All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 15 posts ] 
Author Message
 Post subject: Recover data from ext tdrive partially encrypted Bitlocker
PostPosted: March 5th, 2016, 7:35 
Offline

Joined: March 5th, 2016, 6:20
Posts: 10
Location: France
Hi there,

I need advices about how can I solve my issue:

I have an external drive. I started the encryption drive with bitlocker, during encryption process, the drive has been disconnected so I wasn’t able to continue the encryption process.

Now, the drive is partially encrypted. When I want to access the drive, I got the error message “Encryption Failed to recover from an abruptly terminated conversion”.

I would like a procedure to recover the remaining data: encrypted and non encrypted

I used M3 Bitlocker Recovery but the tool freezes, I am currently trying TestDisk 7.0. Analysis is in progress.

You'll find attached screenshots and detailed description of the situation.

I have the passwords & recovery keys


Attachments:
File comment: Issue Description
2016 bitlocker recovery.pdf [148.38 KiB]
Downloaded 479 times
Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 5th, 2016, 8:08 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3636
Location: Massachusetts, USA
Have you tried force decrypting manually in Bitlocker?

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 5th, 2016, 8:17 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 831
Location: Pakistan
read here:
https://technet.microsoft.com/en-us/lib ... 29851.aspx

_________________
Data Recovery Pakistan


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 5th, 2016, 17:35 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4301
Location: Hungary
Quote:
Repair-bde cannot repair a drive that failed during the encryption or decryption process.

Repair-bde assumes that if the drive has any encryption, then the drive has been fully encrypted.


seems to be kind of limited...

you might try dislocker.
i strongly recommend creating an image of the drive in the current state, because if u get any tool decrypt it, the unencrypted area might be destroyed too.
later it might be neccessary to merge the decrypted and the yet unencrypted parts.
i have never had a partially encrypted case, so i am not sure wether dislocker can work with it either. The most important stuff is the metadata, which if not yet written to the disk, you are screwed.
i will try to do some tests on a spare drive.

pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 5th, 2016, 18:09 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4301
Location: Hungary
I made a quick test and it seems that the metadata is written at the beginning of the encryption process, so in theory it should be possible to decrypt using the recovery key which you were supposed to save or print when u started the encryption process.
i think even repair-bde should be able to deal with it, but you can't escape the merging phase when decryption is done, so u definitely need 2 copies.

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 8th, 2016, 5:59 
Offline

Joined: March 5th, 2016, 6:20
Posts: 10
Location: France
Thanks a lot Pepe :)

This is exactly the idea I had.

Repair-Bde:
I confirm that the metadata written at the beggining of the external drive is safe a accessible from repair-bde.
Command used: Repair-bde g: h:\dataimage.img -rp 445753-050908-116633-034606-691966-304216-490831-695222 -f

However, when trying to force the decrypting using this command, I got an error at 5%. 5% seems to be the point where the encryption stopped. (Size of drive 500Go - usb only) I assume that the remaining 95% are not encrypted.
Q1 : How can I access to the remaining 95% of the data?

In addition to that I mounted the image using Daemon Lite, I got a windows error: "Windows cannot access the drive, it can be damaged"

Q2 How can we access to the image created by repair-bde (error above) ? representing 5% of drive
Q3 Dislocker is running on Linux & my machine has windows. Is there a way to run disloker online on a Linux machine, I remember I did it some time ago.
Q4 Which tool should I use to make an image of the drive in current state including the meta data ? Macrium is ok?

I found the tool TestDisk. I am going to investigate dislocker option & find a way to run it

Thank you for your help I will update you,


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 8th, 2016, 9:41 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4301
Location: Hungary
u can use a VM with ubuntu to run dislocker.

if you are not familiar with on-disk structures and the use of a hex editor and disk imager, i would recommend seeking pro help.
I have not used repair-bde a lot, only a few times, but i haven't got errors even when the image had unread sectors.
What error did u get btw?

pepe

ps: i hope you created a backup image and working on that, as i recommended...

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 11th, 2016, 5:56 
Offline

Joined: March 5th, 2016, 6:20
Posts: 10
Location: France
Hi Yep I have a vm with ubuntu ,

I am an ex soft developer 5yrs ago, Im familiar with hex editors, compilers, disk image etc but need some guidance on these topics

Good progress in the meanwhile, I created a VM with ubuntu and in trying to create an image of the encrypted drive.

I used Macrium & ran it 3 times in several modes: Intelligent Copy ; Exact Copy ; with option ignore bad sectors.

It went well 3 times with estimated time of 8hours for image creation. But, after some time, it goes to 22700 hours (2.6 years)

Does anyone had this issue to create an image?

Need to find a way to create an image of this drive even if some sectors are damaged.

Thanks


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 11th, 2016, 15:13 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4301
Location: Hungary
macrium is not for this.

there are several progs, but i do not know their capabilities to be honest.
I use winhex under Win. Or use dd under linux (will be a bit slow from a VM, but if it is not urgent...)

pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 13th, 2016, 1:54 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3459
Location: CDRLabs @ Chandigarh [ India ]
HateBitlocker wrote:
Hi Yep I have a vm with ubuntu ,

I am an ex soft developer 5yrs ago, Im familiar with hex editors, compilers, disk image etc but need some guidance on these topics

Good progress in the meanwhile, I created a VM with ubuntu and in trying to create an image of the encrypted drive.

I used Macrium & ran it 3 times in several modes: Intelligent Copy ; Exact Copy ; with option ignore bad sectors.

It went well 3 times with estimated time of 8hours for image creation. But, after some time, it goes to 22700 hours (2.6 years)

Does anyone had this issue to create an image?

Need to find a way to create an image of this drive even if some sectors are damaged.

Thanks



Sir ,
Long Time in Cloning HDD Means " Bad Sectors" In HDD And this could be the reason that bitlocker failed .I would advise anyone trying bitlocker to first logically test all sectors of the partition that you are going to attempt bitlocker encryption to

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 13th, 2016, 5:14 
Offline

Joined: March 5th, 2016, 6:20
Posts: 10
Location: France
Yep Long Time againg with WinHex.

I launched an imaging of this drive on 12 March 2016 @ 1:00pm, it was supposed to take 7.5hrs.

On 12 March 2016 08pm, Status was 52% & remaining time was 4hrs approx

On 13 March 2016 10am, Status was 55% & remaining time is still 4hrs approx. I enclosed a screenshot

CPU of winhex process is 0%

Is there any mode to skip theses bad sectors ?

How do you test the bad sectors ? & what do you do when you identified them?

Best regards,


Attachments:
WinHexLongTime.jpg
WinHexLongTime.jpg [ 160.04 KiB | Viewed 9751 times ]
Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 13th, 2016, 11:35 
Offline

Joined: February 13th, 2010, 9:44
Posts: 208
Location: san diego, ca.
Me- first thing I would do if i suspected bad sectors is image the drive. there are hardware imagers (best) and a couple software imagers that handle bad sectors. Shameless plug for one of them that i am trying to unload :) viewtopic.php?f=15&t=32945


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 16th, 2016, 9:44 
Offline

Joined: March 5th, 2016, 6:20
Posts: 10
Location: France
Recovery is going bad. I tried to use dd rescue under a VM Ware with Ubuntu.

I can see the drive f: in windows but:
- Windows Disk Management diskmgmt.msc does not respond.
- TestDisk does not respond. Message "please wait" is displayed.
- M3 Bitlocker Recovery is not able to start. It was the case before I restarted laptop
- Recuva is not able to start
- Partition Find & Mount identifies the drive SAMSUNG HM500JI USB Device but there is no partition detected
- EditHexa recognize disk with no partition& no size
- When accessing drive F: in Windows, message is "cannot access drive"

-Winhex start but take considerable time
- PC Inspector is able to start but doesnt recognize disk

- PowerQuest is not Able to access to the MBR. the MBR was correct 2 days ago

What should be next step to Fix the MBR & image the drive ?

Best regards,


Attachments:
PowerQuest.jpg
PowerQuest.jpg [ 61.74 KiB | Viewed 9641 times ]
2016 bitlocker recovery 2016 03 16.pdf [523.73 KiB]
Downloaded 453 times
Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 16th, 2016, 11:41 
Offline

Joined: March 5th, 2016, 6:20
Posts: 10
Location: France
It looks like that PowerQuest has identified the drive again...


Top
 Profile  
 
 Post subject: Re: Recover data from ext tdrive partially encrypted Bitlock
PostPosted: March 16th, 2016, 14:03 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3459
Location: CDRLabs @ Chandigarh [ India ]
HateBitlocker wrote:
It looks like that PowerQuest has identified the drive again...

Well,
Unlike many others this is what i would suggest you .....

Boss the surface of this drive or a head or heads are or have gone from worst to failing condition .I suggest you use a hardware based cloning device to clone this hdd and then try a bitlocker tool .I am 100% confident it will work ,The problem is not what you are thinking its different

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 15 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 45 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group