MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 11 posts ] 
Author Message
 Post subject: Is Data recovery possible from this Bitlocker case
PostPosted: July 25th, 2016, 10:21 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 548
Location: brisbane
One of my customer has accidentally deleted Data drive D having bitlocker encrypted data. I have made clone of the disk. I could see 2 partitions with RAW file system.
Customers IT dept. has given bitlocker key.
My question is whether there is any way to forcefully invoke Bitlocker interface for data partition.
Has anyone solved this type case?
Thanks.


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: July 25th, 2016, 11:52 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3577
Location: Chicago
try this - https://technet.microsoft.com/en-us/lib ... 51(v=ws.11).aspx

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: July 26th, 2016, 6:11 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 548
Location: brisbane
Hi Doomer sir
Thank you so much for valuable help. I will go through the article.


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 22nd, 2016, 18:39 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
I have a very similar case to this. Looks like they formatted a bitlocker encrypted drive. That article is now missing, anyone have an updated reference? I've dealt with plenty of bitlocker drives, but none that were formatted.

I've been looking over this article: http://www.normanbauer.com/2013/07/25/h ... partition/

But it seems to depend on knowing the original partition structure which I don't.

I do see starting around sector 249220 a bunch of strings that appear like:


Vol_.C._.K.e.y.0.0. and it counts up from there with data in between each key. Anyone know what sector in a bitlocker volume that's supposed to start at?

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 23rd, 2016, 4:45 
Offline

Joined: January 8th, 2008, 5:21
Posts: 927
Location: uk
Try this edited link: https://technet.microsoft.com/en-us/lib ... 29851.aspx


Last edited by dick on November 23rd, 2016, 4:46, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 23rd, 2016, 4:46 
Offline
User avatar

Joined: August 9th, 2007, 8:40
Posts: 791
Location: United Kingdom
You need to look for the first occurrence of 'HVE'

Can you take a screenshot of LBA0 ?

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 30th, 2016, 8:40 
Offline
User avatar

Joined: November 30th, 2016, 8:27
Posts: 1
Location: Brazil
We have solutions for cases like yours!

Contact pm


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 30th, 2016, 10:05 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 838
Location: Pakistan
solve today almost similar case, where customer create new partitions on a bitlocker drive. what is more they even dump 1.4GB of data on one of the newly created partition.

have successfully trace the bitlocker partition, image the area to another hdd, and its done.

pm if anyone want a reference of our approach.

_________________
Data Recovery Pakistan


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 30th, 2016, 10:47 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 838
Location: Pakistan
there is a way to bypass Bitlocker !!!!

http://thehackernews.com/2016/11/window ... ypass.html

_________________
Data Recovery Pakistan


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 30th, 2016, 11:17 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3577
Location: Chicago
MindMergepk wrote:
there is a way to bypass Bitlocker !!!!

http://thehackernews.com/2016/11/window ... ypass.html

After you unlock it with correct password

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
 Post subject: Re: Is Data recovery possible from this Bitlocker case
PostPosted: November 30th, 2016, 11:48 
Offline

Joined: January 8th, 2008, 5:21
Posts: 927
Location: uk
Well done!
I haven't used it but maybe somebody would like to test this out: http://www.m3datarecovery.com/bitlocker ... -recovery/
Bitlocker data recovery software to recover data from Bitlocker encrypted volume. M3 Bitlocker Recovery provides easy-to-use and friendly UI to recover damaged, corrupted, failed or inaccessible, deleted or lost Bitlocker encrypted volume as long as you provide original password or Bitlocker recovery key.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 39 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group