Is Data recovery possible from this Bitlocker case

[terminator2]

One of my customer has accidentally deleted Data drive D having bitlocker encrypted data. I have made clone of the disk. I could see 2 partitions with RAW file system.
Customers IT dept. has given bitlocker key.
My question is whether there is any way to forcefully invoke Bitlocker interface for data partition.
Has anyone solved this type case?
Thanks.

[Doomer]

try this - https://technet.microsoft.com/en-us/lib ... 51(v=ws.11).aspx

[terminator2]

Hi Doomer sir
Thank you so much for valuable help. I will go through the article.

[data-medics]

I have a very similar case to this. Looks like they formatted a bitlocker encrypted drive. That article is now missing, anyone have an updated reference? I've dealt with plenty of bitlocker drives, but none that were formatted.

I've been looking over this article: http://www.normanbauer.com/2013/07/25/h ... partition/

But it seems to depend on knowing the original partition structure which I don't.

I do see starting around sector 249220 a bunch of strings that appear like:


Vol_.C._.K.e.y.0.0. and it counts up from there with data in between each key. Anyone know what sector in a bitlocker volume that's supposed to start at?

[dick]

Try this edited link: https://technet.microsoft.com/en-us/lib ... 29851.aspx

Last edited by dick on November 23rd, 2016, 4:46, edited 1 time in total.

[scratchy]

You need to look for the first occurrence of 'HVE'

Can you take a screenshot of LBA0 ?

[suardim]

We have solutions for cases like yours!

Contact pm

[MindMergepk]

solve today almost similar case, where customer create new partitions on a bitlocker drive. what is more they even dump 1.4GB of data on one of the newly created partition.

have successfully trace the bitlocker partition, image the area to another hdd, and its done.

pm if anyone want a reference of our approach.

[MindMergepk]

there is a way to bypass Bitlocker !!!!

http://thehackernews.com/2016/11/window ... ypass.html

[Doomer]

there is a way to bypass Bitlocker !!!!

http://thehackernews.com/2016/11/window ... ypass.html

After you unlock it with correct password

[dick]

Well done!
I haven't used it but maybe somebody would like to test this out: http://www.m3datarecovery.com/bitlocker ... -recovery/
Bitlocker data recovery software to recover data from Bitlocker encrypted volume. M3 Bitlocker Recovery provides easy-to-use and friendly UI to recover damaged, corrupted, failed or inaccessible, deleted or lost Bitlocker encrypted volume as long as you provide original password or Bitlocker recovery key.