All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 16 posts ] 
Author Message
 Post subject: BitLocker partition formatted
PostPosted: July 30th, 2018, 13:41 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
Hello
The customer formatted a BitLocker partition. Is there any way to recover the data.
I have the recovery key.

Any suggestions?

Thanks in advance


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 14:22 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3221
Location: Chicago
scan it for metadata with repair-bde

_________________
https://www.linkedin.com/in/artemrubtsov/


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 14:31 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
@ Doomer, Thanks a lot for your response.


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 15:12 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7186
Location: UK
Or you can use “M3 Bitlocker Recovery”.

It’s not cheap but it often does it when repair-bde can’t.

_________________
PC Image Data Recovery
www.pcimage.co.uk


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 15:14 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
pcimage wrote:
Or you can use “M3 Bitlocker Recovery”.

It’s not cheap but it often does it when repair-bde can’t.

I already have it. But didn't use it yet until repair-bde finishing scanning for metadata.

I appreciate your both responses.


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 15:52 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
After scanning the entire partition with repair-bde and M3 BitLocker both couldn't success.
Tried scanning the partition with R-Studio I have found 2GB of data intact.
Is that mean that the customer after formatting the partition overwrite it with new data, am I right here?
If so, is there any chance to recover the data?

Thanks in advance.


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 15:58 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3221
Location: Chicago
if repair-bde couldn't find metadata then it's probably not on the drive
W/o metadata you cannot decrypt the drive even though you know the password

_________________
https://www.linkedin.com/in/artemrubtsov/


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 16:02 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
Doomer wrote:
if repair-bde couldn't find metadata then it's probably not on the drive
W/o metadata you cannot decrypt the drive even though you know the password

Thanks for response sir,
The customer said to me that he just quick formatted the drive and didn't overwrite anything. But he tried several recovery softwares but didn't overwrite on the same partition as he said ( He supposed to be the IT manager of his company )


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 16:13 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
Is it certain the drive had bitlocker ? Maybe it had another kind of encryption and the customer is mixing the names ?


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 16:25 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
rogfanther wrote:
Is it certain the drive had bitlocker ? Maybe it had another kind of encryption and the customer is mixing the names ?

C partition is encrypted with BitLocker too. I can open C partition with it's recovery key.
He said that he formatted the D partition because it wasn't accept the recovery key or password thinking that when he format the partition he will use a recovery software and recover the data :( .


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: July 30th, 2018, 17:13 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
Another customer come with almost the same case ( but this time he didn't format it ) :)
M3 BitLocker get the metadata very quickly and shows the data.

This is the day of BitLocker :lol:


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: August 14th, 2018, 15:19 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 2604
Location: Hungary
once i made a test. When i formatted the bitlocker partition in a bitlocker aware os, it wiped all metadata sectors, so recovery key alone is not sufficient to decrypt. The exported metadata could only help in such situation.
IMO

_________________
Adatmentés - Data recovery
No bitcoin donations :)


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: August 14th, 2018, 16:30 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1255
I have tried several methods to work around. Unfortunately, nothing work, beside that the customer was need the drive in the same day.
So Mr. Pepe, will you refuse a drive like that for data recovery? :D


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: August 15th, 2018, 2:50 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 2604
Location: Hungary
that's definitely the case. at least without the exported metadata.

_________________
Adatmentés - Data recovery
No bitcoin donations :)


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: August 29th, 2018, 16:45 
Online

Joined: August 24th, 2012, 8:15
Posts: 120
Location: Dominican Republic
Heh,

Have a similar situation yet no Key or password.


Top
 Profile  
 
 Post subject: Re: BitLocker partition formatted
PostPosted: September 30th, 2018, 21:40 
Online
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9670
Location: Portugal
LoboX wrote:
Heh,

Have a similar situation yet no Key or password.


You can cry ... as you will not get data !

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 16 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google Adsense [Bot] and 46 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group