MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Formatted Dynamic volume recovery
PostPosted: January 30th, 2015, 22:16 
Offline

Joined: May 30th, 2014, 0:54
Posts: 152
Location: Universe
I have a case where customer has formatted a dynamic volume ( 1TB in size having 600 GB X 2 disks). Volume was having bitlocker encryption. Is there any chance of rebuilding volume and bitlocker decryption ?How should I go ahead ?


Top
 Profile  
 
 Post subject: Re: Formatted Dynamic volume recovery
PostPosted: January 31st, 2015, 14:18 
Offline

Joined: January 8th, 2008, 5:21
Posts: 927
Location: uk
Well it all depends on what type of format was run on the volume?
Do you have access to the Bitlocker recovery key?
Of course you need to image both drives first! Then rebuild/recover the volume. Then mount the recovered volume in Windows. Using the recovery key you should be able to decrypt the data.


Top
 Profile  
 
 Post subject: Re: Formatted Dynamic volume recovery
PostPosted: February 2nd, 2015, 2:07 
Offline

Joined: May 30th, 2014, 0:54
Posts: 152
Location: Universe
Hi dick thanks for the suggestions. Yes I have made raw images of both disks first. Trying to rebuild R-studio , do you suggest any other software for rebuilding volume ?


Top
 Profile  
 
 Post subject: Re: Formatted Dynamic volume recovery
PostPosted: February 4th, 2015, 22:49 
Offline

Joined: August 6th, 2007, 13:12
Posts: 181
Location: India
Even if a virtual volume was rebuild , how to invoke Bitlocker authentication process ? Since due to format Bitlocker related information is lost.
This is complex recovery. Advanced forensic tools might be able to help. Senior members having experience of forensic recovery will be able to help.


Top
 Profile  
 
 Post subject: Re: Formatted Dynamic volume recovery
PostPosted: February 5th, 2015, 4:43 
Offline

Joined: January 8th, 2008, 5:21
Posts: 927
Location: uk
As I stated it all depends on the type of format. Also we don't know if the volume was written to as the OP hasn't given much info.
In some cases the images can be written back to 2x replacement disks and the volume can be mounted as before. It is possible in this scenario the original Bitlocker key will decrypt the drive. If not the original backed up recovery key might be the better option.

I am presuming here the dynamic volume refers to a spanned disk? Again the OP hasn't made it clear. So a 'rebuilt' recovered spanned volume could be written to a larger capacity single spare drive. Then mount in Windows and try the keys.

Of course if the volume has been overwritten then it would be impossible. Analysis of the images in a hex editor would indicate if it might be possible .


Top
 Profile  
 
 Post subject: Re: Formatted Dynamic volume recovery
PostPosted: February 5th, 2015, 11:50 
Offline

Joined: May 30th, 2014, 0:54
Posts: 152
Location: Universe
Thanks a lot dick.
Your post has kept my hopes of recovery alive . I will follow process suggested by you. Lets hope for big success .


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 43 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group