Data Inaccessible after turning off Bit Locker

[shashi0905]

Hello Guys,

One of my friend has an external hard disk, Seagate Backup Plus 1 TB. She encrypted the hard disk using bit locker, using a password. But when she tried to access those files from another computer, she got an 'Access Denied' permission.

We tried to changing the permissions, taking ownerships of the folder and files, but it didn't work.
So finally I turned off Bit Locker. But even after completing the decryption process, the files remain Inaccessible.

The computer (and the corresponding user), where initially bitlocker was setup, is no longer available. And she didn't have any idea about backup keys either.

I tried to use EFS recovery application, it lists down the files as encrypted but I couldn't decrypt them as I didn't have the key, And I couldn't find the option to decrypt them using the password.

We only have the password that was used to setup the BitLocker. Is there any way to recover the files now, or they are gone ??

 

[DR_Luke]

If you went through the full long decryption process, either the sectors are decrypted or you scrambled them up even more. At this point, are you able to recover any files using R-Studio or any other data recovery program?

 

[Solandri]

The password is not sufficient to decrypt the files. It's hashed against a randomly generated key to encrypt the files. This key was stored on the original computer, and was supposed to have been backed up elsewhere in case of situations like this (original machine destroyed or inaccessible). Unless you have that key, the files are as good as gone.

I learned this the hard way when I reinstalled Windows - all my financial records for about 5 years were encrypted, and I unwittingly erased the only copy of the key when I reinstalled.

I'm a little surprised Windows went through the motions of decrypting the files without the key when you turned off Bit Locker. I would hope against hope that the key was somehow stored on the drive itself, instead of the OS drive, and the decryption was successful. Browse one of the files with a binary editor and see if the data is decrypted. e.g. the first few bytes of a JPEG file will include "JFIF" to indicate the file is in JPEG file interchange format. (Assuming Bit Locker encrypts the entire file's binary data - for all I know it could leave the first few bytes alone to make file type recognition easier.)

https://en.wikipedia.org/wiki/Magic_number_%28programming%29#Magic_numbers_in_files