Quote:
It is WD5000LPLX, so it's not SSD
![Sad :(](./images/smilies/icon_sad.gif)
The fact that it's not a SSD is actually a good thing for your purposes : deleted data would be wiped quickly on a SSD because of the “trim” feature, whereas on a HDD it stays in place until it's been overwritten. In other words, if it had been a SSD it would have been game over right over.
Quote:
Thank you for reply. I don't think Acronis is doing anything different, since i need exactly bit-to-bit clone if i want to look for deleted data. Anyway, i'll try both Acronis and Macrium Reflect, won't hurt
![Smile :)](./images/smilies/icon_smile.gif)
Thank you for suggestion.
I don't have much experience with that, but (to anyone who may have some insight) is there a backup software which would be able to create a forensically sound image by
not relying on VSS on a drive which does not contain the running system, and which would “see” the data as it appears from within the Windows 10 session, i.e. decrypted ? Or would a “rescue media” created on Windows 10 be able to somehow decrypt the data on the fly ? (Don't think so...)
Have you tried more basic recovery softwares, like Recuva, Handy Recovery ?
What do you see when examining the whole volume with an hexadecimal editor, encrypted or decrypted data ? With WinHex or equivalent, can you browse the current data, as in files and folders ?
To others : do empty sectors appear always the same when encrypted with BitLocker ? (In a
topic I created some months ago, “fzabkar” said that AES-encrypted empty sectors would always have the same pattern with a given encryption key, although he didn't know about BitLocker.)
What I don't get here is : how useful is a BitLocker encryption if anyone running Windows 10 can access the drive's contents ?