1

I have a big problem. I inadvertently deleted a partition, which I had installed win7 BitLocker Crypt, so the entire partition was encrypted. I found a recovery tool which is called "DiskInternals EFS recovery", that we managed to access my data from the lost partition but I had not recovered because I have low space to my hdd, so we left on later.

The problem is that I tried to install another operating system on another partition of the same hdd and I think I've broken the partition table and I overwrite all, or part of BitLocker header, so I cannot access data on it. The program recognizes my 51 GB, which is encrypted partition.

I have .bek key and key recovery.

So, full volume encryption key (FVEK) is situated in a location in BitLocker header, which in turn is encrypted with the volume master key (VMK, I think this is hash function) and the latter is encrypted (or generated from) the my recovery key or password etc. The question is can I recover the bitlocker header of the encrypted volume? This starts with the "-FVE-FS-" signature. From my knowledge, I can use an hex editor for this but I don't think I will succeed, because I don't have the encryption key.

So I delete/overwrite the entire or partial of bitlocker metadata? Where is location of the encripted key in the bitlocker metadata? Usually when I format the partition all partition metadata is erased? Bitlocker protect the encryption key from this unpleasant events? I do not have valuable data and want to reuse the partition. So, they can do anything?

eightShirt
  • 303
  • 1
  • 3
  • 12
user77600
  • 11
  • 1

0 Answers0