Quote:
- Ask the customer or computer owner/actual user.
The informations I got so far are rather sketchy... The actual user seems to have very little technical knowledge (no offense if she's reading this !
), hence why she asked her father to fix the computer. I don't know what he did, I don't know if what appears as possibly encrypted data was there from the begining, or if this is the result of something he did while attempting to fix it. In order to have more accurate input, I would have to talk directly to the guy, and it would become very complicated, for possibly zero reward if it turns out that it's completely unrecoverable...
Quote:
- Think how they may have encrypted it without them realizing they actually did and ask if they recall anything like that happening.
That's the problem : how would they remember anything like this without realizing it at the moment ? By eating a
madeleine ?
I also asked if it was possible for a laptop computer to be sold with a whole volume encryption already activated, without the owner's knowledge or explicit consent (that would be stupid for sure, but there are many stupid things happening in this world... at every single second, there is someone, somewhere, doing something utterly stupid, and sometimes that someone can be a large corporation with a worldwide customer base !
).
Quote:
- Did they save any encryption keys? What about their Microsoft account?
They don't remember anything about an encryption process, and didn't consciously deal with any encryption key.
What about the Microsoft account ? How could it be related with a (possible) encryption ? I personally stayed away from Windows 8/10, and don't know much about that thing, which seems to be way more annoying than it is worth. (About a year ago I banged my head on the wall while trying to remotely configure my mother's computer running on Windows 8 so that it would have two separate user accounts, one for her and one for her companion, with a selection screen during startup and a password for each – just like it used to work perfectly with her former computer running on Windows Vista ; but I couldn't do that, even after applying some obscure registry trick, it came back at the next reboot, and I was asked to set up a Microsoft account, which is apparently necessary now to get that simple feature ; it was already difficult to explain to her the difference between the Windows account password and the e-mail account password, and it seemed way too convoluted even for me, so I gave up, and they still use the same account because it's too complicated and unintuitive to manually change the user account it after being logged in... That's about all that the words “Microsoft account” evoke to me !
)
Quote:
- Look for Bitlocker or Truecrypt signatures.
Yes, that's what I was requesting above, repeatedly : what would be Bitlocker or Truecrypt signatures, and where should I look for them ? (The difficulty must be compounded by the fact that a large chunk of the partition was overwritten when Windows was reinstalled – with no encryption obviously.)
Quote:
- Try to replicate the problem with a test drive.
I don't know enough about what happened in the first place to be able to replicate it.
Quote:
Not sure I understand your question.
I mean... I don't know much about cryptography, I never used any of those encryption systems myself, so, generally speaking, how does the system, and the user, interact with a volume encrypted with either Bitlocker or Truecrypt ? Is there a password to type each time, or can it be an automated process, linked with the user account password for instance, or with the computer's firmware, or something else ? Where is the encryption software located ? I'm just looking for any hint that would allow me to, at least, say if it is or is not encryption, or what else it could possibly be.
Quote:
Needlees to say, not sure what else I can suggest without more concrete information.
Well, I provided all the information I have myself. Imagine that you get exactly the same request, with exactly the same amount of information, and that you already went through the hassle of doing a volume image and a thorough analysis with two reliable tools and found absolutely nothing, what would you do ? (I initially asked 25€ for that job, which seemed pretty straightforward, and well within my current abilities.)