBundleIdentifier=f"org.idrix.veracrypt.lifecycle-test.{os.getpid()}",
+        CFBundlePackageType="APPL", NSHighResolutionCapable=True)))
+    volume = root / "ordinary.hc"
+    password = "Disposable-normal-lifecycle-only"
+    gui = None
+    active = None
+    succeeded = False
+
+    def vc(label, *options):
+        result = subprocess.run([str(binary), "--text", "--non-interactive", *map(str, options)],
+                                env=env, capture_output=True, text=True, timeout=90)
+        (root / (label + ".log")).write_text(result.stdout + result.stderr)
+        if result.returncode:
+            raise RuntimeError(f"{label} failed; see {root / (label + '.log')}")
+
+    def mount(read_only=False):
+        nonlocal active
+        vc("mount", "--mount", volume, mountpoint, "--password=" + password,
+           "--pim=1", "--keyfiles=", "--protect-hidden=no",
+           *(["--mount-options=ro"] if read_only else []))
+        identities = list(temporary.glob(".veracrypt_aux_mnt*/shutdown"))
+        assert len(identities) == 1, "Expected one disposable FUSE-T service"
+        aux = identities[0].parent
+        active = (int(identities[0].read_text().split()[0]), aux,
+                  Path((aux / "shutdown-socket").read_text().strip()))
+
+    def confirm_closed():
+        if active:
+            pid, aux, endpoint = active
+            try:
+                os.kill(pid, 0)
+            except ProcessLookupError:
+                pass
+            else:
+                raise AssertionError("Disposable service still running")
+            assert not aux.exists() and not endpoint.exists(), "Cleanup paths remain"
+        assert str(root) not in mounts(), "Disposable mount remains"
+        handles = subprocess.run(["/usr/sbin/lsof", "-t", str(volume)], capture_output=True, text=True)
+        assert handles.returncode == 1 and not handles.stdout.strip(), "Backing file still open"
+
+    try:
+        vc("create", "--create", volume, "--size=33554432", "--volume-type=normal",
+           "--encryption=AES", "--hash=sha512", "--filesystem=FAT", "--password=" + password,
+           "--pim=1", "--keyfiles=", "--random-source=/dev/urandom")
+        mount()
+        payload = bytes(range(256)) * 4096
+        with (mountpoint / "payload.bin").open("wb") as stream:
+            stream.write(payload)
+            stream.flush()
+            os.fsync(stream.fileno())
+        vc("unmount-write", "--unmount", volume)
+        confirm_closed()
+        mount(read_only=True)
+        assert hashlib.sha256((mountpoint / "payload.bin").read_bytes()).digest() == hashlib.sha256(payload).digest()
+        with (root / "gui.log").open("w") as log:
+            gui = subprocess.Popen([str(executable), "--background-task"], env=env,
+                                   stdout=log, stderr=log, start_new_session=True)
+        time.sleep(5)
+        assert gui.poll() is None, "Background app exited with a mounted volume"
+        vc("unmount-readonly", "--unmount", volume)
+        assert gui.wait(timeout=20) == 0, "Background app did not exit cleanly"
+        confirm_closed()
+        succeeded = True
+        print("PASS: payload integrity, initial background discovery, external-dismount refresh, automatic exit, service/file cleanup", flush=True)
+    finally:
+        if gui and gui.poll() is None:
+            gui.terminate()
+            gui.wait(timeout=10)
+        if str(root) in mounts():
+            vc("test-cleanup", "--unmount", volume)
+        if succeeded and not args.keep_artifacts:
+            confirm_closed()
+            shutil.rmtree(root)
+
+
+if __name__ == "__main__":
+    main()

Tests/test_macos_gui_teardown.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""Automatic GUI unmounts while a volume's service is slow; no sudo required.
+
+Requires a logged-in macOS desktop, clang, an unsigned local build, and no other
+VeraCrypt processes or mounts. Disposable containers are mounted without a
+filesystem; fuset_startup_faults.c slows down only their own services.
+
+1. A normal quit request (the quit Apple event also sent by logout) arrives while
+   an automatic unmount is in progress. It must be honored afterwards, including
+   unmount on quit for the remaining volume.
+2. An automatic unmount cannot confirm that the service exited. The background
+   application must keep a warning (shown on screen until the test ends) instead
+   of exiting silently.
+Takes about three minutes.
+"""
+import argparse
+import os
+from pathlib import Path
+import plistlib
+import shutil
+import signal
+import subprocess
+import tempfile
+import time
+
+QUIT_SOURCE = r"""
+#import <AppKit/AppKit.h>
+#include <stdlib.h>
+int main (int argc, char **argv)
+{
+	@autoreleasepool {
+		NSRunningApplication *app = argc > 1 ? [NSRunningApplication runningApplicationWithProcessIdentifier:atoi (argv[1])] : nil;
+		return app && [app terminate] ? 0 : 1;
+	}
+}
+"""
+
+
+class Leg:
+    def __init__(self, parent, name, prefs):
+        self.parent, self.name = parent, name
+        self.root = parent / name
+        self.temporary = self.root / "tmp"
+        config = self.root / "config" / "VeraCrypt"
+        self.temporary.mkdir(parents=True, mode=0o700)
+        config.mkdir(parents=True)
+        defaults = dict(BackgroundTaskEnabled=1, DismountOnInactivity=1, MaxVolumeIdleTime=1, ForceAutoDismount=1,
+                        WipeCacheOnAutoDismount=0, WipeCacheOnClose=0, MountFavoritesOnLogon=0,
+                        MountDevicesOnLogon=0, OpenExplorerWindowAfterMount=0, SaveHistory=0)
+        defaults.update(prefs)
+        (config / "Configuration.xml").write_text("<VeraCrypt><configuration>" + "".join(
+            f'<config key="{key}">{value}</config>' for key, value in defaults.items()
+        ) + "</configuration></VeraCrypt>")
+        self.env = dict(os.environ, TMPDIR=str(self.temporary) + "/", XDG_CONFIG_HOME=str(self.root / "config"))
+        self.gui = None
+        self.volumes = []
+
+    def vc(self, binary, label, *options, extra=None):
+        result = subprocess.run([str(binary), "--text", "--non-interactive", *map(str, options)],
+                                env=dict(self.env, **(extra or {})), capture_output=True, text=True, timeout=90)
+        (self.root / (label + ".log")).write_text(result.stdout + result.stderr)
+        if result.returncode:
+            raise RuntimeError(f"{label} failed; see {self.root / (label + '.log')}")
+
+    def aux_mounts(self):
+        mounts = subprocess.check_output(["/sbin/mount"], text=True)
+        return {line for line in mounts.splitlines() if str(self.temporary) in line and ".veracrypt_aux_mnt" in line}
+
+    def mount(self, binary, name, password, faults=None):
+        volume = self.root / (name + ".hc")
+        self.vc(binary, "create-" + name, "--create", volume, "--size=33554432", "--volume-type=normal",
+                "--encryption=AES", "--hash=sha512", "--filesystem=FAT", "--password=" + password,
+                "--pim=1", "--keyfiles=", "--random-source=/dev/urandom")
+        before = self.aux_mounts()
+        self.vc(binary, "mount-" + name, "--mount", volume, "--filesystem=none", "--password=" + password,
+                "--pim=1", "--keyfiles=", "--protect-hidden=no", extra=faults)
+        added = self.aux_mounts() - before
+        assert len(added) == 1, "Expected one new auxiliary mount"
+        self.volumes.append(volume)
+        return added.pop()
+
+    def start_gui(self, bundle):
+        with (self.root / "gui.log").open("w") as log:
+            self.gui = subprocess.Popen([str(bundle), "--background-task"], env=self.env,
+                                        stdout=log, stderr=log, start_new_session=True)
+        return time.monotonic()
+
+    def cleanup(self, binary):
+        if self.gui and self.gui.poll() is None:
+            self.gui.send_signal(signal.SIGTERM)
+            try:
+                self.gui.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                self.gui.kill()
+                self.gui.wait(timeout=10)
+        for volume in self.volumes:
+            if self.aux_mounts():
+                subprocess.run([str(binary), "--text", "--non-interactive", "--unmount", str(volume)],
+                               env=self.env, capture_output=True, text=True, timeout=90)
+
+
+def wait_for(condition, timeout):
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if condition():
+            return True
+        time.sleep(0.2)
+    return condition()
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--binary", required=True, type=Path)
+    parser.add_argument("--keep-artifacts", action="store_true")
+    args = parser.parse_args()
+    binary = args.binary.resolve(strict=True)
+    if ".veracrypt_aux_mnt" in subprocess.check_output(["/sbin/mount"], text=True):
+        raise RuntimeError("Dismount existing VeraCrypt volumes before this isolated GUI test")
+    processes = subprocess.check_output(["/bin/ps", "-axo", "comm="], text=True)
+    if any(Path(line.strip()).name.lower() == "veracrypt" for line in processes.splitlines()):
+        raise RuntimeError("Close other VeraCrypt processes before this isolated GUI test")
+
+    root = Path(tempfile.mkdtemp(prefix="vc-gui-teardown-")).resolve()
+    print("Artifacts:", root, flush=True)
+    contents = root / "VeraCryptTest.app" / "Contents"
+    bundle = contents / "MacOS" / "VeraCrypt"
+    bundle.parent.mkdir(parents=True)
+    shutil.copy2(binary, bundle)
+    (contents / "Info.plist").write_bytes(plistlib.dumps(dict(
+        CFBundleExecutable="VeraCrypt", CFBundleName="VeraCrypt Teardown Test",
+        CFBundleIdentifier=f"org.idrix.veracrypt.teardown-test.{os.getpid()}",
+        CFBundlePackageType="APPL", NSHighResolutionCapable=True)))
+    faults = root / "service-faults.dylib"
+    subprocess.run(["/usr/bin/xcrun", "clang", "-dynamiclib", "-Wall", "-Wextra", "-O2",
+                    str(Path(__file__).with_name("fuset_startup_faults.c")), "-o", str(faults)], check=True)
+    quit_tool = root / "quit-application"
+    subprocess.run(["/usr/bin/xcrun", "clang", "-x", "objective-c", "-fobjc-arc", "-framework", "AppKit",
+                    "-", "-o", str(quit_tool)], input=QUIT_SOURCE, text=True, check=True)
+    password = "Disposable-teardown-only"
+    legs = []
+    succeeded = False
+    try:
+        # 1. Quit request during an automatic unmount.
+        leg = Leg(root, "quit", dict(CloseBackgroundTaskOnNoVolumes=0, DismountOnLogOff=1))
+        legs.append(leg)
+        marker = leg.root / "unmount-started"
+        slow = leg.mount(binary, "slow", password, dict(
+            DYLD_INSERT_LIBRARIES=str(faults), VC_FUSET_TEST_FAULT="unmount-delay", VC_FUSET_TEST_DELAY="8",
+            VC_FUSET_TEST_ROOT=str(root), VC_FUSET_TEST_FAULT_MARKER=str(marker)))
+        started = leg.start_gui(bundle)
+        time.sleep(30)
+        other = leg.mount(binary, "other", password)
+        other_idle_deadline = time.monotonic() + 60
+        assert wait_for(marker.exists, 120), "Automatic unmount did not start"
+        subprocess.run([str(quit_tool), str(leg.gui.pid)], check=True)
+        assert wait_for(lambda: leg.gui.poll() is not None, 40), "Quit request during an automatic unmount was not honored"
+        exited = time.monotonic()
+        assert leg.gui.returncode == 0, "Application did not exit cleanly after the quit request"
+        remaining = leg.aux_mounts() & {slow, other}
+        assert not remaining, "Volumes remained mounted after quit"
+        assert exited < other_idle_deadline, "The remaining volume was not unmounted by the quit request"
+        print(f"quit honored {exited - started:.0f} s after GUI start; both volumes unmounted", flush=True)
+
+        # 2. Automatic unmount whose service exit cannot be confirmed.
+        leg = Leg(root, "unconfirmed", dict(CloseBackgroundTaskOnNoVolumes=1, DismountOnLogOff=0))
+        legs.append(leg)
+        slow = leg.mount(binary, "slow", password, dict(
+            DYLD_INSERT_LIBRARIES=str(faults), VC_FUSET_TEST_FAULT="cleanup-delay", VC_FUSET_TEST_DELAY="15",
+            VC_FUSET_TEST_ROOT=str(root), VC_FUSET_TEST_FAULT_MARKER=str(leg.root / "cleanup-delayed")))
+        service = int(next(leg.temporary.glob(".veracrypt_aux_mnt*/shutdown")).read_text().split()[0])
+        leg.start_gui(bundle)
+        assert wait_for(lambda: slow not in leg.aux_mounts(), 120), "Automatic unmount did not start"
+        service_alive = lambda: subprocess.run(["/bin/kill", "-0", str(service)], capture_output=True).returncode == 0
+        assert wait_for(lambda: not service_alive(), 40), "Delayed service did not exit"
+        time.sleep(8)
+        assert leg.gui.poll() is None, \
+            f"Background application exited (status {leg.gui.returncode}) after an unconfirmed cleanup"
+        print("unconfirmed cleanup kept the background application and its warning", flush=True)
+        succeeded = True
+        print("PASS: quit during automatic unmount, unmount on quit, unconfirmed cleanup warning", flush=True)
+    finally:
+        for leg in legs:
+            leg.cleanup(binary)
+        if succeeded and not args.keep_artifacts:
+            assert not any(leg.aux_mounts() for leg in legs), "Disposable mount remains"
+            shutil.rmtree(root)
+
+
+if __name__ == "__main__":
+    main()

contrib/EncryptData.ps1

@@ -0,0 +1,444 @@
+<#
+.SYNOPSIS
+    Create a VeraCrypt container just large enough for the supplied file or
+    directory and copy the data into it.
+
+.DESCRIPTION
+    • Chooses an exFAT cluster size (auto or explicit).
+    • Calculates the minimum container size using an iterative approach for FAT/Bitmap sizing, plus safety margin.
+    • Creates, mounts, copies, verifies, and unmounts – all guarded by -WhatIf/-Confirm (SupportsShouldProcess).
+    • Finds VeraCrypt automatically or takes a -VeraCryptDir override.
+    • Encryption and hash algorithms are parameters.
+    • Password can be passed via SecureString prompt or pipeline.
+    • Enhanced parameterization for safety margins and VeraCrypt overhead.
+
+.PARAMETER InputPath        File or directory to store in the container.
+.PARAMETER ContainerPath    Dest *.hc* file. Default: InputPath + '.hc'.
+.PARAMETER ClusterSizeKB    4–512 KiB or 'Auto' (default 32).
+.PARAMETER VeraCryptDir     Optional folder containing VeraCrypt *.exe* files.
+.PARAMETER EncryptionAlg    Any algorithm VeraCrypt accepts (default AES).
+.PARAMETER HashAlg          VeraCrypt hash (default SHA512).
+.PARAMETER SafetyPercent    Safety margin as percentage of calculated size (default 1.0 for small, 0.1 for large).
+.PARAMETER VCOverheadMiB    VeraCrypt overhead in MiB (default varies by size).
+.PARAMETER Force            If specified, allows overwriting the output container if it already exists.
+.PARAMETER Password         Optional SecureString password for automation (prompts if not provided).
+
+.EXAMPLE
+    .\EncryptData.ps1 -InputPath C:\Data -ContainerPath C:\EncryptedData.hc -ClusterSizeKB Auto
+.NOTES
+    Author: Mounir IDRASSI
+    Email: mounir.idrassi@amcrypto.jp
+    Date: 30 April 2025
+    License: This script is licensed under the Apache License 2.0
+#>
+
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [Parameter(Mandatory)][string]$InputPath,
+    [string]$ContainerPath,
+    [ValidateSet('Auto','4','8','16','32','64','128','256','512')]
+    [string]$ClusterSizeKB = '32',
+    [string]$VeraCryptDir,
+    [string]$EncryptionAlg = 'AES',
+    [string]$HashAlg = 'SHA512',
+    # 0 ⇒ use built-in logic; otherwise 0–100 %  
+    [ValidateRange(0.0,100.0)]  
+    [double]$SafetyPercent = 0,  
+    # 0 ⇒ auto. 1-8192 MiB accepted.  
+    [ValidateRange(0,8192)]  
+    [int]$VCOverheadMiB    = 0,
+    [Parameter(ValueFromPipeline = $true)][System.Security.SecureString]$Password,
+    [switch]$Force
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Get-AbsolutePath([string]$Path) {
+    if ([System.IO.Path]::IsPathRooted($Path)) {
+        return [System.IO.Path]::GetFullPath($Path)
+    } else {
+        $combined = Join-Path -Path (Get-Location) -ChildPath $Path
+        return [System.IO.Path]::GetFullPath($combined)
+    }
+}
+
+# Helper creates a temp file, registers it for secure deletion in finally  
+function New-VcErrFile {  
+    $tmp = [System.IO.Path]::GetTempFileName()  
+    # Pre-allocate 0-byte file; caller overwrites  
+    return $tmp  
+}
+
+# Constants for exFAT sizing
+$EXFAT_MIN_CLUSTERS = 2
+$EXFAT_PRACTICAL_MIN_CLUSTERS = 65533
+$INITIAL_VBR_SIZE = 32KB
+$BACKUP_VBR_SIZE = 32KB
+$RAW_UPCASE_BYTES = 128KB
+
+#----------------------- Locate VeraCrypt executables --------------------------
+if (-not $VeraCryptDir) {
+    $candidates = @(Join-Path $env:ProgramFiles 'VeraCrypt')
+    $VeraCryptDir = $candidates |
+        Where-Object { Test-Path (Join-Path $_ 'VeraCrypt.exe') } |
+        Select-Object -First 1
+    if (-not $VeraCryptDir) {
+        $cmd = Get-Command 'VeraCrypt.exe' -ErrorAction SilentlyContinue
+        if ($cmd) { $VeraCryptDir = Split-Path $cmd.Path }
+    }
+    if (-not $VeraCryptDir) { throw 'VeraCrypt executables not found – specify -VeraCryptDir.' }
+}
+
+$VeraCryptExe = Join-Path $VeraCryptDir 'VeraCrypt.exe'
+$VeraCryptFormatExe = Join-Path $VeraCryptDir 'VeraCrypt Format.exe'
+if (-not (Test-Path $VeraCryptExe) -or -not (Test-Path $VeraCryptFormatExe)) {
+    throw 'VeraCrypt executables missing.'
+}
+
+#--------------------------- Input / Output Paths ------------------------------
+$InputPath = Get-AbsolutePath $InputPath
+if (-not (Test-Path $InputPath)) { throw "InputPath '$InputPath' does not exist." }
+
+if (-not $ContainerPath) {
+    $ContainerPath = ($InputPath.TrimEnd('\') + '.hc')
+} else {
+    $ContainerPath = Get-AbsolutePath $ContainerPath
+}
+if (Test-Path $ContainerPath) {
+    if ($Force) {
+        Write-Verbose "Container '$ContainerPath' already exists and will be overwritten."
+        if ($PSCmdlet.ShouldProcess("File '$ContainerPath'", "Remove existing container")) {
+            Remove-Item $ContainerPath -Force
+        } else {
+            throw "Operation cancelled by user. Cannot overwrite '$ContainerPath'."
+        }
+    } else {
+        throw "Container '$ContainerPath' already exists. Use -Force to overwrite."
+    }
+}
+
+#----------------------------- Cluster Size -------------------------------------
+[UInt32]$ClusterSize = if ($ClusterSizeKB -eq 'Auto') { $null } else { [int]$ClusterSizeKB * 1KB }
+
+#--------------------------- exFAT Size Helpers --------------------------------
+function Get-DirectoryStats {
+    param([string]$Path)
+
+    $fileLengths = [System.Collections.Generic.List[UInt64]]::new()
+    $dirLengths  = [System.Collections.Generic.List[UInt64]]::new()
+    [UInt64]$metaSum = 0
+
+    function WalkDir {
+        param([System.IO.DirectoryInfo]$Dir)
+
+        [UInt64]$thisDirBytes = 0
+
+        # Use -ErrorAction SilentlyContinue for potentially inaccessible items (like system junctions)
+        Get-ChildItem -LiteralPath $Dir.FullName -Force -ErrorAction SilentlyContinue | ForEach-Object {
+
+            $nameLen   = $_.Name.Length
+            $nameSlots = [math]::Ceiling($nameLen / 15)          # name entries
+            $dirSlots  = 2 + $nameSlots                          # File + Stream + Names
+            $entryBytes = $dirSlots * 32
+
+            $metaSum      += $entryBytes
+            $thisDirBytes += $entryBytes
+
+            if ($_.PSIsContainer) {
+                WalkDir $_
+            } else {
+                # Handle potential errors reading length (e.g., locked files)
+                try {
+                    $fileLengths.Add([UInt64]$_.Length)
+                } catch {
+                    Write-Warning "Could not get length for file: $($_.FullName). Error: $($_.Exception.Message)"
+                }
+            }
+        }
+
+        # At least one 32-byte entry so the directory is not “empty”
+        if ($thisDirBytes -lt 32) { $thisDirBytes = 32 }
+
+        $dirLengths.Add($thisDirBytes)
+    }
+
+    $startItem = Get-Item -LiteralPath $Path -Force
+    if ($startItem -isnot [System.IO.DirectoryInfo]) {
+        # Handle case where InputPath is a single file
+        $nameLen   = $startItem.Name.Length
+        $nameSlots = [math]::Ceiling($nameLen / 15)
+        $dirSlots  = 2 + $nameSlots
+        $entryBytes = $dirSlots * 32
+        $metaSum = $entryBytes
+        $fileLengths.Add([UInt64]$startItem.Length)
+        $dirLengths.Add(32) # Minimal directory entry size for the root
+    } else {
+        WalkDir $startItem
+    }
+
+    [PSCustomObject]@{
+        MetadataSum = $metaSum      # pure 32-byte entry bytes (used for info, not size calc)
+        FileLengths = $fileLengths  # payload of regular files
+        DirLengths  = $dirLengths   # payload of *directory files* (containing entries)
+    }
+}
+
+function Compute-ExFatSize {
+    param(
+        [Parameter(Mandatory)][UInt64[]] $FileLengths,
+        [Parameter(Mandatory)][UInt64[]] $DirLengths,
+        [Parameter(Mandatory)][UInt32]   $Cluster
+    )
+
+    # --- Calculate base size (VBR, UpCase Table, File Payloads, Directory Payloads) ---
+    # These parts don't depend on the total cluster count directly.
+    [UInt64]$baseSize = $INITIAL_VBR_SIZE + $BACKUP_VBR_SIZE
+    $baseSize += [math]::Ceiling($RAW_UPCASE_BYTES / $Cluster) * $Cluster  # up-case tbl aligned
+
+    foreach ($len in $FileLengths) { $baseSize += [math]::Ceiling($len / $Cluster) * $Cluster }
+    foreach ($len in $DirLengths ) { $baseSize += [math]::Ceiling($len / $Cluster) * $Cluster }
+
+    # --- Iterative FAT/Bitmap Calculation ---
+    # The size of FAT and Bitmap depends on the total cluster count, which depends on the total size (including FAT/Bitmap).
+    # We iterate until the calculated total size stabilizes.
+
+    [UInt64]$currentTotalSize = $baseSize # Initial guess: size without FAT/Bitmap
+    [UInt64]$previousTotalSize = 0
+    $maxIterations = 10 # Safety break to prevent infinite loops
+    $iteration = 0
+
+    while ($currentTotalSize -ne $previousTotalSize -and $iteration -lt $maxIterations) {
+        $previousTotalSize = $currentTotalSize
+        $iteration++
+        Write-Verbose "Compute-ExFatSize Iteration '$iteration': Starting size = '$previousTotalSize' bytes"
+
+        # Calculate cluster count based on the size from the *start* of this iteration
+        $clusterCount = [math]::Ceiling($previousTotalSize / $Cluster)
+        # Ensure minimum cluster count if needed (exFAT has minimums, though usually covered by VBR etc.)
+        if ($clusterCount -lt $EXFAT_PRACTICAL_MIN_CLUSTERS) { $clusterCount = $EXFAT_PRACTICAL_MIN_CLUSTERS } # Practical minimum for FAT entries > sector size
+
+        # Allocation bitmap (1 bit per cluster, aligned to cluster size)
+        $bitmapBytes = [math]::Ceiling($clusterCount / 8)
+        $bitmapBytesAligned = [math]::Ceiling($bitmapBytes / $Cluster) * $Cluster
+        Write-Verbose "  Clusters: '$clusterCount', Bitmap Bytes: '$bitmapBytes', Aligned Bitmap: '$bitmapBytesAligned'"
+
+        # FAT (4 bytes per cluster, +2 reserved entries, aligned to cluster size)
+        $fatBytes = ([UInt64]$clusterCount + 2) * 4 # Use UInt64 to avoid overflow on large volumes
+        $fatBytesAligned = [math]::Ceiling($fatBytes / $Cluster) * $Cluster
+        Write-Verbose "  FAT Bytes: '$fatBytes', Aligned FAT: '$fatBytesAligned'"
+
+        # Calculate the new total size estimate including FAT and Bitmap
+        $currentTotalSize = $baseSize + $bitmapBytesAligned + $fatBytesAligned
+        Write-Verbose "  New Estimated Total Size: '$currentTotalSize' bytes"
+    }
+
+    if ($iteration -ge $maxIterations) {
+        Write-Warning "FAT/Bitmap size calculation did not converge after '$maxIterations' iterations. Using last calculated size ('$currentTotalSize' bytes). This might indicate an issue or extremely large dataset."
+    }
+
+    Write-Verbose "Compute-ExFatSize Converged Size: '$currentTotalSize' bytes after '$iteration' iterations."
+    return [PSCustomObject]@{
+        TotalSize = $currentTotalSize
+        ClusterCount = $clusterCount
+        IterationHistory = @()
+    }
+}
+
+function Get-RecommendedCluster {
+    param([UInt64]$VolumeBytes)
+    switch ($VolumeBytes) {
+        { $_ -le 256MB } { return 4KB }
+        { $_ -le 32GB } { return 32KB }
+        { $_ -le 256TB } { return 128KB }
+        default { return 512KB }
+    }
+}
+
+#----------------------------------------------- Drive the two-pass logic
+Write-Host "Calculating required size for '$InputPath'..."
+$stats = Get-DirectoryStats -Path $InputPath
+Write-Verbose "Stats: $($stats.FileLengths.Count) files, $($stats.DirLengths.Count) directories, Metadata: $($stats.MetadataSum) bytes."
+
+if (-not $ClusterSize) {
+    Write-Verbose "Cluster size set to 'Auto'. Performing first pass calculation with 4KB cluster..."
+    $firstPassResult = Compute-ExFatSize -FileLengths $stats.FileLengths -DirLengths $stats.DirLengths -Cluster 4KB
+    $firstPassSize = $firstPassResult.TotalSize
+    Write-Verbose "First pass estimated size: '$firstPassSize' bytes"
+
+    $ClusterSize = Get-RecommendedCluster -VolumeBytes $firstPassSize
+    Write-Host "Auto-selected Cluster size: $($ClusterSize / 1KB) KiB based on estimated size."
+    Write-Verbose "Performing second pass calculation with selected cluster size ($($ClusterSize / 1KB) KiB)..."
+    $sizeResult = Compute-ExFatSize -FileLengths $stats.FileLengths -DirLengths $stats.DirLengths -Cluster $ClusterSize
+    $rawSize = $sizeResult.TotalSize
+} else {
+    Write-Host "Using specified Cluster size: $($ClusterSize / 1KB) KiB."
+    Write-Verbose "Performing calculation with specified cluster size..."
+    $sizeResult = Compute-ExFatSize -FileLengths $stats.FileLengths -DirLengths $stats.DirLengths -Cluster $ClusterSize
+    $rawSize = $sizeResult.TotalSize
+}
+
+#---------------------------- Container Sizing ---------------------------------
+$safetyPercentUsed = if ($SafetyPercent -gt 0.0) { $SafetyPercent } else { if ($rawSize -lt 100MB) { 1.0 } else { 0.1 } }
+$safety = if ($rawSize -lt 100MB) { [math]::Max(64KB, [math]::Ceiling($rawSize * $safetyPercentUsed / 100)) }
+          else { [math]::Max(1MB, [math]::Ceiling($rawSize * $safetyPercentUsed / 100)) }
+$contBytes = $rawSize + [UInt64]$safety
+$contMiB = [int][math]::Ceiling($contBytes / 1MB)
+if ($contMiB -lt 2) { $contMiB = 2 }
+
+$vcOverheadMiBUsed = if ($VCOverheadMiB -gt 0) { $VCOverheadMiB } else {
+    if ($contMiB -lt 10) { 1 } elseif ($contMiB -lt 100) { 2 } else { [math]::Ceiling($contMiB * 0.01) }
+}
+$finalContMiB = $contMiB + $vcOverheadMiBUsed
+
+Write-Host ("Cluster Size  : {0} KiB`nCalculated FS: {1:N0} bytes`nSafety Margin: {2:N0} bytes ({3}%)`nVC Overhead  : {4} MiB`nFinal Size   : {5} MiB" -f
+    ($ClusterSize/1KB), $rawSize, $safety, $safetyPercentUsed, $vcOverheadMiBUsed, $finalContMiB)
+
+#---- Secure Password Prompt ----
+if (-not $Password) {
+    $Password = Read-Host -AsSecureString -Prompt "Enter container password"
+}
+$cred = New-Object System.Management.Automation.PSCredential ("VeraCryptUser", $Password)
+$plainPassword = $cred.GetNetworkCredential().Password
+
+if ([string]::IsNullOrWhiteSpace($plainPassword)) {
+    Write-Host "Error: Password cannot be empty. Please provide a non-empty password." -ForegroundColor Red
+    exit 1
+}
+
+#---- Main Action ----
+$mounted = $false
+$driveLetter = $null
+
+$errFile   = New-VcErrFile  
+$mountFile = New-VcErrFile
+
+try {
+    #--- Create Container ----
+    if ($PSCmdlet.ShouldProcess("File '$ContainerPath'", "Create VeraCrypt container ($finalContMiB MiB)")) {
+        $formatArgs = @(
+            '/create', $ContainerPath,
+            '/size', "$($finalContMiB)M",
+            '/password', $plainPassword,
+            '/encryption', $EncryptionAlg,
+            '/hash', $HashAlg,
+            '/filesystem', 'exFAT',
+            '/quick', '/silent',
+            '/force'
+        )
+        $maskedArgs = $formatArgs.Clone()
+        $pwIndex = [array]::IndexOf($maskedArgs, '/password')
+        if ($pwIndex -ge 0 -and $pwIndex + 1 -lt $maskedArgs.Length) { $maskedArgs[$pwIndex+1] = '********' }
+        Write-Verbose "Executing: `"$VeraCryptFormatExe`" $($maskedArgs -join ' ')"
+
+        $proc = Start-Process -FilePath $VeraCryptFormatExe -ArgumentList $formatArgs -NoNewWindow -Wait -PassThru -RedirectStandardError $errFile
+        if ($proc.ExitCode -ne 0) {
+            $errMsg = if (Test-Path $errFile) { Get-Content $errFile -Raw } else { "No error output captured." }
+            throw "VeraCrypt Format failed (code $($proc.ExitCode)). Error: $errMsg"
+        }
+        Write-Verbose "VeraCrypt Format completed successfully."
+    } else {
+        Write-Host "Container creation skipped due to -WhatIf."
+        exit
+    }
+
+    #--- Choose Drive Letter ----
+    $used = (Get-PSDrive -PSProvider FileSystem).Name
+    $driveLetter = (67..90 | ForEach-Object {[char]$_}) |
+        Where-Object { $_ -notin $used } |
+        Select-Object -First 1
+    if (-not $driveLetter) { throw 'No free drive letters found (C-Z).' }
+    Write-Verbose "Selected drive letter: $driveLetter"
+
+    #--- Mount ----
+    if ($PSCmdlet.ShouldProcess("Drive $driveLetter", "Mount VeraCrypt volume '$ContainerPath'")) {
+        $mountArgs = @(
+            '/volume', $ContainerPath,
+            '/letter', $driveLetter,
+            '/m', 'rm',
+            '/password', $plainPassword,
+            '/quit', '/silent'
+        )
+        $maskedArgs = $mountArgs.Clone()
+        $pwIndex = [array]::IndexOf($maskedArgs, '/password')
+        if ($pwIndex -ge 0 -and $pwIndex + 1 -lt $maskedArgs.Length) { $maskedArgs[$pwIndex+1] = '********' }
+        Write-Verbose "Executing: `"$VeraCryptExe`" $($maskedArgs -join ' ')"
+
+        $mountProc = Start-Process -FilePath $VeraCryptExe -ArgumentList $mountArgs -NoNewWindow -Wait -PassThru -RedirectStandardError $mountFile
+        if ($mountProc.ExitCode -ne 0) {
+            $errMsg = if (Test-Path $mountFile) { Get-Content $mountFile -Raw } else { "No error output captured." }
+            throw "VeraCrypt mount failed (code $($mountProc.ExitCode)). Error: $errMsg"
+        }
+
+        $root = "$($driveLetter):\"
+        Write-Verbose "Waiting for drive $root to become available..."
+        $mountTimeoutSeconds = 30
+        $mountCheckInterval = 0.5
+        $elapsed = 0
+        while (-not (Test-Path $root) -and $elapsed -lt $mountTimeoutSeconds) {
+            Start-Sleep -Seconds $mountCheckInterval
+            $elapsed += $mountCheckInterval
+        }
+
+        if (-not (Test-Path $root)) { throw "Drive $driveLetter did not appear within $mountTimeoutSeconds seconds." }
+        $mounted = $true
+        Write-Verbose "Drive $root mounted successfully."
+    } else {
+        Write-Host "Mounting skipped due to -WhatIf."
+        exit
+    }
+
+    #--- Copy Data ----
+    $destinationPath = "$($driveLetter):\"
+    if ($PSCmdlet.ShouldProcess("'$InputPath' -> '$destinationPath'", "Copy input data into container")) {
+        Write-Verbose "Starting data copy..."
+        if (Test-Path $InputPath -PathType Container) {
+            Copy-Item -Path "$InputPath\*" -Destination $destinationPath -Recurse -Force -ErrorAction Stop
+            Write-Verbose "Copied directory contents recursively."
+        } else {
+            Copy-Item -Path $InputPath -Destination $destinationPath -Force -ErrorAction Stop
+            Write-Verbose "Copied single file."
+        }
+        try {
+            $driveInfo = Get-PSDrive $driveLetter -ErrorAction Stop
+            $freeSpace = $driveInfo.Free
+            Write-Verbose "Free space after copy: $freeSpace bytes."
+            if ($freeSpace -lt 0) {
+                Write-Warning 'Reported free space is negative. This might indicate an issue, but the copy might still be okay.'
+            } elseif ($freeSpace -lt 1MB) {
+                Write-Warning "Very low free space remaining ($freeSpace bytes). The container might be too small if data changes slightly."
+            }
+        } catch {
+            Write-Warning "Could not verify free space on drive $driveLetter after copy. Error: $($_.Exception.Message)"
+        }
+        Write-Host "Data copy completed."
+    } else {
+        Write-Host "Data copy skipped due to -WhatIf."
+    }
+} catch {
+    Write-Error "An error occurred: $($_.Exception.Message)"
+} finally {
+    if (Test-Path variable:plainPassword) { Clear-Variable plainPassword -ErrorAction SilentlyContinue }
+    if ($mounted) {
+        if ($PSCmdlet.ShouldProcess("Drive $driveLetter", "Unmount VeraCrypt volume")) {
+            Write-Verbose "Unmounting drive $driveLetter..."
+            $unmountArgs = @('/unmount', $driveLetter, '/force', '/quit', '/silent')
+            Start-Process -FilePath $VeraCryptExe -ArgumentList $unmountArgs -NoNewWindow -Wait -ErrorAction SilentlyContinue
+            Write-Verbose "Unmount command issued."
+        } else {
+            Write-Host "Unmount skipped due to -WhatIf."
+        }
+    }
+    foreach($f in @($errFile,$mountFile) | Where-Object { $_ }) {  
+        if(Test-Path $f){  
+            try { Set-Content -Path $f -Value ($null) -Encoding Byte -Force } catch{}  
+            Remove-Item $f -Force -ErrorAction SilentlyContinue  
+        }  
+    }
+}
+
+if ($PSCmdlet.ShouldProcess("File '$ContainerPath'", "Create VeraCrypt container ($finalContMiB MiB)")) {
+    Write-Host ("Script finished. VeraCrypt container created at '{0}' ({1} MiB)." -f $ContainerPath, $finalContMiB)
+} else {
+    Write-Host ("Script finished (simulation mode).")
+}

doc/chm/create_chm.bat

@@ -0,0 +1,41 @@
+PATH=%PATH%;C:\Program Files (x86)\HTML Help Workshop
+
+set CHMBUILDPATH=%~dp0
+cd %CHMBUILDPATH%\en
+
+xcopy /E ..\..\html\en\* .
+
+hhc VeraCrypt.hhp
+
+del /F /Q *.html *.css *.jpg *.gif *.png *.svg *.js
+rmdir /s /Q CompilingGuidelineWin
+
+move /Y "VeraCrypt User Guide.chm" "..\VeraCrypt User Guide.chm"
+
+cd %CHMBUILDPATH%\zh-cn
+
+xcopy /E ..\..\html\zh-cn\* .
+
+hhc VeraCrypt.zh-cn.hhp
+
+del /F /Q *.html *.css *.jpg *.gif *.png *.svg *.js
+rmdir /s /Q CompilingGuidelineWin
+
+move /Y "VeraCrypt User Guide.zh-cn.chm" "..\VeraCrypt User Guide.zh-cn.chm"
+
+cd %CHMBUILDPATH%\ru
+
+xcopy /E ..\..\html\ru\* .
+
+hhc VeraCrypt.ru.hhp
+
+del /F /Q *.html *.css *.jpg *.gif *.png *.svg *.js
+rmdir /s /Q CompilingGuidelineWin
+
+move /Y "VeraCrypt User Guide.ru.chm" "..\VeraCrypt User Guide.ru.chm"
+
+cd %CHMBUILDPATH%
+
+
+
+

doc/chm/en/VeraCrypt.hhc

@@ -0,0 +1,481 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<HTML>
+<HEAD>
+<meta name="GENERATOR" content="Microsoft&reg; HTML Help Workshop 4.1">
+<!-- Sitemap 1.0 -->
+</HEAD><BODY>
+<UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Table Of Contents">
+		<param name="Local" value="Documentation.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Preface">
+		<param name="Local" value="Preface.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Introduction">
+		<param name="Local" value="Introduction.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Beginner's Tutorial ">
+		<param name="Local" value="Beginner's Tutorial.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="VeraCrypt Volume ">
+		<param name="Local" value="VeraCrypt Volume.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Creating a New VeraCrypt Volume">
+			<param name="Local" value="Creating New Volumes.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Favorite Volumes">
+			<param name="Local" value="Favorite Volumes.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="System Favorite Volumes">
+			<param name="Local" value="System Favorite Volumes.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="System Encryption">
+		<param name="Local" value="System Encryption.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Hidden Operating System">
+			<param name="Local" value="Hidden Operating System.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Operating Systems Supported for System Encryption">
+			<param name="Local" value="Supported Systems for System Encryption.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="EFI Secure Boot">
+			<param name="Local" value="EFISecureBoot.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt Rescue Disk">
+			<param name="Local" value="VeraCrypt Rescue Disk.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Plausible Deniability">
+		<param name="Local" value="Plausible Deniability.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Hidden Volume">
+			<param name="Local" value="Hidden Volume.html">
+			</OBJECT>
+		<UL>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Protection of Hidden Volumes Against Damage">
+				<param name="Local" value="Protection of Hidden Volumes.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Security Requirements and Precautions Pertaining to Hidden Volumes">
+				<param name="Local" value="Security Requirements for Hidden Volumes.html">
+				</OBJECT>
+		</UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Hidden Operating System">
+			<param name="Local" value="VeraCrypt Hidden Operating System.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Main Program Window">
+		<param name="Local" value="Main Program Window.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Program Menu">
+			<param name="Local" value="Program Menu.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Mounting Volumes">
+			<param name="Local" value="Mounting VeraCrypt Volumes.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Normal Unmount vs Force Unmount ">
+		<param name="Local" value="Normal Unmount vs Force Unmount.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Avoid Third-Party File Extensions">
+		<param name="Local" value="Avoid Third-Party File Extensions.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Parallelization">
+		<param name="Local" value="Parallelization.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Pipelining">
+		<param name="Local" value="Pipelining.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Hardware acceleration">
+		<param name="Local" value="Hardware Acceleration.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Hot keys">
+		<param name="Local" value="Hot Keys.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Keyfiles">
+		<param name="Local" value="Keyfiles in VeraCrypt.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Security Tokens &amp; Smart Cards">
+		<param name="Local" value="Security Tokens & Smart Cards.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Portable Mode">
+		<param name="Local" value="Portable Mode.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="TrueCrypt Support">
+		<param name="Local" value="TrueCrypt Support.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Converting TrueCrypt Volumes &amp; Partitions">
+		<param name="Local" value="Converting TrueCrypt volumes and partitions.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Conversion Guide for Versions 1.26 and Later">
+		<param name="Local" value="Conversion_Guide_VeraCrypt_1.26_and_Later.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Default Mount Parameters">
+		<param name="Local" value="Default Mount Parameters.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Language Packs">
+		<param name="Local" value="Language Packs.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Encryption Algorithms">
+		<param name="Local" value="Encryption Algorithms.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="AES">
+			<param name="Local" value="AES.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Camellia">
+			<param name="Local" value="Camellia.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Kuznyechik">
+			<param name="Local" value="Kuznyechik.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Serpent">
+			<param name="Local" value="Serpent.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Twofish">
+			<param name="Local" value="Twofish.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Cascades of ciphers">
+			<param name="Local" value="Cascades.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Hash Algorithms">
+		<param name="Local" value="Hash Algorithms.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="BLAKE2s-256">
+			<param name="Local" value="BLAKE2s-256.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="BLAKE2b-512">
+			<param name="Local" value="BLAKE2b-512.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="SHA-256">
+			<param name="Local" value="SHA-256.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="SHA-512">
+			<param name="Local" value="SHA-512.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Whirlpool">
+			<param name="Local" value="Whirlpool.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Streebog">
+			<param name="Local" value="Streebog.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Key Derivation Algorithms">
+		<param name="Local" value="Key Derivation Algorithms.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Argon2id">
+			<param name="Local" value="Argon2id.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="PBKDF2">
+			<param name="Local" value="pbkdf2.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Supported Operating Systems">
+		<param name="Local" value="Supported Operating Systems.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Command Line Usage">
+		<param name="Local" value="Command Line Usage.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Windows">
+			<param name="Local" value="Command Line Usage for Windows.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Linux and macOS">
+			<param name="Local" value="Command Line Usage for Unix.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Security Model">
+		<param name="Local" value="Security Model.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Security Requirements And Precautions">
+		<param name="Local" value="Security Requirements and Precautions.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Data Leaks">
+			<param name="Local" value="Data Leaks.html">
+			</OBJECT>
+		<UL>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Paging File">
+				<param name="Local" value="Paging File.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Memory Dump Files">
+				<param name="Local" value="Memory Dump Files.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Hibernation File">
+				<param name="Local" value="Hibernation File.html">
+				</OBJECT>
+		</UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Unencrypted Data in RAM">
+			<param name="Local" value="Unencrypted Data in RAM.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt RAM Encryption">
+			<param name="Local" value="VeraCrypt RAM Encryption.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt Memory Protection">
+			<param name="Local" value="VeraCrypt Memory Protection.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Physical Security">
+			<param name="Local" value="Physical Security.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Malware">
+			<param name="Local" value="Malware.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Multi-User Environment">
+			<param name="Local" value="Multi-User Environment.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Authenticity and Integrity">
+			<param name="Local" value="Authenticity and Integrity.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Choosing Passwords and Keyfiles">
+			<param name="Local" value="Choosing Passwords and Keyfiles.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Changing Passwords and Keyfiles">
+			<param name="Local" value="Changing Passwords and Keyfiles.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Trim Operation">
+			<param name="Local" value="Trim Operation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Wear-Leveling">
+			<param name="Local" value="Wear-Leveling.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Reallocated Sectors">
+			<param name="Local" value="Reallocated Sectors.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Defragmenting">
+			<param name="Local" value="Defragmenting.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Journaling File Systems">
+			<param name="Local" value="Journaling File Systems.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Volume Clones">
+			<param name="Local" value="Volume Clones.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Additional Security Requirements and Precautions">
+			<param name="Local" value="Additional Security Requirements and Precautions.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="How To Back Up Securely">
+		<param name="Local" value="How to Back Up Securely.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Miscellaneous">
+		<param name="Local" value="Miscellaneous.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Using VeraCrypt Without Administrator Privileges">
+			<param name="Local" value="Using VeraCrypt Without Administrator Privileges.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Sharing Over Network">
+			<param name="Local" value="Sharing over Network.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt Background Task">
+			<param name="Local" value="VeraCrypt Background Task.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Volume Mounted as Removable Medium">
+			<param name="Local" value="Removable Medium Volume.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt System Files &amp; Application Data">
+			<param name="Local" value="VeraCrypt System Files.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="How To Remove Encryption">
+			<param name="Local" value="Removing Encryption.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Uninstalling VeraCrypt">
+			<param name="Local" value="Uninstalling VeraCrypt.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Digital Signatures">
+			<param name="Local" value="Digital Signatures.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Troubleshooting">
+		<param name="Local" value="Troubleshooting.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Incompatibilities">
+		<param name="Local" value="Incompatibilities.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Known Issues and Limitations">
+		<param name="Local" value="Issues and Limitations.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Frequently Asked Questions">
+		<param name="Local" value="FAQ.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Technical Details">
+		<param name="Local" value="Technical Details.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Notation">
+			<param name="Local" value="Notation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Encryption Scheme">
+			<param name="Local" value="Encryption Scheme.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Modes of Operation">
+			<param name="Local" value="Modes of Operation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Header Key Derivation, Salt, and Iteration Count">
+			<param name="Local" value="Header Key Derivation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Random Number Generator">
+			<param name="Local" value="Random Number Generator.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Keyfiles">
+			<param name="Local" value="Keyfiles.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="PIM">
+			<param name="Local" value="Personal Iterations Multiplier (PIM).html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt Volume Format Specification">
+			<param name="Local" value="VeraCrypt Volume Format Specification.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Compliance with Standards and Specifications">
+			<param name="Local" value="Standard Compliance.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Source Code">
+			<param name="Local" value="Source Code.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Building VeraCrypt From Source">
+			<param name="Local" value="CompilingGuidelines.html">
+			</OBJECT>
+		<UL>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Windows Build Guide">
+				<param name="Local" value="CompilingGuidelineWin.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Linux Build Guide">
+				<param name="Local" value="CompilingGuidelineLinux.html">
+				</OBJECT>
+		</UL>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Contact">
+		<param name="Local" value="Contact.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Legal Information">
+		<param name="Local" value="Legal Information.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Version History">
+		<param name="Local" value="Release Notes.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Acknowledgements">
+		<param name="Local" value="Acknowledgements.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="References">
+		<param name="Local" value="References.html">
+		</OBJECT>
+</UL>
+</BODY></HTML>

doc/chm/en/VeraCrypt.hhk

@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<HTML>
+<HEAD>
+<!-- Sitemap 1.0 -->
+</HEAD><BODY>
+<UL>
+<LI> <OBJECT type="text/sitemap">
+     <param name="Name" value="Table Of Contents">
+     <param name="Local" value="Documentation.html">
+     </OBJECT>
+
+</UL>
+</BODY></HTML>

doc/chm/en/VeraCrypt.hhp

@@ -0,0 +1,185 @@
+[OPTIONS]
+Compatibility=1.1 or later
+Compiled file=VeraCrypt User Guide.chm
+Contents file=VeraCrypt.hhc
+Default topic=Documentation.html
+Display compile progress=No
+Full-text search=Yes
+Index file=VeraCrypt.hhk
+Language=0x409 English (United States)
+Title=VeraCrypt User Guide
+
+[FILES]
+Acknowledgements.html
+Additional Security Requirements and Precautions.html
+AES.html
+Argon2id.html
+arrow_right.gif
+Authenticity and Integrity.html
+Authors.html
+Avoid Third-Party File Extensions.html
+BC_Logo_30x30.png
+BCH_Logo_30x30.png
+Beginner's Tutorial.html
+Beginner's Tutorial_Image_001.jpg
+Beginner's Tutorial_Image_002.jpg
+Beginner's Tutorial_Image_003.jpg
+Beginner's Tutorial_Image_004.jpg
+Beginner's Tutorial_Image_005.jpg
+Beginner's Tutorial_Image_007.jpg
+Beginner's Tutorial_Image_008.jpg
+Beginner's Tutorial_Image_009.jpg
+Beginner's Tutorial_Image_010.jpg
+Beginner's Tutorial_Image_011.jpg
+Beginner's Tutorial_Image_012.jpg
+Beginner's Tutorial_Image_013.jpg
+Beginner's Tutorial_Image_014.jpg
+Beginner's Tutorial_Image_015.jpg
+Beginner's Tutorial_Image_016.jpg
+Beginner's Tutorial_Image_017.jpg
+Beginner's Tutorial_Image_018.jpg
+Beginner's Tutorial_Image_019.jpg
+Beginner's Tutorial_Image_020.jpg
+Beginner's Tutorial_Image_021.jpg
+Beginner's Tutorial_Image_022.jpg
+Beginner's Tutorial_Image_023.gif
+Beginner's Tutorial_Image_024.gif
+Beginner's Tutorial_Image_034.png
+BLAKE2s-256.html
+BLAKE2b-512.html
+Camellia.html
+Cascades.html
+Changing Passwords and Keyfiles.html
+Choosing Passwords and Keyfiles.html
+Command Line Usage.html
+Command Line Usage for Windows.html
+Command Line Usage for Unix.html
+CompilingGuidelineLinux.html
+CompilingGuidelines.html
+CompilingGuidelineWin.html
+Contact.html
+Contributed Resources.html
+Conversion_Guide_VeraCrypt_1.26_and_Later.html
+Converting TrueCrypt volumes and partitions.html
+Converting TrueCrypt volumes and partitions_truecrypt_convertion.jpg
+Creating New Volumes.html
+Data Leaks.html
+Default Mount Parameters.html
+Default Mount Parameters_VeraCrypt_password_using_default_parameters.png
+Defragmenting.html
+Digital Signatures.html
+Disclaimers.html
+Documentation.html
+EFISecureBoot.html
+Encryption Algorithms.html
+Encryption Scheme.html
+FAQ.html
+Favorite Volumes.html
+flattr-badge-large.png
+gf2_mul.gif
+Hardware Acceleration.html
+Hash Algorithms.html
+Header Key Derivation.html
+Hibernation File.html
+Hidden Operating System.html
+Hidden Volume.html
+Home_facebook_veracrypt.png
+Home_reddit.png
+Home_utilities-file-archiver-3.png
+Home_VeraCrypt_Default_Mount_Parameters.png
+Home_VeraCrypt_menu_Default_Mount_Parameters.png
+Hot Keys.html
+How to Back Up Securely.html
+Incompatibilities.html
+Introduction.html
+Issues and Limitations.html
+Journaling File Systems.html
+Key Derivation Algorithms.html
+Keyfiles in VeraCrypt.html
+Keyfiles in VeraCrypt_Image_040.gif
+Keyfiles.html
+Kuznyechik.html
+Language Packs.html
+Legal Information.html
+liberapay_donate.svg
+LTC_Logo_30x30.png
+Main Program Window.html
+Malware.html
+mastodon_veracrypt.PNG
+Memory Dump Files.html
+Miscellaneous.html
+Modes of Operation.html
+Monero_Logo_30x30.png
+Mounting VeraCrypt Volumes.html
+Multi-User Environment.html
+Notation.html
+Paging File.html
+Parallelization.html
+paypal_30x30.png
+pbkdf2.html
+Personal Iterations Multiplier (PIM).html
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step2.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step2.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step2.png
+Physical Security.html
+Pipelining.html
+Plausible Deniability.html
+Portable Mode.html
+Preface.html
+Program Menu.html
+Protection of Hidden Volumes.html
+Protection of Hidden Volumes_Image_027.jpg
+Protection of Hidden Volumes_Image_028.jpg
+Protection of Hidden Volumes_Image_029.jpg
+Protection of Hidden Volumes_Image_030.jpg
+Protection of Hidden Volumes_Image_031.jpg
+Random Number Generator.html
+Reallocated Sectors.html
+References.html
+Release Notes.html
+Removable Medium Volume.html
+Removing Encryption.html
+Security Model.html
+Security Requirements and Precautions.html
+Security Requirements for Hidden Volumes.html
+Security Tokens & Smart Cards.html
+Serpent.html
+SHA-256.html
+SHA-512.html
+Sharing over Network.html
+Source Code.html
+Standard Compliance.html
+Streebog.html
+styles.css
+Supported Operating Systems.html
+Supported Systems for System Encryption.html
+System Encryption.html
+System Favorite Volumes.html
+Technical Details.html
+Trim Operation.html
+Troubleshooting.html
+TrueCrypt Support.html
+TrueCrypt Support_truecrypt_mode_gui.jpg
+twitter_veracrypt.PNG
+Twofish.html
+Unencrypted Data in RAM.html
+Uninstalling VeraCrypt.html
+Using VeraCrypt Without Administrator Privileges.html
+VeraCrypt Background Task.html
+VeraCrypt Hidden Operating System.html
+VeraCrypt License.html
+VeraCrypt Memory Protection.html
+VeraCrypt RAM Encryption.html
+VeraCrypt Rescue Disk.html
+VeraCrypt System Files.html
+VeraCrypt Volume Format Specification.html
+VeraCrypt Volume.html
+VeraCrypt128x128.png
+Volume Clones.html
+Wear-Leveling.html
+Whirlpool.html
+
+[INFOTYPES]

doc/chm/ru/VeraCrypt.ru.hhc

@@ -0,0 +1,471 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<HTML>
+<HEAD>
+<meta name="GENERATOR" content="Microsoft&reg; HTML Help Workshop 4.1">
+<!-- Sitemap 1.0 -->
+</HEAD><BODY>
+<UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Äîêóìåíòàöèÿ">
+        <param name="Local" value="Documentation.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïðåäèñëîâèå">
+        <param name="Local" value="Preface.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ââåäåíèå">
+        <param name="Local" value="Introduction.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ðóêîâîäñòâî äëÿ íà÷èíàþùèõ">
+        <param name="Local" value="Beginner's Tutorial.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Òîì VeraCrypt">
+        <param name="Local" value="VeraCrypt Volume.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñîçäàíèå íîâîãî òîìà VeraCrypt">
+            <param name="Local" value="Creating New Volumes.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Èçáðàííûå òîìà">
+            <param name="Local" value="Favorite Volumes.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñèñòåìíûå èçáðàííûå òîìà">
+            <param name="Local" value="System Favorite Volumes.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Øèôðîâàíèå ñèñòåìû">
+        <param name="Local" value="System Encryption.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñêðûòàÿ îïåðàöèîííàÿ ñèñòåìà">
+            <param name="Local" value="Hidden Operating System.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Îïåðàöèîííûå ñèñòåìû, ïîääåðæèâàþùèå ñèñòåìíîå øèôðîâàíèå">
+            <param name="Local" value="Supported Systems for System Encryption.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="EFI Secure Boot">
+            <param name="Local" value="EFISecureBoot.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Äèñê âîññòàíîâëåíèÿ VeraCrypt (Rescue Disk)">
+            <param name="Local" value="VeraCrypt Rescue Disk.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïðàâäîïîäîáíîå îòðèöàíèå íàëè÷èÿ øèôðîâàíèÿ">
+        <param name="Local" value="Plausible Deniability.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñêðûòûé òîì">
+            <param name="Local" value="Hidden Volume.html">
+            </OBJECT>
+        <UL>
+            <LI> <OBJECT type="text/sitemap">
+                <param name="Name" value="Çàùèòà ñêðûòûõ òîìîâ îò ïîâðåæäåíèé">
+                <param name="Local" value="Protection of Hidden Volumes.html">
+                </OBJECT>
+            <LI> <OBJECT type="text/sitemap">
+                <param name="Name" value="Òðåáîâàíèÿ áåçîïàñíîñòè è ìåðû ïðåäîñòîðîæíîñòè, êàñàþùèåñÿ ñêðûòûõ òîìîâ">
+                <param name="Local" value="Security Requirements for Hidden Volumes.html">
+                </OBJECT>
+        </UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñêðûòàÿ îïåðàöèîííàÿ ñèñòåìà">
+            <param name="Local" value="VeraCrypt Hidden Operating System.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ãëàâíîå îêíî ïðîãðàììû">
+        <param name="Local" value="Main Program Window.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ìåíþ ïðîãðàììû">
+            <param name="Local" value="Program Menu.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ìîíòèðîâàíèå òîìîâ">
+            <param name="Local" value="Mounting VeraCrypt Volumes.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Îáû÷íîå ðàçìîíòèðîâàíèå ïðîòèâ ïðèíóäèòåëüíîãî">
+        <param name="Local" value="Normal Unmount vs Force Unmount.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Î ðèñêàõ, ñâÿçàííûõ ñî ñòîðîííèìè ðàñøèðåíèÿìè ôàéëîâ">
+        <param name="Local" value="Avoid Third-Party File Extensions.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ðàñïàðàëëåëèâàíèå">
+        <param name="Local" value="Parallelization.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Êîíâåéåðèçàöèÿ">
+        <param name="Local" value="Pipelining.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Àïïàðàòíîå óñêîðåíèå">
+        <param name="Local" value="Hardware Acceleration.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ãîðÿ÷èå êëàâèøè">
+        <param name="Local" value="Hot Keys.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Êëþ÷åâûå ôàéëû">
+        <param name="Local" value="Keyfiles in VeraCrypt.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Òîêåíû áåçîïàñíîñòè è ñìàðò-êàðòû">
+        <param name="Local" value="Security Tokens & Smart Cards.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïîðòàòèâíûé (ïåðåíîñíîé) ðåæèì">
+        <param name="Local" value="Portable Mode.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïîääåðæêà TrueCrypt">
+        <param name="Local" value="TrueCrypt Support.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïðåîáðàçîâàíèå òîìîâ è ðàçäåëîâ TrueCrypt â ôîðìàò VeraCrypt">
+        <param name="Local" value="Converting TrueCrypt volumes and partitions.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ðóêîâîäñòâî ïî ïðåîáðàçîâàíèþ òîìîâ äëÿ âåðñèé 1.26 è íîâåå">
+        <param name="Local" value="Conversion_Guide_VeraCrypt_1.26_and_Later.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïàðàìåòðû ìîíòèðîâàíèÿ ïî óìîë÷àíèþ">
+        <param name="Local" value="Default Mount Parameters.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="ßçûêîâûå ïàêåòû">
+        <param name="Local" value="Language Packs.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Àëãîðèòìû øèôðîâàíèÿ">
+        <param name="Local" value="Encryption Algorithms.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="AES">
+            <param name="Local" value="AES.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Camellia">
+            <param name="Local" value="Camellia.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Kuznyechik">
+            <param name="Local" value="Kuznyechik.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Serpent">
+            <param name="Local" value="Serpent.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Twofish">
+            <param name="Local" value="Twofish.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Êàñêàäû øèôðîâ">
+            <param name="Local" value="Cascades.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Àëãîðèòìû õåøèðîâàíèÿ">
+        <param name="Local" value="Hash Algorithms.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="BLAKE2s-256">
+            <param name="Local" value="BLAKE2s-256.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="BLAKE2b-512">
+            <param name="Local" value="BLAKE2b-512.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="SHA-256">
+            <param name="Local" value="SHA-256.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="SHA-512">
+            <param name="Local" value="SHA-512.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Whirlpool">
+            <param name="Local" value="Whirlpool.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Streebog">
+            <param name="Local" value="Streebog.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Àëãîðèòìû ôîðìèðîâàíèÿ êëþ÷à">
+        <param name="Local" value="Key Derivation Algorithms.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Argon2id">
+            <param name="Local" value="Argon2id.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="PBKDF2">
+            <param name="Local" value="pbkdf2.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïîääåðæèâàåìûå îïåðàöèîííûå ñèñòåìû">
+        <param name="Local" value="Supported Operating Systems.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Èñïîëüçîâàíèå â êîìàíäíîé ñòðîêå">
+        <param name="Local" value="Command Line Usage.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ìîäåëü áåçîïàñíîñòè">
+        <param name="Local" value="Security Model.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Òðåáîâàíèÿ áåçîïàñíîñòè è ìåðû ïðåäîñòîðîæíîñòè">
+        <param name="Local" value="Security Requirements and Precautions.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Óòå÷êè äàííûõ">
+            <param name="Local" value="Data Leaks.html">
+            </OBJECT>
+        <UL>
+            <LI> <OBJECT type="text/sitemap">
+                <param name="Name" value="Ôàéë ïîäêà÷êè">
+                <param name="Local" value="Paging File.html">
+                </OBJECT>
+            <LI> <OBJECT type="text/sitemap">
+                <param name="Name" value="Ôàéëû äàìïà ïàìÿòè">
+                <param name="Local" value="Memory Dump Files.html">
+                </OBJECT>
+            <LI> <OBJECT type="text/sitemap">
+                <param name="Name" value="Ôàéë ãèáåðíàöèè">
+                <param name="Local" value="Hibernation File.html">
+                </OBJECT>
+        </UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Íåçàøèôðîâàííûå äàííûå â ÎÇÓ">
+            <param name="Local" value="Unencrypted Data in RAM.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Øèôðîâàíèå îïåðàòèâíîé ïàìÿòè â VeraCrypt">
+            <param name="Local" value="VeraCrypt RAM Encryption.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Çàùèòà ïàìÿòè â VeraCrypt">
+            <param name="Local" value="VeraCrypt Memory Protection.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ôèçè÷åñêàÿ áåçîïàñíîñòü">
+            <param name="Local" value="Physical Security.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Âðåäîíîñíîå ÏÎ (malware)">
+            <param name="Local" value="Malware.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ìíîãîïîëüçîâàòåëüñêàÿ ñðåäà">
+            <param name="Local" value="Multi-User Environment.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ïîäëèííîñòü è öåëîñòíîñòü äàííûõ">
+            <param name="Local" value="Authenticity and Integrity.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Âûáîð ïàðîëåé è êëþ÷åâûõ ôàéëîâ">
+            <param name="Local" value="Choosing Passwords and Keyfiles.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Èçìåíåíèå ïàðîëåé è êëþ÷åâûõ ôàéëîâ">
+            <param name="Local" value="Changing Passwords and Keyfiles.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Îïåðàöèÿ Trim">
+            <param name="Local" value="Trim Operation.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ðàñïðåäåëåíèå èçíîñà (Wear-Leveling)">
+            <param name="Local" value="Wear-Leveling.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ïåðåðàñïðåäåë¸ííûå ñåêòîðà">
+            <param name="Local" value="Reallocated Sectors.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Äåôðàãìåíòàöèÿ">
+            <param name="Local" value="Defragmenting.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Æóðíàëèðóåìûå ôàéëîâûå ñèñòåìû">
+            <param name="Local" value="Journaling File Systems.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Êëîíèðîâàíèå òîìîâ">
+            <param name="Local" value="Volume Clones.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Äîïîëíèòåëüíûå òðåáîâàíèÿ áåçîïàñíîñòè è ìåðû ïðåäîñòîðîæíîñòè">
+            <param name="Local" value="Additional Security Requirements and Precautions.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Î áåçîïàñíîì ðåçåðâíîì êîïèðîâàíèè">
+        <param name="Local" value="How to Back Up Securely.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ðàçíîå">
+        <param name="Local" value="Miscellaneous.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Èñïîëüçîâàíèå VeraCrypt áåç ïðàâ àäìèíèñòðàòîðà">
+            <param name="Local" value="Using VeraCrypt Without Administrator Privileges.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Îáùèé äîñòóï ïî ñåòè">
+            <param name="Local" value="Sharing over Network.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ðàáîòà VeraCrypt â ôîíîâîì ðåæèìå">
+            <param name="Local" value="VeraCrypt Background Task.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Òîì, ñìîíòèðîâàííûé êàê ñìåííûé íîñèòåëü">
+            <param name="Local" value="Removable Medium Volume.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñèñòåìíûå ôàéëû VeraCrypt è ïðîãðàììíûå äàííûå">
+            <param name="Local" value="VeraCrypt System Files.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Êàê óäàëèòü øèôðîâàíèå">
+            <param name="Local" value="Removing Encryption.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Óäàëåíèå VeraCrypt">
+            <param name="Local" value="Uninstalling VeraCrypt.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Öèôðîâûå ïîäïèñè">
+            <param name="Local" value="Digital Signatures.html">
+            </OBJECT>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Óñòðàíåíèå çàòðóäíåíèé">
+        <param name="Local" value="Troubleshooting.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Íåñîâìåñòèìîñòè">
+        <param name="Local" value="Incompatibilities.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Çàìå÷åííûå ïðîáëåìû è îãðàíè÷åíèÿ">
+        <param name="Local" value="Issues and Limitations.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Âîïðîñû è îòâåòû">
+        <param name="Local" value="FAQ.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Òåõíè÷åñêèå ïîäðîáíîñòè">
+        <param name="Local" value="Technical Details.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñèñòåìà îáîçíà÷åíèé">
+            <param name="Local" value="Notation.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñõåìà øèôðîâàíèÿ">
+            <param name="Local" value="Encryption Scheme.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ðåæèìû ðàáîòû">
+            <param name="Local" value="Modes of Operation.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ôîðìèðîâàíèå êëþ÷à çàãîëîâêà, ñîëü è êîëè÷åñòâî èòåðàöèé">
+            <param name="Local" value="Header Key Derivation.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ãåíåðàòîð ñëó÷àéíûõ ÷èñåë">
+            <param name="Local" value="Random Number Generator.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Êëþ÷åâûå ôàéëû">
+            <param name="Local" value="Keyfiles.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="PIM (Ïåðñîíàëüíûé ìíîæèòåëü èòåðàöèé)">
+            <param name="Local" value="Personal Iterations Multiplier (PIM).html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñïåöèôèêàöèÿ ôîðìàòà òîìîâ VeraCrypt">
+            <param name="Local" value="VeraCrypt Volume Format Specification.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñîîòâåòñòâèå ñòàíäàðòàì è ñïåöèôèêàöèÿì">
+            <param name="Local" value="Standard Compliance.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Èñõîäíûé êîä ïðîãðàììû">
+            <param name="Local" value="Source Code.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Ñáîðêà VeraCrypt èç èñõîäíîãî êîäà">
+            <param name="Local" value="CompilingGuidelines.html">
+            </OBJECT>
+        <UL>
+            <LI> <OBJECT type="text/sitemap">
+                <param name="Name" value="Ðóêîâîäñòâî ïî ñáîðêå â Windows">
+                <param name="Local" value="CompilingGuidelineWin.html">
+                </OBJECT>
+            <LI> <OBJECT type="text/sitemap">
+                <param name="Name" value="Ðóêîâîäñòâî ïî ñáîðêå â Linux">
+                <param name="Local" value="CompilingGuidelineLinux.html">
+                </OBJECT>
+        </UL>
+    </UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ñâÿçü ñ àâòîðàìè">
+        <param name="Local" value="Contact.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ïðàâîâàÿ èíôîðìàöèÿ">
+        <param name="Local" value="Legal Information.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Èñòîðèÿ âåðñèé">
+        <param name="Local" value="Release Notes.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Áëàãîäàðíîñòè">
+        <param name="Local" value="Acknowledgements.html">
+        </OBJECT>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="Ññûëêè">
+        <param name="Local" value="References.html">
+        </OBJECT>
+</UL>
+</BODY></HTML>

doc/chm/ru/VeraCrypt.ru.hhk

@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<HTML>
+<HEAD>
+<!-- Sitemap 1.0 -->
+</HEAD><BODY>
+<UL>
+<LI> <OBJECT type="text/sitemap">
+     <param name="Name" value="Äîêóìåíòàöèÿ">
+     <param name="Local" value="Documentation.html">
+     </OBJECT>
+
+</UL>
+</BODY></HTML>

doc/chm/ru/VeraCrypt.ru.hhp

@@ -0,0 +1,185 @@
+[OPTIONS]
+Compatibility=1.1 or later
+Compiled file=VeraCrypt User Guide.ru.chm
+Contents file=VeraCrypt.ru.hhc
+Default topic=Documentation.html
+Default Font=Tahoma,9,0
+Display compile progress=No
+Full-text search=Yes
+Index file=VeraCrypt.ru.hhk
+Language=0x419 Ðóññêèé(Ðîññèÿ)
+Title=Ðóêîâîäñòâî ïîëüçîâàòåëÿ VeraCrypt
+
+[FILES]
+Acknowledgements.html
+Additional Security Requirements and Precautions.html
+AES.html
+Argon2id.html
+arrow_right.gif
+Authenticity and Integrity.html
+Authors.html
+Avoid Third-Party File Extensions.html
+BC_Logo_30x30.png
+BCH_Logo_30x30.png
+Beginner's Tutorial.html
+Beginner's Tutorial_Image_001.png
+Beginner's Tutorial_Image_002.png
+Beginner's Tutorial_Image_003.png
+Beginner's Tutorial_Image_004.png
+Beginner's Tutorial_Image_005.png
+Beginner's Tutorial_Image_007.png
+Beginner's Tutorial_Image_008.png
+Beginner's Tutorial_Image_009.png
+Beginner's Tutorial_Image_010.png
+Beginner's Tutorial_Image_011.png
+Beginner's Tutorial_Image_012.png
+Beginner's Tutorial_Image_013.png
+Beginner's Tutorial_Image_014.png
+Beginner's Tutorial_Image_015.png
+Beginner's Tutorial_Image_016.png
+Beginner's Tutorial_Image_017.png
+Beginner's Tutorial_Image_018.png
+Beginner's Tutorial_Image_019.png
+Beginner's Tutorial_Image_020.png
+Beginner's Tutorial_Image_021.png
+Beginner's Tutorial_Image_022.png
+Beginner's Tutorial_Image_023.png
+Beginner's Tutorial_Image_024.png
+Beginner's Tutorial_Image_034.png
+BLAKE2s-256.html
+BLAKE2b-512.html
+Camellia.html
+Cascades.html
+Changing Passwords and Keyfiles.html
+Choosing Passwords and Keyfiles.html
+Command Line Usage.html
+CompilingGuidelineLinux.html
+CompilingGuidelines.html
+CompilingGuidelineWin.html
+Contact.html
+Contributed Resources.html
+Conversion_Guide_VeraCrypt_1.26_and_Later.html
+Converting TrueCrypt volumes and partitions.html
+Converting TrueCrypt volumes and partitions_truecrypt_convertion.png
+Creating New Volumes.html
+Data Leaks.html
+Default Mount Parameters.html
+Default Mount Parameters_VeraCrypt_password_using_default_parameters.png
+Defragmenting.html
+Digital Signatures.html
+Disclaimers.html
+Documentation.html
+EFISecureBoot.html
+Encryption Algorithms.html
+Encryption Scheme.html
+FAQ.html
+Favorite Volumes.html
+flattr-badge-large.png
+gf2_mul.gif
+Hardware Acceleration.html
+Hash Algorithms.html
+Header Key Derivation.html
+Hibernation File.html
+Hidden Operating System.html
+Hidden Volume.html
+Home_facebook_veracrypt.png
+Home_reddit.png
+Home_utilities-file-archiver-3.png
+Home_VeraCrypt_Default_Mount_Parameters.png
+Home_VeraCrypt_menu_Default_Mount_Parameters.png
+Hot Keys.html
+How to Back Up Securely.html
+Incompatibilities.html
+Introduction.html
+Issues and Limitations.html
+Journaling File Systems.html
+Key Derivation Algorithms.html
+Keyfiles in VeraCrypt.html
+Keyfiles in VeraCrypt_Image_040.png
+Keyfiles.html
+Kuznyechik.html
+Language Packs.html
+Legal Information.html
+liberapay_donate.svg
+LTC_Logo_30x30.png
+Main Program Window.html
+Malware.html
+mastodon_veracrypt.PNG
+Memory Dump Files.html
+Miscellaneous.html
+Modes of Operation.html
+Monero_Logo_30x30.png
+Mounting VeraCrypt Volumes.html
+Multi-User Environment.html
+Notation.html
+Paging File.html
+Parallelization.html
+paypal_30x30.png
+pbkdf2.html
+Personal Iterations Multiplier (PIM).html
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step2.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step2.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step2.png
+Physical Security.html
+Pipelining.html
+Plausible Deniability.html
+Portable Mode.html
+Preface.html
+Program Menu.html
+Protection of Hidden Volumes.html
+Protection of Hidden Volumes_Image_027.png
+Protection of Hidden Volumes_Image_028.png
+Protection of Hidden Volumes_Image_029.png
+Protection of Hidden Volumes_Image_030.png
+Protection of Hidden Volumes_Image_031.png
+Random Number Generator.html
+Reallocated Sectors.html
+References.html
+Release Notes.html
+Removable Medium Volume.html
+Removing Encryption.html
+Security Model.html
+Security Requirements and Precautions.html
+Security Requirements for Hidden Volumes.html
+Security Tokens & Smart Cards.html
+Serpent.html
+SHA-256.html
+SHA-512.html
+Sharing over Network.html
+Source Code.html
+Standard Compliance.html
+Streebog.html
+styles.css
+Supported Operating Systems.html
+Supported Systems for System Encryption.html
+System Encryption.html
+System Favorite Volumes.html
+Technical Details.html
+Trim Operation.html
+Troubleshooting.html
+TrueCrypt Support.html
+TrueCrypt Support_truecrypt_mode_gui.png
+twitter_veracrypt.PNG
+Twofish.html
+Unencrypted Data in RAM.html
+Uninstalling VeraCrypt.html
+Using VeraCrypt Without Administrator Privileges.html
+VeraCrypt Background Task.html
+VeraCrypt Hidden Operating System.html
+VeraCrypt License.html
+VeraCrypt Memory Protection.html
+VeraCrypt RAM Encryption.html
+VeraCrypt Rescue Disk.html
+VeraCrypt System Files.html
+VeraCrypt Volume Format Specification.html
+VeraCrypt Volume.html
+VeraCrypt128x128.png
+Volume Clones.html
+Wear-Leveling.html
+Whirlpool.html
+
+[INFOTYPES]
+

doc/chm/zh-cn/VeraCrypt.zh-cn.hhc

@@ -0,0 +1,471 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<HTML>
+<HEAD>
+<meta name="GENERATOR" content="Microsoft&reg; HTML Help Workshop 4.1">
+<!-- Sitemap 1.0 -->
+</HEAD><BODY>
+<UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="目录">
+		<param name="Local" value="Documentation.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="前言">
+		<param name="Local" value="Preface.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="简介">
+		<param name="Local" value="Introduction.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="初学者教程">
+		<param name="Local" value="Beginner's Tutorial.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="VeraCrypt卷">
+		<param name="Local" value="VeraCrypt Volume.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="创建新的VeraCrypt卷">
+			<param name="Local" value="Creating New Volumes.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="收藏卷">
+			<param name="Local" value="Favorite Volumes.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="系统收藏卷">
+			<param name="Local" value="System Favorite Volumes.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="系统加密">
+		<param name="Local" value="System Encryption.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="隐藏操作系统">
+			<param name="Local" value="Hidden Operating System.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="支持系统加密的操作系统">
+			<param name="Local" value="Supported Systems for System Encryption.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="EFI安全启动">
+			<param name="Local" value="EFISecureBoot.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt急救盘">
+			<param name="Local" value="VeraCrypt Rescue Disk.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="合理否认">
+		<param name="Local" value="Plausible Deniability.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="隐藏卷">
+			<param name="Local" value="Hidden Volume.html">
+			</OBJECT>
+		<UL>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="隐藏卷防损坏保护">
+				<param name="Local" value="Protection of Hidden Volumes.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="隐藏卷的安全要求和注意事项">
+				<param name="Local" value="Security Requirements for Hidden Volumes.html">
+				</OBJECT>
+		</UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="隐藏操作系统">
+			<param name="Local" value="VeraCrypt Hidden Operating System.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="主程序窗口">
+		<param name="Local" value="Main Program Window.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="程序菜单">
+			<param name="Local" value="Program Menu.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="挂载卷">
+			<param name="Local" value="Mounting VeraCrypt Volumes.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="正常卸载与强制卸载">
+		<param name="Local" value="Normal Unmount vs Force Unmount.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="避免使用第三方文件扩展名">
+		<param name="Local" value="Avoid Third-Party File Extensions.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="并行处理">
+		<param name="Local" value="Parallelization.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="流水线处理">
+		<param name="Local" value="Pipelining.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="硬件加速">
+		<param name="Local" value="Hardware Acceleration.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="热键">
+		<param name="Local" value="Hot Keys.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="密钥文件">
+		<param name="Local" value="Keyfiles in VeraCrypt.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="安全令牌和智能卡">
+		<param name="Local" value="Security Tokens & Smart Cards.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="便携模式">
+		<param name="Local" value="Portable Mode.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="TrueCrypt支持">
+		<param name="Local" value="TrueCrypt Support.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="转换TrueCrypt卷和分区">
+		<param name="Local" value="Converting TrueCrypt volumes and partitions.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="1.26及更高版本转换指南">
+		<param name="Local" value="Conversion_Guide_VeraCrypt_1.26_and_Later.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="默认挂载参数">
+		<param name="Local" value="Default Mount Parameters.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="语言包">
+		<param name="Local" value="Language Packs.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="加密算法">
+		<param name="Local" value="Encryption Algorithms.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="AES">
+			<param name="Local" value="AES.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Camellia">
+			<param name="Local" value="Camellia.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Kuznyechik">
+			<param name="Local" value="Kuznyechik.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Serpent">
+			<param name="Local" value="Serpent.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Twofish">
+			<param name="Local" value="Twofish.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="密码级联">
+			<param name="Local" value="Cascades.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="哈希算法">
+		<param name="Local" value="Hash Algorithms.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="BLAKE2s-256">
+			<param name="Local" value="BLAKE2s-256.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="BLAKE2b-512">
+			<param name="Local" value="BLAKE2b-512.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="SHA-256">
+			<param name="Local" value="SHA-256.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="SHA-512">
+			<param name="Local" value="SHA-512.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Whirlpool">
+			<param name="Local" value="Whirlpool.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Streebog">
+			<param name="Local" value="Streebog.html">
+			</OBJECT>
+	</UL>
+    <LI> <OBJECT type="text/sitemap">
+        <param name="Name" value="密钥推导算法">
+        <param name="Local" value="Key Derivation Algorithms.html">
+        </OBJECT>
+    <UL>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="Argon2id">
+            <param name="Local" value="Argon2id.html">
+            </OBJECT>
+        <LI> <OBJECT type="text/sitemap">
+            <param name="Name" value="PBKDF2">
+            <param name="Local" value="pbkdf2.html">
+            </OBJECT>
+    </UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="支持的操作系统">
+		<param name="Local" value="Supported Operating Systems.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="命令行用法">
+		<param name="Local" value="Command Line Usage.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="安全模型">
+		<param name="Local" value="Security Model.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="安全要求和注意事项">
+		<param name="Local" value="Security Requirements and Precautions.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="数据泄露">
+			<param name="Local" value="Data Leaks.html">
+			</OBJECT>
+		<UL>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="分页文件">
+				<param name="Local" value="Paging File.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="内存转储文件">
+				<param name="Local" value="Memory Dump Files.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="休眠文件">
+				<param name="Local" value="Hibernation File.html">
+				</OBJECT>
+		</UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="RAM中的未加密数据">
+			<param name="Local" value="Unencrypted Data in RAM.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt RAM加密">
+			<param name="Local" value="VeraCrypt RAM Encryption.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt内存保护">
+			<param name="Local" value="VeraCrypt Memory Protection.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="物理安全">
+			<param name="Local" value="Physical Security.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="恶意软件">
+			<param name="Local" value="Malware.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="多用户环境">
+			<param name="Local" value="Multi-User Environment.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="真实性和完整性">
+			<param name="Local" value="Authenticity and Integrity.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="选择密码和密钥文件">
+			<param name="Local" value="Choosing Passwords and Keyfiles.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="更改密码和密钥文件">
+			<param name="Local" value="Changing Passwords and Keyfiles.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="Trim操作">
+			<param name="Local" value="Trim Operation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="磨损均衡">
+			<param name="Local" value="Wear-Leveling.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="重新分配扇区">
+			<param name="Local" value="Reallocated Sectors.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="碎片整理">
+			<param name="Local" value="Defragmenting.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="日志文件系统">
+			<param name="Local" value="Journaling File Systems.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="卷克隆">
+			<param name="Local" value="Volume Clones.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="附加安全要求和注意事项">
+			<param name="Local" value="Additional Security Requirements and Precautions.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="如何安全备份">
+		<param name="Local" value="How to Back Up Securely.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="杂项">
+		<param name="Local" value="Miscellaneous.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="无需管理员权限使用VeraCrypt">
+			<param name="Local" value="Using VeraCrypt Without Administrator Privileges.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="网络共享">
+			<param name="Local" value="Sharing over Network.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt后台任务">
+			<param name="Local" value="VeraCrypt Background Task.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="作为可移动介质挂载的卷">
+			<param name="Local" value="Removable Medium Volume.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt系统文件和应用数据">
+			<param name="Local" value="VeraCrypt System Files.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="如何移除加密">
+			<param name="Local" value="Removing Encryption.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="卸载VeraCrypt">
+			<param name="Local" value="Uninstalling VeraCrypt.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="数字签名">
+			<param name="Local" value="Digital Signatures.html">
+			</OBJECT>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="故障排除">
+		<param name="Local" value="Troubleshooting.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="不兼容问题">
+		<param name="Local" value="Incompatibilities.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="已知问题和限制">
+		<param name="Local" value="Issues and Limitations.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="常见问题解答">
+		<param name="Local" value="FAQ.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="技术细节">
+		<param name="Local" value="Technical Details.html">
+		</OBJECT>
+	<UL>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="符号表示">
+			<param name="Local" value="Notation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="加密方案">
+			<param name="Local" value="Encryption Scheme.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="操作模式">
+			<param name="Local" value="Modes of Operation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="头部密钥派生、盐和迭代次数">
+			<param name="Local" value="Header Key Derivation.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="随机数生成器">
+			<param name="Local" value="Random Number Generator.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="密钥文件">
+			<param name="Local" value="Keyfiles.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="PIM（个人迭代乘数）">
+			<param name="Local" value="Personal Iterations Multiplier (PIM).html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="VeraCrypt卷格式规范">
+			<param name="Local" value="VeraCrypt Volume Format Specification.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="标准合规性">
+			<param name="Local" value="Standard Compliance.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="源代码">
+			<param name="Local" value="Source Code.html">
+			</OBJECT>
+		<LI> <OBJECT type="text/sitemap">
+			<param name="Name" value="从源代码构建VeraCrypt">
+			<param name="Local" value="CompilingGuidelines.html">
+			</OBJECT>
+		<UL>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Windows构建指南">
+				<param name="Local" value="CompilingGuidelineWin.html">
+				</OBJECT>
+			<LI> <OBJECT type="text/sitemap">
+				<param name="Name" value="Linux构建指南">
+				<param name="Local" value="CompilingGuidelineLinux.html">
+				</OBJECT>
+		</UL>
+	</UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="联系我们">
+		<param name="Local" value="Contact.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="法律信息">
+		<param name="Local" value="Legal Information.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="版本历史">
+		<param name="Local" value="Release Notes.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="致谢">
+		<param name="Local" value="Acknowledgements.html">
+		</OBJECT>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="参考文献">
+		<param name="Local" value="References.html">
+		</OBJECT>
+</UL>
+</BODY></HTML>

doc/chm/zh-cn/VeraCrypt.zh-cn.hhk

@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<HTML>
+<HEAD>
+<meta name="GENERATOR" content="Microsoft&reg; HTML Help Workshop 4.1">
+<!-- Sitemap 1.0 -->
+</HEAD><BODY>
+<UL>
+	<LI> <OBJECT type="text/sitemap">
+		<param name="Name" value="Ŀ¼±í">
+		<param name="Local" value="Documentation.html">
+		</OBJECT>
+</UL>
+</BODY></HTML>

doc/chm/zh-cn/VeraCrypt.zh-cn.hhp

@@ -0,0 +1,186 @@
+[OPTIONS]
+Compatibility=1.1 or later
+Compiled file=VeraCrypt User Guide.zh-cn.chm
+Contents file=VeraCrypt.zh-cn.hhc
+Default Font=微软雅黑,9,0
+Default topic=Documentation.html
+Display compile progress=No
+Full-text search=Yes
+Index file=VeraCrypt.zh-cn.hhk
+Language=0x804 中文(简体，中国)
+Title=VeraCrypt用户指南
+
+
+[FILES]
+Acknowledgements.html
+Additional Security Requirements and Precautions.html
+AES.html
+Argon2id.html
+arrow_right.gif
+Authenticity and Integrity.html
+Authors.html
+Avoid Third-Party File Extensions.html
+BC_Logo_30x30.png
+BCH_Logo_30x30.png
+Beginner's Tutorial.html
+Beginner's Tutorial_Image_001.jpg
+Beginner's Tutorial_Image_002.jpg
+Beginner's Tutorial_Image_003.jpg
+Beginner's Tutorial_Image_004.jpg
+Beginner's Tutorial_Image_005.jpg
+Beginner's Tutorial_Image_007.jpg
+Beginner's Tutorial_Image_008.jpg
+Beginner's Tutorial_Image_009.jpg
+Beginner's Tutorial_Image_010.jpg
+Beginner's Tutorial_Image_011.jpg
+Beginner's Tutorial_Image_012.jpg
+Beginner's Tutorial_Image_013.jpg
+Beginner's Tutorial_Image_014.jpg
+Beginner's Tutorial_Image_015.jpg
+Beginner's Tutorial_Image_016.jpg
+Beginner's Tutorial_Image_017.jpg
+Beginner's Tutorial_Image_018.jpg
+Beginner's Tutorial_Image_019.jpg
+Beginner's Tutorial_Image_020.jpg
+Beginner's Tutorial_Image_021.jpg
+Beginner's Tutorial_Image_022.jpg
+Beginner's Tutorial_Image_023.gif
+Beginner's Tutorial_Image_024.gif
+Beginner's Tutorial_Image_034.png
+BLAKE2s-256.html
+BLAKE2b-512.html
+Camellia.html
+Cascades.html
+Changing Passwords and Keyfiles.html
+Choosing Passwords and Keyfiles.html
+Command Line Usage.html
+CompilingGuidelineLinux.html
+CompilingGuidelines.html
+CompilingGuidelineWin.html
+Contact.html
+Contributed Resources.html
+Conversion_Guide_VeraCrypt_1.26_and_Later.html
+Converting TrueCrypt volumes and partitions.html
+Converting TrueCrypt volumes and partitions_truecrypt_convertion.jpg
+Creating New Volumes.html
+Data Leaks.html
+Default Mount Parameters.html
+Default Mount Parameters_VeraCrypt_password_using_default_parameters.png
+Defragmenting.html
+Digital Signatures.html
+Disclaimers.html
+Documentation.html
+EFISecureBoot.html
+Encryption Algorithms.html
+Encryption Scheme.html
+FAQ.html
+Favorite Volumes.html
+flattr-badge-large.png
+gf2_mul.gif
+Hardware Acceleration.html
+Hash Algorithms.html
+Header Key Derivation.html
+Hibernation File.html
+Hidden Operating System.html
+Hidden Volume.html
+Home_facebook_veracrypt.png
+Home_reddit.png
+Home_utilities-file-archiver-3.png
+Home_VeraCrypt_Default_Mount_Parameters.png
+Home_VeraCrypt_menu_Default_Mount_Parameters.png
+Hot Keys.html
+How to Back Up Securely.html
+Incompatibilities.html
+Introduction.html
+Issues and Limitations.html
+Journaling File Systems.html
+Key Derivation Algorithms.html
+Keyfiles in VeraCrypt.html
+Keyfiles in VeraCrypt_Image_040.gif
+Keyfiles.html
+Kuznyechik.html
+Language Packs.html
+Legal Information.html
+liberapay_donate.svg
+LTC_Logo_30x30.png
+Main Program Window.html
+Malware.html
+mastodon_veracrypt.PNG
+Memory Dump Files.html
+Miscellaneous.html
+Modes of Operation.html
+Monero_Logo_30x30.png
+Mounting VeraCrypt Volumes.html
+Multi-User Environment.html
+Notation.html
+Paging File.html
+Parallelization.html
+paypal_30x30.png
+pbkdf2.html
+Personal Iterations Multiplier (PIM).html
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_Step2.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_ChangePIM_System_Step2.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step1.png
+Personal Iterations Multiplier (PIM)_VeraCrypt_UsePIM_Step2.png
+Physical Security.html
+Pipelining.html
+Plausible Deniability.html
+Portable Mode.html
+Preface.html
+Program Menu.html
+Protection of Hidden Volumes.html
+Protection of Hidden Volumes_Image_027.jpg
+Protection of Hidden Volumes_Image_028.jpg
+Protection of Hidden Volumes_Image_029.jpg
+Protection of Hidden Volumes_Image_030.jpg
+Protection of Hidden Volumes_Image_031.jpg
+Random Number Generator.html
+Reallocated Sectors.html
+References.html
+Release Notes.html
+Removable Medium Volume.html
+Removing Encryption.html
+Security Model.html
+Security Requirements and Precautions.html
+Security Requirements for Hidden Volumes.html
+Security Tokens & Smart Cards.html
+Serpent.html
+SHA-256.html
+SHA-512.html
+Sharing over Network.html
+Source Code.html
+Standard Compliance.html
+Streebog.html
+styles.css
+Supported Operating Systems.html
+Supported Systems for System Encryption.html
+System Encryption.html
+System Favorite Volumes.html
+Technical Details.html
+Trim Operation.html
+Troubleshooting.html
+TrueCrypt Support.html
+TrueCrypt Support_truecrypt_mode_gui.jpg
+twitter_veracrypt.PNG
+Twofish.html
+Unencrypted Data in RAM.html
+Uninstalling VeraCrypt.html
+Using VeraCrypt Without Administrator Privileges.html
+VeraCrypt Background Task.html
+VeraCrypt Hidden Operating System.html
+VeraCrypt License.html
+VeraCrypt Memory Protection.html
+VeraCrypt RAM Encryption.html
+VeraCrypt Rescue Disk.html
+VeraCrypt System Files.html
+VeraCrypt Volume Format Specification.html
+VeraCrypt Volume.html
+VeraCrypt128x128.png
+Volume Clones.html
+Wear-Leveling.html
+Whirlpool.html
+
+[INFOTYPES]
+

doc/html/en/AES.html

@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Encryption%20Algorithms.html">Encryption Algorithms</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="AES.html">AES</a>
+</p></div>
+
+<div class="wikidoc">
+<h1>AES</h1>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+The Advanced Encryption Standard (AES) specifies a FIPS-approved cryptographic algorithm (Rijndael, designed by Joan Daemen and Vincent Rijmen, published in 1998) that may be used by US federal departments and agencies to cryptographically protect sensitive
+ information [3]. VeraCrypt uses AES with 14 rounds and a 256-bit key (i.e., AES-256, published in 2001) operating in
+<a href="Modes%20of%20Operation.html" style="text-align:left; color:#0080c0; text-decoration:none">
+XTS mode</a> (see the section <a href="Modes%20of%20Operation.html" style="text-align:left; color:#0080c0; text-decoration:none">
+Modes of Operation</a>).</div>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+In June 2003, after the NSA (US National Security Agency) conducted a review and analysis of AES, the U.S. CNSS (Committee on National Security Systems) announced in [1] that the design and strength of AES-256 (and AES-192) are sufficient to protect classified
+ information up to the Top Secret level. This is applicable to all U.S. Government Departments or Agencies that are considering the acquisition or use of products incorporating the Advanced Encryption Standard (AES) to satisfy Information Assurance requirements
+ associated with the protection of national security systems and/or national security information [1].</div>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<a href="Camellia.html" style="text-align:left; color:#0080c0; text-decoration:none; font-weight:bold">Next Section &gt;&gt;</a></div>
+</div><div class="ClearBoth"></div></body></html>

doc/html/en/Acknowledgements.html

@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Acknowledgements.html">Acknowledgements</a>
+</p></div>
+<div class="wikidoc">
+<div>
+<h1>Acknowledgements</h1>
+<p>We would like to thank the following people:</p>
+<p>The TrueCrypt Developers team who have done an amazing job over the course of 10 years. Without their hard work, VeraCrypt would not exist today.</p>
+<p>Paul Le Roux for making his E4M source code available. TrueCrypt 1.0 was derived from E4M and some parts of the E4M source code are still incorporated in the latest version of the TrueCrypt source code.</p>
+<p>Brian Gladman, who wrote the excellent AES, Twofish, and SHA-512 routines.</p>
+<p>Peter Gutmann for his paper on random numbers, and for creating his cryptlib, which was the source of parts of the random number generator source code.</p>
+<p>Wei Dai, who wrote the Serpent and RIPEMD-160 and Whirlpool routines.</p>
+<p>Tom St Denis, the author of LibTomCrypt which includes compact SHA-256 routines.</p>
+<p>Mark Adler and Jean-loup Gailly, who wrote the zlib library.</p>
+<p>The designers of the encryption algorithms, hash algorithms, and the mode of operation:</p>
+<p>Horst Feistel, Don Coppersmith, Walt Tuchmann, Lars Knudsen, Ross Anderson, Eli Biham, Bruce Schneier, David Wagner, John Kelsey, Niels Ferguson, Doug Whiting, Chris Hall, Joan Daemen, Vincent Rijmen, Carlisle Adams, Stafford Tavares, Phillip Rogaway, Hans
+ Dobbertin, Antoon Bosselaers, Bart Preneel, Paulo S. L. M. Barreto.</p>
+<p>Andreas Becker for designing VeraCrypt logo and icons.</p>
+<p>Xavier de Carn&eacute; de Carnavalet who proposed a speed optimization for PBKDF2 that reduced mount/boot time by half.</p>
+<p>kerukuro for cppcrypto library (http://cppcrypto.sourceforge.net/) from which Kuznyechik cipher implementation was taken.</p>
+<p><br>
+Dieter Baron and Thomas Klausner who wrote the libzip library.</p>
+<p><br>
+Jack Lloyd who wrote the SIMD optimized Serpent implementation.</p>
+<p>All the others who have made this project possible, all who have morally supported us, and all who sent us bug reports or suggestions for improvements.</p>
+<p>Thank you very much.</p>
+</div>
+</div><div class="ClearBoth"></div></body></html>

doc/html/en/Additional Security Requirements and Precautions.html

@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Security%20Requirements%20and%20Precautions.html">Security Requirements and Precautions</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Additional%20Security%20Requirements%20and%20Precautions.html">Additional Security Requirements and Precautions</a>
+</p></div>
+
+<div class="wikidoc">
+<div>
+<h1>Additional Security Requirements and Precautions</h1>
+<p>In addition to the requirements and precautions described in this chapter (<a href="Security%20Requirements%20and%20Precautions.html"><em>Security Requirements and Precautions</em></a>), you must follow and keep in
+ mind the security requirements, precautions, and limitations listed in the following chapters and sections:</p>
+<ul>
+<li><a href="How%20to%20Back%20Up%20Securely.html"><em><strong>How to Back Up Securely</strong></em></a>
+</li><li><a href="Issues%20and%20Limitations.html"><em><strong>Limitations</strong></em></a>
+</li><li><a href="Security%20Model.html"><em><strong>Security Model</strong></em></a>
+</li><li><a href="Security%20Requirements%20for%20Hidden%20Volumes.html"><em><strong>Security Requirements and Precautions Pertaining to Hidden Volumes</strong></em></a>
+</li><li><a href="Plausible%20Deniability.html"><em><strong>Plausible Deniability</strong></em></a>
+</li></ul>
+<p>See also: <a href="Digital%20Signatures.html">
+<em>Digital Signatures</em></a></p>
+</div>
+</div><div class="ClearBoth"></div></body></html>

doc/html/en/Argon2id.html

@@ -0,0 +1,174 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+    <ul>
+      <li><a href="Home.html">Home</a></li>
+      <li><a href="Code.html">Source Code</a></li>
+      <li><a href="Downloads.html">Downloads</a></li>
+      <li><a class="active" href="Documentation.html">Documentation</a></li>
+      <li><a href="Donation.html">Donate</a></li>
+      <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+    </ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Key%20Derivation%20Algorithms.html">Key Derivation Algorithms</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Argon2id.html">Argon2id</a>
+</p></div>
+
+<div class="wikidoc">
+<h1>Argon2id</h1>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+Argon2id is a memory-hard key derivation function designed to resist both time-memory trade-off attacks and side-channel attacks. It was selected as the winner of the Password Hashing Competition (PHC) in 2015 and is defined in RFC 9106. VeraCrypt supports Argon2id as an alternative to PBKDF2-HMAC for non-system volume header key derivation.
+</div>
+
+<h3>Key Features</h3>
+<ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Memory-hard:</strong> Requires a configurable amount of memory, making it resistant to specialized hardware attacks
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Side-channel resistant:</strong> Combines data-dependent and data-independent memory access patterns
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Internal hash function:</strong> Uses <a href="BLAKE2b-512.html" style="color:#0080c0; text-decoration:none">BLAKE2b-512</a> internally, eliminating the need for separate hash algorithm selection
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Tunable parameters:</strong> Allows adjustment of memory cost, time cost, and parallelism
+</li>
+</ul>
+
+<h3>Argon2 Variants</h3>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+Argon2 has three variants:
+</div>
+<ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Argon2d:</strong> Uses data-dependent memory access, resistant to time-memory trade-off attacks but vulnerable to side-channel attacks
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Argon2i:</strong> Uses data-independent memory access, resistant to side-channel attacks but more vulnerable to time-memory trade-off attacks
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Argon2id:</strong> Hybrid approach that combines both variants, providing resistance to both attack types (used by VeraCrypt)
+</li>
+</ul>
+
+<h3>Parameters in VeraCrypt</h3>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+VeraCrypt uses Argon2id with the following parameter configuration:
+</div>
+
+<h4>Memory Cost (m_cost)</h4>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+The amount of memory used during the key derivation process, controlled by the PIM value:
+</div>
+<ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Formula:</strong> m_cost(pim) = min(64 MiB + (pim - 1) × 32 MiB, 1024 MiB)
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Range:</strong> 64 MiB to 1024 MiB (capped at PIM = 31)
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Default:</strong> 416 MiB (equivalent to PIM = 12)
+</li>
+</ul>
+
+<h4>Time Cost (t_cost)</h4>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+The number of iterations performed during the key derivation process:
+</div>
+<ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>For PIM ≤ 31:</strong> t_cost(pim) = 3 + floor((pim - 1) / 3)
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>For PIM > 31:</strong> t_cost(pim) = 13 + (pim - 31)
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Default:</strong> 6 iterations (equivalent to PIM = 12)
+</li>
+</ul>
+
+<h4>Parallelism</h4>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+The number of parallel threads used during computation:
+</div>
+<ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Value:</strong> Fixed at 1 thread for all cases in VeraCrypt
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Rationale:</strong> Ensures consistent behavior across different hardware configurations
+</li>
+</ul>
+
+<h3>Advantages over PBKDF2</h3>
+<ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Memory hardness:</strong> Requires significant memory allocation, making GPU and ASIC attacks more expensive
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Modern design:</strong> Specifically designed to resist contemporary attack methods
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Side-channel resistance:</strong> Built-in protections against cache-timing and other side-channel attacks
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Standardization:</strong> Officially standardized in RFC 9106
+</li>
+</ul>
+
+<h3>Usage Considerations</h3>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+When using Argon2id in VeraCrypt:
+</div>
+<ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Memory requirements:</strong> Ensure sufficient RAM is available, especially with higher PIM values
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Performance:</strong> Higher memory costs may result in slower mounting times but provide better security
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>Compatibility:</strong> Available in VeraCrypt versions that support multiple key derivation functions
+</li>
+<li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+<strong>No hash selection:</strong> Unlike PBKDF2-HMAC, no separate hash algorithm needs to be chosen
+</li>
+</ul>
+
+<h3>Technical Specifications</h3>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<strong>Algorithm:</strong> Argon2id as defined in RFC 9106<br/>
+<strong>Internal hash:</strong> <a href="BLAKE2b-512.html" style="color:#0080c0; text-decoration:none">BLAKE2b-512</a><br/>
+<strong>Salt size:</strong> 512 bits (same as PBKDF2-HMAC)<br/>
+<strong>Header KDF output length:</strong> Fixed at 1536 bits (192 bytes) for the current VeraCrypt format. The required prefix is used for the selected encryption algorithm (for example, the first 64 bytes for AES (AES-256-XTS)). Third-party implementations must request 192 bytes from Argon2id before selecting the required prefix; requesting only the selected algorithm's key material length produces a different Argon2id output.<br/>
+<strong>Version:</strong> Argon2 version 0x13 (19 decimal)
+</div>
+
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+For more information about PIM values and their effect on Argon2id parameters, see the 
+<a href="Personal%20Iterations%20Multiplier%20%28PIM%29.html" style="text-align:left; color:#0080c0; text-decoration:none">
+Personal Iterations Multiplier (PIM)</a> section.
+</div>
+
+</div><div class="ClearBoth"></div></body></html>

doc/html/en/Authenticity and Integrity.html

@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Security%20Requirements%20and%20Precautions.html">Security Requirements and Precautions</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Authenticity%20and%20Integrity.html">Authenticity and Integrity</a>
+</p></div>
+
+<div class="wikidoc">
+<div>
+<h1>Authenticity and Integrity</h1>
+<p>VeraCrypt uses encryption to preserve the <em>confidentiality</em> of data it encrypts. VeraCrypt neither preserves nor verifies the integrity or authenticity of data it encrypts or decrypts. Hence, if you allow an adversary to modify data encrypted by VeraCrypt,
+ he can set the value of any 16-byte block of the data to a random value or to a previous value, which he was able to obtain in the past. Note that the adversary cannot choose the value that you will obtain when VeraCrypt decrypts the modified block &mdash;
+ the value will be random &mdash; unless the attacker restores an older version of the encrypted block, which he was able to obtain in the past. It is your responsibility to verify the integrity and authenticity of data encrypted or decrypted by VeraCrypt (for
+ example, by using appropriate third-party software).<br>
+<br>
+See also: <a href="Physical%20Security.html">
+<em>Physical Security</em></a>, <a href="Security%20Model.html">
+<em>Security Model</em></a></p>
+</div>
+</div><div class="ClearBoth"></div></body></html>

doc/html/en/Authors.html

@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="VeraCrypt%20Volume.html">VeraCrypt Volume</a>
+</p></div>
+
+<div class="wikidoc">
+<h2>Authors</h2>
+<p>Mounir IDRASSI (<a href="https://amcrypto.jp" target="_blank">AM Crypto</a>, <a href="https://www.linkedin.com/in/idrassi" target="_blank">
+https://www.linkedin.com/in/idrassi</a>) is the creator and main developer of VeraCrypt. He managed all development and deployment aspects on all supported platforms (Windows,Linux and OSX).</p>
+<p>Alex Kolotnikov (<a href="https://ru.linkedin.com/in/alex-kolotnikov-6625568b" target="_blank">https://ru.linkedin.com/in/alex-kolotnikov-6625568b</a>) is the author of VeraCrypt EFI bootloader. He manages all aspects of EFI support and his strong expertise
+ helps bring new exciting features to VeraCrypt Windows system encryption.</p>
+<p>&nbsp;</p>
+</div><div class="ClearBoth"></div></body></html>

doc/html/en/Avoid Third-Party File Extensions.html

@@ -0,0 +1,84 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Avoid%20Third-Party%20File%20Extensions.html">Avoid Third-Party File Extensions</a>
+</p></div>
+
+<div class="wikidoc">
+	<h1>Understanding the Risks of Using Third-Party File Extensions with VeraCrypt</h1>
+	<div>
+	  <p>While VeraCrypt provides robust encryption capabilities to secure your data, using third-party file extensions for File Containers or Keyfiles could risk making the encrypted data inaccessible.<br />
+	  This guide provides an in-depth explanation of the associated risks, and it outlines recommendations for best practices to mitigate these risks.</p>
+	</div>
+	
+	<h2>Risks Associated with File Containers</h2>
+	<div>
+	  <p>Using a third-party file extension for File Containers exposes you to several risks:</p>
+	  <ul>
+		<li>Overwritten Metadata: Third-party applications may update their metadata, which could overwrite crucial parts of the File Container.</li>
+		<li>Unintentional Changes: Accidentally launching a File Container with a third-party application could modify its metadata without your consent.</li>
+		<li>Container Corruption: These actions could render the container unreadable or unusable.</li>
+		<li>Data Loss: The data within the container might be permanently lost if the container becomes corrupted.</li>
+	  </ul>
+	</div>
+	
+	<h2>Risks Associated with Keyfiles</h2>
+	<div>
+	  <p>Similar risks are associated with Keyfiles:</p>
+	  <ul>
+		<li>Keyfile Corruption: Inadvertently modifying a Keyfile with a third-party application can make it unusable for decryption.</li>
+		<li>Overwritten Data: Third-party applications may overwrite the portion of the Keyfile that VeraCrypt uses for decryption.</li>
+		<li>Unintentional Changes: Accidental changes can make it impossible to mount the volume unless you have an unaltered backup of the Keyfile.</li>
+	  </ul>
+	</div>
+	
+	<h2>Examples of Extensions to Avoid</h2>
+	<div>
+	  <p>Avoid using the following types of third-party file extensions:</p>
+	  <ul>
+		<li>Media Files: Picture, audio, and video files are subject to metadata changes by their respective software.</li>
+		<li>Archive Files: Zip files can be easily modified, which could disrupt the encrypted volume.</li>
+		<li>Executable Files: Software updates can modify these files, making them unreliable as File Containers or Keyfiles.</li>
+		<li>Document Files: Office and PDF files can be automatically updated by productivity software, making them risky to use.</li>
+	  </ul>
+	</div>
+	
+	<h2>Recommendations</h2>
+	<div>
+	  <p>For secure usage, consider the following best practices:</p>
+	  <ul>
+		<li>Use neutral file extensions for File Containers and Keyfiles to minimize the risk of automatic file association.</li>
+		<li>Keep secure backups of your File Containers and Keyfiles in locations isolated from network access.</li>
+		<li>Disable auto-open settings for the specific file extensions you use for VeraCrypt File Containers and Keyfiles.</li>
+		<li>Always double-check file associations and be cautious when using a new device or third-party application.</li>
+	  </ul>
+	</div>
+	
+<div class="ClearBoth"></div></div></body></html>

doc/html/en/BLAKE2b-512.html

@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Hash%20Algorithms.html">Hash Algorithms</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="BLAKE2b-512.html">BLAKE2b-512</a>
+</p></div>
+
+<div class="wikidoc">
+<h1>BLAKE2b-512</h1>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<p>
+BLAKE2b is the 64-bit-word variant of BLAKE2 and the successor of BLAKE-512. BLAKE2b and BLAKE2s are specified in RFC 7693.
+</p>
+<p>
+VeraCrypt uses BLAKE2b with its maximum output size of 64 bytes (512 bits) internally in <a href="Argon2id.html" style="text-align:left; color:#0080c0; text-decoration:none">Argon2id</a>. For non-system volume header key derivation, BLAKE2b-512 is reached by selecting the Argon2 key derivation algorithm in VeraCrypt; this corresponds to Argon2id internally. In hash-oriented contexts such as random pool mixing and keyfile generation, the same underlying hash may be displayed as BLAKE2b-512.
+</p>
+<p>
+BLAKE2b-512 is not offered as a separate PBKDF2-HMAC hash algorithm. To use BLAKE2b-512 in VeraCrypt non-system volume header key derivation, select <a href="Argon2id.html" style="text-align:left; color:#0080c0; text-decoration:none">Argon2id</a>; no separate hash algorithm selection is available for Argon2id.
+</p>
+</div>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<a href="SHA-256.html" style="text-align:left; color:#0080c0; text-decoration:none; font-weight:bold">Next Section &gt;&gt;</a></div>
+</div><div class="ClearBoth"></div></body></html>

doc/html/en/BLAKE2s-256.html

@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
+<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
+<meta name="keywords" content="encryption, security"/>
+<link href="styles.css" rel="stylesheet" type="text/css" />
+</head>
+<body>
+
+<div>
+<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
+</div>
+
+<div id="menu">
+	<ul>
+	  <li><a href="Home.html">Home</a></li>
+	  <li><a href="Code.html">Source Code</a></li>
+	  <li><a href="Downloads.html">Downloads</a></li>
+	  <li><a class="active" href="Documentation.html">Documentation</a></li>
+	  <li><a href="Donation.html">Donate</a></li>
+	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
+	</ul>
+</div>
+
+<div>
+<p>
+<a href="Documentation.html">Documentation</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="Hash%20Algorithms.html">Hash Algorithms</a>
+<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
+<a href="BLAKE2s-256.html">BLAKE2s-256</a>
+</p></div>
+
+<div class="wikidoc">
+<h1>BLAKE2s-256</h1>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<p>
+BLAKE2 is a cryptographic hash function based on BLAKE, created by Jean-Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian Winnerlein. It was announced on December 21, 2012. The design goal was to replace the widely used, but broken, MD5 and SHA-1 algorithms in applications requiring high performance in software. BLAKE2 provides better security than SHA-2 and similar to that of SHA-3 (e.g. immunity to length extension, indifferentiability from a random oracle, etc...).<br/>
+BLAKE2 removes addition of constants to message words from BLAKE round function, changes two rotation constants, simplifies padding, adds parameter block that is XOR'ed with initialization vectors, and reduces the number of rounds from 16 to 12 for BLAKE2b (successor of BLAKE-512), and from 14 to 10 for BLAKE2s (successor of BLAKE-256).<br/>
+BLAKE2b and BLAKE2s are specified in RFC 7693.
+</p>
+<p>
+VeraCrypt uses BLAKE2s with its maximum output size of 32 bytes (256 bits) as a PBKDF2-HMAC hash algorithm. For Argon2id, VeraCrypt uses <a href="BLAKE2b-512.html" style="text-align:left; color:#0080c0; text-decoration:none">BLAKE2b-512</a> internally.
+</p>
+</div>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+<a href="BLAKE2b-512.html" style="text-align:left; color:#0080c0; text-decoration:none; font-weight:bold">Next Section &gt;&gt;</a></div>
+</div><div class="ClearBoth"></div></body></html>