How to recover a deleted partition, which was encrypted with BitLocker

[rajiev555]

Hey TechWizs,

I had Windows 7 on my lap (with Ubuntu as dual boot). I encrypted a 120GB (drive E: ) partition with BitLocker (without the use of a TPM). Then I’ve decided to install Windows Vista SP2 Ultimate.

Once I installed Vista Ultimate, The Encrypted drive was shown but it said that I can’t decrypt the drive cos I don’t have a TPM. (That time I didn’t know I can use BitLocker in Vista without a TPM by editing group policy). While trying to fix it with several reinstallations of Windows 7 and Vista, I reinstalled Ubuntu too.

After the Ubuntu Installation the encrypted partition was gone although I didn’t formatted the partition, now the 120GB partition is shown as unallocated space in disk management utilities 😱 I think the Ubuntu installation messed up the partition table cos it couldn’t identify the encrypted partition.

I’ve tried several data recovery and partition recovery tools (like File scavenger v3, TestDisk, EasyRecovery Professional) but didn’t work. The files recovered by EasyRecovery pro aren’t my files (I think cos the drive was encrypted). TestDisk couldn’t identify the encrypted partition either.

One of my lecturers suggested that if I could edit the partition table manually and entered the exact partition type for a BitLocker encrypted partition, the windows might start to show the encrypted partition again and then I could decrypt it again with BitLocker.

So

1. Can I recover my data in the encrypted partition? (Will losing a single byte make the total partition un decryptable?)
2. What are the good software which I can use to recover the partition and/or edit the partition table?
3. What is the partition type code for a BitLocker encrypted partition?
4. What are the software I can use to low level copy the data (bit pattern) in the lost partition? Bit by bit or sector by sector?


Pls help me guys. I had some personally valuable data in that partition.

 

[fowang]

Sound like you will have to format the partition to allocate the space and try recovering the data that way. AND USE QUICK FORMAT!

But even at that the data you will be revcovering will be encrypted too :S it sounds like a bit of a head melter!
GLHF

 

[rajiev555]

OK

Problem Fixed.

Here's the details.

First, THe problem was with Microsoft. They can Even Make two versions their own software compatible. BitLocker for Vista nad BitLocker for Windows 7 are completely (well Not that different) to different stories. Vista Bitlecker is too secure paranoid and has limited chance of recovery if you screw things up 😛 And It demands a lot of things (TPM, seperate partitioning ... blah blah blah..). ANd Vista's version is not soo compatiible with Win 7. Win 7 version is soo much cool and forgiving

So What I did was....

Fisrt used a another machine and crated a bitlocker partition with windows 7. Just to check how the partition header sector will look like. Then I used a tool that can view the actual hex data.
What Has happend was that, when Linux installation couldnt identyfy the beitlocker partition header It agestted that partition and there was a empty sector before the real starting sector.

So What we did was edited the first few bits of the partition and make it looks like a NTFS partition.

Then use testDisk to edit the partition table and register my partition.

restarted, and Vista Showed my partition as a bitlocker encrypted partition.

Then, used the Windows 7 installation CD and used its recovery console to unlock the partition.
or
reinstall windows 7 and decrytpted the whole drive and reinstalled the vista back again 😉

 

[OzY360]

rajiev555 can you show me what you did to sort this issue out because im in the exact same situation as you. I had windows 7 ultimate 64 bit and i wanted to dual boot that with windows xp home. I wanted to use the xp partition for gaming the the windows 7 partition for work. Anyhow, i had encrypted my portable media drive using bitlocker and i forgot to take it of and back my stuff up before things got screwed up. I thought what i was trying to achieve is relatively easy but clearly i was wrong because dumb windows cant do anything right 😡 now i have a portable media drive which is the only copy of all my files that i really need. Don't worry about using tech as i'm a computer science undergrad as well

 

[OzY360]

the main thing i want to know is how you got windows vista to show the partition as a bitlocker encrypted partition. i can recover and decrypt the data from there using bitlocker repair tools as i still have the recovery key =D. i just need to get past the point where the drive shows up as unallocated space!

 

[OzY360]

please help me some 1 i desperately need to know how to view and edit hex information so that vista shows my partition as a bitlocker partition.... only then i can use bitlocker recovery tool to get my stuff back

 

[Guest]

hi there,
I'm also in a bit of a dilema here, this is what hpnd in short,
I have dual boot, one windows 7(64bit) and the other vista(32bit), i normally work on windows 7 and vista is sort of a backup OS which i wanted to use if anything did happen, coz windows 7 was still RC, recently windows 7 crashed and i couldn't get it to boot, tried all the basic steps like chkdsk /r thru Vista but still didn't work.
I have 2 HDD with 4 partitions [C:/D:&/E:/F:], with windows 7 installed in C: and Vista installed in E:, i used bitlocker to lock C: & E:.
Problem now is that since windows 7 crashed and even though i'm able to boot into windows Vista, the 2 bit locker drives can't be accessed, it is not even showing that the drives are locked, i did format D: thinking i could recover the data, but that proved to be wrong, and i don't want to do the same mistake with F:
would u mind telling me how to decrypt F: or atleast a method which would show F: as locked by bitlocker so that i can put the password to unlock it!
Thanks, waiting for ur reply

OK

Problem Fixed.

Here's the details.

First, THe problem was with Microsoft. They can Even Make two versions their own software compatible. BitLocker for Vista nad BitLocker for Windows 7 are completely (well Not that different) to different stories. Vista Bitlecker is too secure paranoid and has limited chance of recovery if you screw things up 😛 And It demands a lot of things (TPM, seperate partitioning ... blah blah blah..). ANd Vista's version is not soo compatiible with Win 7. Win 7 version is soo much cool and forgiving

So What I did was....

Fisrt used a another machine and crated a bitlocker partition with windows 7. Just to check how the partition header sector will look like. Then I used a tool that can view the actual hex data.
What Has happend was that, when Linux installation couldnt identyfy the beitlocker partition header It agestted that partition and there was a empty sector before the real starting sector.

So What we did was edited the first few bits of the partition and make it looks like a NTFS partition.

Then use testDisk to edit the partition table and register my partition.

restarted, and Vista Showed my partition as a bitlocker encrypted partition.

Then, used the Windows 7 installation CD and used its recovery console to unlock the partition.
or
reinstall windows 7 and decrytpted the whole drive and reinstalled the vista back again 😉

 

[rajiev555]

I'm really sorry guys, for the delayed reply :S

I hope you still want a reply.

First I got bad news for Anon. The chance of recovering your formatted partition is really slim. If you can copy that partition bit by bit to another drive, and if you are 100%, you might have a chance.

Here I'm gonna give an answer based on what worked for me.

First install windows 7 in a separate partition/drive or boot up from installation DVD of windows 7. Booting up from installation DVD will automatically detect Bit Locker encrypted partitions.

KEEP IN MIND THAT VISTA IS USELESS IN RECOVERING BITLOCKER PARTITIONS the Bitlocker technologies used in Vista and & is totally different (VISTA being so dumb)

When you have a running Windows 7 session, it should show those encrypted partitions as BirLocker partitions again. the nice recovery console comes with Win7 automatically mounts the encrypted partition, so you can use it to copy the data to a backup drive

But to do these you must have the 48 digit BitLocker recovery key This key is given to you when you finished encrypting your drives for the first time. If you were too lazy to save it or write down that, then say good bye for your data as it says there is NO back doors for ( I mean intentionally developed by Microsoft ) BitLocker.

Pls Do write if you need further assistance.

I'm really surprised that Microsoft is not giving any good help on this matter, yet 😱 (once again, one shouldn't expect such from MS 😛 )

Rajiev Ranasinghe

 

[rajiev555]

please help me some 1 i desperately need to know how to view and edit hex information so that vista shows my partition as a bitlocker partition.... only then i can use bitlocker recovery tool to get my stuff back

I'm really sorry guys, for the delayed reply :S

I hope you still want a reply.

First I got bad news for Anon. The chance of recovering your formatted partition is really slim. If you can copy that partition bit by bit to another drive, and if you are 100%, you might have a chance.

Here I'm gonna give an answer based on what worked for me.

First install windows 7 in a separate partition/drive or boot up from installation DVD of windows 7. Booting up from installation DVD will automatically detect Bit Locker encrypted partitions.

KEEP IN MIND THAT VISTA IS USELESS IN RECOVERING BITLOCKER PARTITIONS the Bitlocker technologies used in Vista and & is totally different (VISTA being so dumb)

When you have a running Windows 7 session, it should show those encrypted partitions as BirLocker partitions again. the nice recovery console comes with Win7 automatically mounts the encrypted partition, so you can use it to copy the data to a backup drive

But to do these you must have the 48 digit BitLocker recovery key This key is given to you when you finished encrypting your drives for the first time. If you were too lazy to save it or write down that, then say good bye for your data as it says there is NO back doors for ( I mean intentionally developed by Microsoft ) BitLocker.

Pls Do write if you need further assistance.

I'm really surprised that Microsoft is not giving any good help on this matter, yet 😱 (once again, one shouldn't expect such from MS 😛 )

Rajiev Ranasinghe

 

[abdking1987]

Dear rajiev555

thank you for helping

I have drive on my hard disc (f contains my important data , and I encrypted it using bitlocker program which comes with windows 7 , accidently the drive had been formatted and the drive was locked (data is encrypted), I tried to recover the data using some recovery software but it's not Working because the data is encrypted and the SW can't see the data , please rajiev555 help or advise me to solve that disaster you look have good knowledge on these things, I lose very much important data and I don’t have backup .
Note: I have the password and the recovery key that decrypt the drive but i don't know how to use it because the drive after format back to its normal condition (bitlocker set off)

 

[Dark Lord of Tech]

abdking1987 , start a new thread,this one is 2 years old