0

The data on my hard disk was deleted from an encrypted bitlocker hard disk. After deleting the data, a new partition including a new installation of windows was created on the same hard disk. The key to the original bitlocker encrypted data is available.

Using commercial software for data retrieval has proven to be difficult. Is it possible to retrieve the lost data? If it is, what needs to be done to retrieve it?

Katt
  • 103
  • 1
  • Yes, it is possible to retrieve data that hasn't been overwritten. You need to know (or find out) exactly where your partition began (to use the sector's number for the sector keys), and then decrypt everything. Through decryption, the newer windows's files becomes garbage, and your files become visible to normal recovery tools. However, if there is no tool that does it for you, you have to write your own. Bitlocker works block-wise, so in theory it is possible to retrieve some parts when other parts were lost. – user10008 Nov 18 '14 at 01:32

1 Answers1

0

Unfortunately I think it's highly unlikely that you'll be able to recover any of the original encrypted data. Even if the data wasn't encrypted, the new installation of Windows would have overwritten many of the original files. The encryption that was originally there makes it nearly impossible.

Commercial data recovery software works by scanning empty portions of the hard drive for certain file signatures that would signal the start and end of a file. For example, JPG images always start with "FF D8 FF E0", so if the data recovery program sees this sequence of bytes in the disk, it would know that this is the start of a JPG image and proceed to attempt recovery. If the data is encrypted, however, data recovery software will not be able to find any signatures because all of the data will be scrambled. It will have no way of knowing whether a sequence of deleted bytes is data that was originally encrypted, or just a random sequence of nothingness.

Even if you could extract all of the remaining encrypted data on the HDD, it probably won't be decryptable because you'll still be missing the parts that were overwritten by the new Windows installation.

tlng05
  • 10,244
  • 1
  • 33
  • 36