I have got a disk from one of my enterprise customer. It engineer has accidentally formatted a hard disk and reinstalled new OS from a bitlocker encrypted laptop.
Customer has backup of bitlocker key. But previous bitlocker metadata is lost due to format .
I have not got disk yet so could not check protectors but as per IT it should be TPM+key .
Is there any way to mount bitlocker partition , provoke it for key and link /fetch key from TPM ?
Though this seems to be weird non practical thing.
Is there any alternative software to do this task. Is it advisable to work on detached hard disk clone or hard disk clone from within laptop (to access TPM)
any help or suggestions?
Merry Christmas and Happy new year 2022 to everyone.

There are very softwares which can do this. I think UFS explorer professional is one of them. It needs lots of knowledge of file system on low level.

I think this is impossible for any forensic software ,person or even any organization. No software can do this feat.

Formatted & OS re-installed ------> Game over its gone (specially if based on my guesses SSD/M2 laptop drive)

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Thanks einstein9
Yes I have updated customer for the same. I tried raw recovery but it is also not working.

For decrypting Bitlocker partition , Recovery key is not enough, very important to get pervious bitcloker metadata which has 3 copies. Search for FVE magic header. If formatting got overwrite it, as been said - game Over

_________________
Angel Data Recovery

Question: is it a "hard disk" or "SSD drive" ?

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk

wo thanks DR-Kiev and digisupport.
digisupport this is 500GB laptop hard disk having single partition.
If needed I can give remote access to drive as well. In case of successful recovery we will share the booty.