PC-3000 Forum

I have a drive that is encrypted with Bitlocker. I've got the encryption key based off the key ID. manage-bde -unlock (drive letter) -rp will not accept the key, however when creating a virtual encrypted bitlocker drive on the Data Extractor, It does accept the key. I see no files or folders within the data extractor. Past experience has not let me run a Raw Recovery on encrypted bitlocker drives without first decrypting them. However Bitlocker's manage-bde not accepting the key prevents me from decrypting the drive.

Can the Data Extractor actually decrypt so that I can attempt a raw recovery?

With Mcafee Endpoint Encryption, I was able to force a decryption regardless of if I had the correct key or not. Are there any tools that allow this for bitlocker?

DE will allow full decryption of the Bitlocker drive. You should see the drive letter with a unlocked padlock icon next to the drive letter. If you see this, then the drive has been decrypted. You can proceed with raw recovery if you see no files/folders.

thanks msurgeon for your reply. I assume you mean within windows explorer the unlocked padlock?

Do you have instructions on how to initiate a full decryption within DE? I can add a virtual bitlocker drive, but I see no options to initiate decyption.

As I said the decryption process is done within the Data Extractor program. You will see the padlock icon only within DE, not when you exit the program. Once the partition is unlocked it is decrypted. From that point work with the drive as you would any other. You can task into a Windows Explorer window but don't close DE.