Formatted BitLocker Partition Recovery

Hello Guys,

A Client mistakenly formatted an external HardDrive, with an active BitLocker on it, she has the password though. I have tried some software that claim to have the capability but no result, couldn't even get Raw files..
Has anyone been able to solve a similar case ?
 
I was able to solve this problem in two ways...
First...
With this command, 'repair-bde C: D: -rp 111111-222222-333333-444444-555555-666666-777777-888888'

this option assumes 'C' was original encrypted volume, and 'D' is destination target.

1111-2222-3333... -> this would be 48 digit recovery key.

Encryption algorithm is already known, and as key is supplied.

This automatically decrypt 'C' to 'D' and because it was formatted its possible you may need to scan for data to find it after decryption is done.

Note: Should you have the Password instead of Key, use this command, "repair-bde C: D: -pw"

This first option works perfectly for me, and data is fully recovered.


The Second Option, which is also gave very good good result.

It may be possible that native boot record remains intact and you may be able to decrypt without the first method.

You can search for BitLocker boot record, using R-Studio, in my case I found the boot record to be 64, You can either image from Sector 64, to end of the drive. (Sector 64 to end).
LBA 64 is bitlocker record and LBA 0 contains new MBR from client format, this MBR has no information about my encrypted partition since this is a new MBR, so for this we need to 'cut' this data out so when we connect image, first sector is bitlocker record and not the new MBR. Then when windows sees image it will identifty password is present and ask for it. It possible maybe some file records are overwritten or damaged, probably some metadata like MFT records are damaged, so we need to scan it after entering password.



Either way, Data was fully recovered.
 

Jared

Administrator
Staff member
Yes, but he actually was able to find the answer he needed. That's half the magic of being successful in this business. :D
 

vijayan

Member
M3 DATA RECOVERY TOOL 100 % POSSIBLES



Bankole Oladoja":1mqyucyx said:
Hello Guys,

A Client mistakenly formatted an external HardDrive, with an active BitLocker on it, she has the password though. I have tried some software that claim to have the capability but no result, couldn't even get Raw files..
Has anyone been able to solve a similar case ?
 
Top