[SOLVED] Is there any hope my Bitlocker key is still in TPM/Memory?

Status
Not open for further replies.
Aug 28, 2020
2
0
10
I think I might be hosed, but I am wondering if any encryption experts can give me a few pointers:

Around December 2019, I was trying to add a linux partition alongside my Windows install on my SSD, and wouldn't you know it, I messed up my boot partition. I was able to rebuild the boot partition using the command line, but as my Windows partition was encrypted, it didn't properly utilize the encryption key.

I'm sure there would've been a way to properly bake that into the partition, but this encryption was all new to me and I really didn't have a lot of time to learn about it. This computer is my daily driver and I needed to get it up and running ASAP.

So I saved the encrypted partition into a virtual one, transferred it to an external hard drive, and started over with a fresh Windows install on the SSD. Now I have some time to take a look at that encrypted partition. I didn't lose much, except for some really cool videos I took doing some foreign travel. I'd like to get those videos back if possible.

I've dug around and cannot find my key on the Microsoft website and if I saved the key as a pdf, I think I saved it inside the now encrypted partition. 🤦‍♂️

Having been using the new Windows install for 8 months now, is there any hope of using an extraction tool to find the old key in the TPM or Memory? I can't imagine the system preserved those. But I'm not an expert on how Bitlocker works....

Thanks for any insight!

EDIT: Just to confirm, my PC does use TPM.
 
Solution
As a last ditch effort, I just looked around and realized I never set up bitlocker encryption on my new OS. In my mind, that means the encryption key should have remained untouched on the TPM. Could that be true? If so, is there a way to put the locked partition somewhere\tell Windows Boot Manager to use what's still on the TPM to unlock the encrypted partition?
Nope. You've broken the chain. Unless you manage to find the recovery key that data is permanently locked.
Aug 28, 2020
2
0
10
If you didn't save the recovery key, either by writing it down or saving it on a thumb drive, then the data is gone. You cannot get the key out of TPM. If it were that simple there wouldn't be any advantage to encryption.

As a last ditch effort, I just looked around and realized I never set up bitlocker encryption on my new OS. In my mind, that means the encryption key should have remained untouched on the TPM. Could that be true? If so, is there a way to put the locked partition somewhere\tell Windows Boot Manager to use what's still on the TPM to unlock the encrypted partition?
 
As a last ditch effort, I just looked around and realized I never set up bitlocker encryption on my new OS. In my mind, that means the encryption key should have remained untouched on the TPM. Could that be true? If so, is there a way to put the locked partition somewhere\tell Windows Boot Manager to use what's still on the TPM to unlock the encrypted partition?
Nope. You've broken the chain. Unless you manage to find the recovery key that data is permanently locked.
 
Solution
Status
Not open for further replies.