Hello all,

I am aware there is a subsequent update released on the 25th of May for PC3000, but please check this as I have noticed what appears to be a major bug in the handling of Bitlocker for the previous version released in April. I have not yet raised with Ace TS but will shortly.

The quick summary:

Failed head assembly in WD HDD
Replaced heads. Imaged HDD using SED decryption. 1 bad sector.
Bitlocker was enabled.
Customer provided correct password, which was entered into Data Extractor
Extracted files normally via PC3000/Data Extractor

When the data was manually inspected it appeared that a large proportion of the files were corrupt. It seemed quite at random, but generally larger files. After various checks, re-imaging etc, the results could vary. It seemed very unusual. There seemed to be a repeated pattern written in parts of the extracted files which would cause partial corruption.

I then decided to mount the task, and then access the disk image via UFS Explorer Pro. The password was entered for Bitlocker. The files would extract normally. Please see the screen shots for opening the same image, from the same disk image in PC3000 and UFS Explorer respectively:





It appears that Data Extractor Data Extractor 5.12.3 has a fault where it is not decrypting files fully, and writing incorrect data to the files when saved from the disk image.

I'll make a few more checks this weekend and submit to Ace TS. I'll also update to the new version released 3 days ago to see if this has been resolved.

John

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/

Hello,

I can confirm that in 5.12.5 and 5.12.6 the fault still existed. I have just tried the latest version today 5.12.9 and I can confirm that Ace have patched the bug and Bitlocker decryption for extraction of files is now working normally.

I never had the chance to test 5.12.7 so I cannot confirm whether this was affected by the bug.

Best regards,
John

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/

Hi Guys,
In DE 5.12.10 the bug still present.

_________________
DataRecovery.bg

That's surprising. I just had the same issue with 5.12.9. All photos broken. Mounted task and ran UFS, all photos OK.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Did anyone report this bug to Ace?

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

I just let Roman know about this thread. It baffles me why this would be the first place to go when a bug is discovered. It is good to let others know about the bug too, but if we don't notify the developers, there is little chance that they will fix it in a timely manner.

_________________
Luke
Recovery Force Data Recovery

I expect people are looking for confirmation it's a replicable bug and not just a product of their particular environment or because it's Friday and it's been one of those weeks

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/

Its been reported, and solved with replacing a DLL. Probably there will be some bug fix release soon , unfortunately not feeling confident I can share the dll on common chat.
The threat helped a lot since the case was weird enough to suspect lots of other things prior decrypting. In my case solved huge headache!

_________________
DataRecovery.bg

Bug found at the weekend when AceTS closed, so reported on the Monday after. But my expectation of Ace TS was that they would immediately assume it was a fault with my systems rather than a fault in PC3k/DE, hence why I wanted to check with a few others first for similar faults. Needless to say when I did report to AceTS I got that response, and it took about 3 emails before they were prepared to take a proper look, by which point a flurry of updates had been applied in the Update Box, which made me think they were probably 'working on it'.

John

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/

John,
What version Of DE is This Please ,I am on 5.12.11

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

same thing encountered today. I was stress free thanks to the fact I encountered this post about 5-6 days ago.

Work around is to mount the BL partition as read only and use R-Studio to browse...all looks well

_________________
THERE IS ALWAYS HOPE TILL YOU LOSE IT.

@sin - I am glad it was of use.

J

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/

Any day my friend....I have always had a knack of browsing through stuff and learn what ever I can..
A small line read somewhere can go long way

Similary for even my examinations, a small line read here and there always fetched good marks

I should thank for your inputs
--

_________________
THERE IS ALWAYS HOPE TILL YOU LOSE IT.

Hi All!
We forwarded the information on this strange behaviour with Bitlocker to ACE Lab developers, and it will be fixed in the next major update. Just follow our news on the latest updates!

_________________
Best regards
ACE Lab Team
ts.acelab.eu.com / blog.acelab.eu.com

Hi,
Glad To See You Here ...

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com