Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 1 of 1
  [ 7 posts ] 
  Previous topic | Next topic 
Author Message
maddin
 Post subject: Bitlocker encrypted HDD
PostPosted: February 13th, 2020, 3:15 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
Hello,

I got a bitlocker encrypted drive which read normally and it get recogniced by the PC but when I connect it in Windows it's looks like the drive is not formated. I also tryted to mount it in Linux with:

Code:
cryptsetup open --type bitlk /dev/sdc bitlocker_hdd

but I got:

Invalid or unknown boot signature for BITLK device.

The MBR looks like that:

Code:
00000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 4681 a308 0000 0000  ........F.......
000001c0: 0200 eefe bf00 0100 0000 ffff ffff 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 55aa  ..............U.


Has anyone an idea what could be the problem?
Top
 Profile  
 
pepe
 Post subject: Re: Bitlocker encrypted HDD
PostPosted: February 13th, 2020, 6:25 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4334
Location: Hungary
the disk has a gpt at lba 1, the mbr does not contain any other info about the partitions.

sdc refers to the physical disk, i am sure that command wants a dev pointing to the bitlocker partition. Like /dev/sdc2.
(if it is the second partition)

pepe

_________________
Adatmentés - Data recovery
Top
 Profile  
 
maddin
 Post subject: Re: Bitlocker encrypted HDD
PostPosted: February 14th, 2020, 9:23 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
pepe wrote:
the disk has a gpt at lba 1, the mbr does not contain any other info about the partitions.

Yes I sa that but for Gparted and Windows there is no partition. They see the disk as unallocated spcae.

Quote:
sdc refers to the physical disk, i am sure that command wants a dev pointing to the bitlocker partition. Like /dev/sdc2.
(if it is the second partition)

I know but as I told there is no partition. Is it possible that even the partition table is encrypted?

Or do I need the TPM to read the partition table?

I had some bitlocker-partition which I could read in that way which you tell but I had never the case that the whole drive is just recogniced as unallocated space...

I will a bit later also post LBA1 maybe you can see there more.
Top
 Profile  
 
maddin
 Post subject: Re: Bitlocker encrypted HDD
PostPosted: February 14th, 2020, 10:48 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
LBA1:
Code:
00000200: 4546 4920 5041 5254 0000 0100 5c00 0000  EFI PART....\...
00000210: ada7 b313 0000 0000 0100 0000 0000 0000  ................
00000220: af88 e0e8 0000 0000 2200 0000 0000 0000  ........".......
00000230: 8e88 e0e8 0000 0000 60a2 6e4e c3e6 6a45  ........`.nN..jE
00000240: a25a 7b55 2d5a fd02 0200 0000 0000 0000  .Z{U-Z..........
00000250: 8000 0000 8000 0000 86d2 54ab 0000 0000  ..........T.....
00000260: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000270: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000280: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000290: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000300: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000310: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000330: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000340: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000350: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000380: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................


LBA2:
Code:
00000400: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000410: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000420: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000430: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000440: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000450: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000460: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000470: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000480: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000490: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000500: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000510: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000520: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000530: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000540: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000550: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000560: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000570: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000580: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000590: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................


LBA4, LBA5, ... looks the same.

As far as I understand the LBA1 in LBA2 should be partition entries and there should be 8 partitions? But the next 3 or 4 following LBAs are empry and contain just 0x00...

Is the partition entry Lost? Or os there some other problem?
Top
 Profile  
 
Amarbir[CDR-Labs]
 Post subject: Re: Bitlocker encrypted HDD
PostPosted: February 14th, 2020, 12:09 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3471
Location: CDRLabs @ Chandigarh [ India ]
maddin wrote:
Hello,

I got a bitlocker encrypted drive which read normally and it get recogniced by the PC but when I connect it in Windows it's looks like the drive is not formated. I also tryted to mount it in Linux with:

Code:
cryptsetup open --type bitlk /dev/sdc bitlocker_hdd

but I got:

Invalid or unknown boot signature for BITLK device.

The MBR looks like that:

Code:
00000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 4681 a308 0000 0000  ........F.......
000001c0: 0200 eefe bf00 0100 0000 ffff ffff 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 55aa  ..............U.


Has anyone an idea what could be the problem?


Him
Please Try This Tool -> https://www.m3datarecovery.com/bitlocke ... -recovery/

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com
Top
 Profile  
 
pepe
 Post subject: Re: Bitlocker encrypted HDD
PostPosted: February 14th, 2020, 14:15 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4334
Location: Hungary
Quote:
LBA4, LBA5, ... looks the same.

As far as I understand the LBA1 in LBA2 should be partition entries and there should be 8 partitions? But the next 3 or 4 following LBAs are empry and contain just 0x00...

Is the partition entry Lost? Or os there some other problem?


yes, the partition table is empty. Why do you think there should be 8 partitions?
The solution is either to find the partitions manually and set up the partition table or use some sw capable of doing so/recover the data to another disk.

pepe

_________________
Adatmentés - Data recovery
Top
 Profile  
 
maddin
 Post subject: Re: Bitlocker encrypted HDD
PostPosted: February 19th, 2020, 4:11 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
Amarbir[CDR-Labs] wrote:
Please Try This Tool -> https://www.m3datarecovery.com/bitlocke ... -recovery/

... Thanks, that helped a lot!
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 7 posts ] 

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 50 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group