Hi there,

I need advices about how can I solve my issue:

I have an external drive. I started the encryption drive with bitlocker, during encryption process, the drive has been disconnected so I wasn’t able to continue the encryption process.

Now, the drive is partially encrypted. When I want to access the drive, I got the error message “Encryption Failed to recover from an abruptly terminated conversion”.

I would like a procedure to recover the remaining data: encrypted and non encrypted

I used M3 Bitlocker Recovery but the tool freezes, I am currently trying TestDisk 7.0. Analysis is in progress.

You'll find attached screenshots and detailed description of the situation.

I have the passwords & recovery keys

Have you tried force decrypting manually in Bitlocker?

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts

read here:
https://technet.microsoft.com/en-us/lib ... 29851.aspx

_________________
Data Recovery Pakistan

seems to be kind of limited...

you might try dislocker.
i strongly recommend creating an image of the drive in the current state, because if u get any tool decrypt it, the unencrypted area might be destroyed too.
later it might be neccessary to merge the decrypted and the yet unencrypted parts.
i have never had a partially encrypted case, so i am not sure wether dislocker can work with it either. The most important stuff is the metadata, which if not yet written to the disk, you are screwed.
i will try to do some tests on a spare drive.

pepe

_________________
Adatmentés - Data recovery
No bitcoin donations

I made a quick test and it seems that the metadata is written at the beginning of the encryption process, so in theory it should be possible to decrypt using the recovery key which you were supposed to save or print when u started the encryption process.
i think even repair-bde should be able to deal with it, but you can't escape the merging phase when decryption is done, so u definitely need 2 copies.

_________________
Adatmentés - Data recovery
No bitcoin donations

Thanks a lot Pepe

This is exactly the idea I had.

Repair-Bde:
I confirm that the metadata written at the beggining of the external drive is safe a accessible from repair-bde.
Command used: Repair-bde g: h:\dataimage.img -rp 445753-050908-116633-034606-691966-304216-490831-695222 -f

However, when trying to force the decrypting using this command, I got an error at 5%. 5% seems to be the point where the encryption stopped. (Size of drive 500Go - usb only) I assume that the remaining 95% are not encrypted.
Q1 : How can I access to the remaining 95% of the data?

In addition to that I mounted the image using Daemon Lite, I got a windows error: "Windows cannot access the drive, it can be damaged"

Q2 How can we access to the image created by repair-bde (error above) ? representing 5% of drive
Q3 Dislocker is running on Linux & my machine has windows. Is there a way to run disloker online on a Linux machine, I remember I did it some time ago.
Q4 Which tool should I use to make an image of the drive in current state including the meta data ? Macrium is ok?

I found the tool TestDisk. I am going to investigate dislocker option & find a way to run it

Thank you for your help I will update you,

u can use a VM with ubuntu to run dislocker.

if you are not familiar with on-disk structures and the use of a hex editor and disk imager, i would recommend seeking pro help.
I have not used repair-bde a lot, only a few times, but i haven't got errors even when the image had unread sectors.
What error did u get btw?

pepe

ps: i hope you created a backup image and working on that, as i recommended...

_________________
Adatmentés - Data recovery
No bitcoin donations

Hi Yep I have a vm with ubuntu ,

I am an ex soft developer 5yrs ago, Im familiar with hex editors, compilers, disk image etc but need some guidance on these topics

Good progress in the meanwhile, I created a VM with ubuntu and in trying to create an image of the encrypted drive.

I used Macrium & ran it 3 times in several modes: Intelligent Copy ; Exact Copy ; with option ignore bad sectors.

It went well 3 times with estimated time of 8hours for image creation. But, after some time, it goes to 22700 hours (2.6 years)

Does anyone had this issue to create an image?

Need to find a way to create an image of this drive even if some sectors are damaged.

Thanks

macrium is not for this.

there are several progs, but i do not know their capabilities to be honest.
I use winhex under Win. Or use dd under linux (will be a bit slow from a VM, but if it is not urgent...)

pepe

_________________
Adatmentés - Data recovery
No bitcoin donations

Sir ,
Long Time in Cloning HDD Means " Bad Sectors" In HDD And this could be the reason that bitlocker failed .I would advise anyone trying bitlocker to first logically test all sectors of the partition that you are going to attempt bitlocker encryption to

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

Yep Long Time againg with WinHex.

I launched an imaging of this drive on 12 March 2016 @ 1:00pm, it was supposed to take 7.5hrs.

On 12 March 2016 08pm, Status was 52% & remaining time was 4hrs approx

On 13 March 2016 10am, Status was 55% & remaining time is still 4hrs approx. I enclosed a screenshot

CPU of winhex process is 0%

Is there any mode to skip theses bad sectors ?

How do you test the bad sectors ? & what do you do when you identified them?

Best regards,

Me- first thing I would do if i suspected bad sectors is image the drive. there are hardware imagers (best) and a couple software imagers that handle bad sectors. Shameless plug for one of them that i am trying to unload viewtopic.php?f=15&t=32945

Recovery is going bad. I tried to use dd rescue under a VM Ware with Ubuntu.

I can see the drive f: in windows but:
- Windows Disk Management diskmgmt.msc does not respond.
- TestDisk does not respond. Message "please wait" is displayed.
- M3 Bitlocker Recovery is not able to start. It was the case before I restarted laptop
- Recuva is not able to start
- Partition Find & Mount identifies the drive SAMSUNG HM500JI USB Device but there is no partition detected
- EditHexa recognize disk with no partition& no size
- When accessing drive F: in Windows, message is "cannot access drive"

-Winhex start but take considerable time
- PC Inspector is able to start but doesnt recognize disk

- PowerQuest is not Able to access to the MBR. the MBR was correct 2 days ago

What should be next step to Fix the MBR & image the drive ?

Best regards,

It looks like that PowerQuest has identified the drive again...

Well,
Unlike many others this is what i would suggest you .....

Boss the surface of this drive or a head or heads are or have gone from worst to failing condition .I suggest you use a hardware based cloning device to clone this hdd and then try a bitlocker tool .I am 100% confident it will work ,The problem is not what you are thinking its different

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com