Formatted Dynamic volume recovery

[athena]

I have a case where customer has formatted a dynamic volume ( 1TB in size having 600 GB X 2 disks). Volume was having bitlocker encryption. Is there any chance of rebuilding volume and bitlocker decryption ?How should I go ahead ?

[dick]

Well it all depends on what type of format was run on the volume?
Do you have access to the Bitlocker recovery key?
Of course you need to image both drives first! Then rebuild/recover the volume. Then mount the recovered volume in Windows. Using the recovery key you should be able to decrypt the data.

[athena]

Hi dick thanks for the suggestions. Yes I have made raw images of both disks first. Trying to rebuild R-studio , do you suggest any other software for rebuilding volume ?

[hddbug]

Even if a virtual volume was rebuild , how to invoke Bitlocker authentication process ? Since due to format Bitlocker related information is lost.
This is complex recovery. Advanced forensic tools might be able to help. Senior members having experience of forensic recovery will be able to help.

[dick]

As I stated it all depends on the type of format. Also we don't know if the volume was written to as the OP hasn't given much info.
In some cases the images can be written back to 2x replacement disks and the volume can be mounted as before. It is possible in this scenario the original Bitlocker key will decrypt the drive. If not the original backed up recovery key might be the better option.

I am presuming here the dynamic volume refers to a spanned disk? Again the OP hasn't made it clear. So a 'rebuilt' recovered spanned volume could be written to a larger capacity single spare drive. Then mount in Windows and try the keys.

Of course if the volume has been overwritten then it would be impossible. Analysis of the images in a hex editor would indicate if it might be possible .

[athena]

Thanks a lot dick.
Your post has kept my hopes of recovery alive . I will follow process suggested by you. Lets hope for big success .