Bitlocker raw recovery

Data recovery from Hard Disk Drives with logical problems

Moderator: Alex_TS


LMDRO
Newbie
Posts: 2
Joined: 08.02.13
Reputation: 0 / (0)

Bitlocker raw recovery

Postby LMDRO » 19.02.21, 01:12

I have a drive that is encrypted with Bitlocker. I've got the encryption key based off the key ID. manage-bde -unlock (drive letter) -rp will not accept the key, however when creating a virtual encrypted bitlocker drive on the Data Extractor, It does accept the key. I see no files or folders within the data extractor. Past experience has not let me run a Raw Recovery on encrypted bitlocker drives without first decrypting them. However Bitlocker's manage-bde not accepting the key prevents me from decrypting the drive.

Can the Data Extractor actually decrypt so that I can attempt a raw recovery?

With Mcafee Endpoint Encryption, I was able to force a decryption regardless of if I had the correct key or not. Are there any tools that allow this for bitlocker?


msurgeon
New user
Posts: 71
Joined: 14.02.12
Reputation: 2 / (24)

Re: Bitlocker raw recovery

Postby msurgeon » 23.02.21, 18:38

DE will allow full decryption of the Bitlocker drive. You should see the drive letter with a unlocked padlock icon next to the drive letter. If you see this, then the drive has been decrypted. You can proceed with raw recovery if you see no files/folders.


LMDRO
Newbie
Posts: 2
Joined: 08.02.13
Reputation: 0 / (0)

Re: Bitlocker raw recovery

Postby LMDRO » 11.03.21, 01:48

thanks msurgeon for your reply. I assume you mean within windows explorer the unlocked padlock?

Do you have instructions on how to initiate a full decryption within DE? I can add a virtual bitlocker drive, but I see no options to initiate decyption.


msurgeon
New user
Posts: 71
Joined: 14.02.12
Reputation: 2 / (24)

Re: Bitlocker raw recovery

Postby msurgeon » 12.03.21, 22:31

As I said the decryption process is done within the Data Extractor program. You will see the padlock icon only within DE, not when you exit the program. Once the partition is unlocked it is decrypted. From that point work with the drive as you would any other. You can task into a Windows Explorer window but don't close DE.


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 1 guest