Friday, January 27, 2017

data recovery - Recover Bitlocker Protected External Hard Disk


While trying to create a bootable USB drive using WinToFlash, I accidentally selected an external hard drive with important data.


The process did not complete but, The bitlocker encryption doesnt seem to be on the drive now. (It doesnt ask for the password)


This is how the data is shown when the hard drive is plugged in.


enter image description here


I tried EaseUS recovery although the scan only gives a bunch of SWF files.


I need to figure out a way to decrypt this data and recover them. I have the password which was used as the Bitlocker password.


Answer



Sorry to be the harbinger of bad news. Your data is most likely not recoverable. Bitlocker works by putting a block of data with the private key - encoded with your passphrase or tpm or what have you - and if this block is destroyed, having the password does not help you. (This is done so you can change password/have multiple passwords/access mechanisms.


The data you are seeing is a misinterpretation of random characters interpreted as files - as evidenced by the garbage characters and date modified times.


That said, if you happen to have an older bit copy of the encrypted drive you might be able to copy the relevant block, decrypt the filesystem and attempt recovery. This is expert territory though, and does require in depth knowledge and a copy of the block containing the key.


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...