How to recover BitLocker encrypted partition that is now 'unallocated'/'free space'?

My hard drive had five partitions, including one some 4-5 GB BitLocker encrypted one. When I used Disk Management I could view two partitions (24.4 GB and 8.94 GB) in green colour labelled Empty space.

So, I wanted to merge them and I used MiniTool partition wizard for the purpose. I don't know what that software did, but all I was left with was two partitions and lots of green free space.

I recovered two partitions using EaseUS partition master, but the BitLocker encrypted partition cannot be searched by it, nor by MiniTool partition recovery.

Now, the Disk Management shows a free space partition and an unallocated partition, of 28.36 GB and 8.94 GB, respectively. Here is a screenshot:

Please, tell me a way to recover the BitLocker-encrypted partition that is showing as a free space in Disk Management.

Atishay Jain

Posted 2012-05-27T04:39:50.810

Reputation: 21

Answers

BitLocker cannot be recovered without the certificate created with it, and the data currently in tact. That's part of their security.

Canadian Luke

Posted 2012-05-27T04:39:50.810

Reputation: 22 162

So, wouldn't it work even if I have the recovery key?? – Atishay Jain – 2012-05-27T06:01:26.293

You would need an exact image of the data to apply the key to – Canadian Luke – 2012-05-27T07:16:07.283

Chances of recovery occur bleak now.

Will Microsoft support be of some help? – Atishay Jain – 2012-05-27T13:03:36.177

2Just to tell you to backup next time, or don't touch partitions – Canadian Luke – 2012-05-27T17:25:48.963

You can try Hasleo Data Recovery, a professional data recovery software which allows you to recover data from accidentally formatted or deleted BitLocker encrypted drive. Unfortunately, it is also a commercial software.

Jerry ZJM

Posted 2012-05-27T04:39:50.810

Reputation: 1

The answer is M3 Bitlocker Recovery Free that is a commercial software. In the free version you can recover only 100MB of your lost data.

Omid Ebrahimi

Posted 2012-05-27T04:39:50.810

Reputation: 203

Assuming that only the volume header was lost (as opposed to the volume contents) you may be able to reconstruct the volume. The critical info, the actual BL headers, isn't stored at the start of the partition. However, the offsets of those BL headers (they are replicated a few times) are stored in the volume header. You'll need to find them again in order to reconstruct the header. Fortunately, they start with a distinctive "magic number" - the string -FVE-FS- that you can scan the partition for. You can try resurrecting your volume using the on-disk structure layout described here: https://github.com/Aorimn/dislocker/blob/master/src/metadata/metadata.h. Note that it's incomplete, so you may need to cross-reference with other BL drives to figure out the expected values. I was able to repair a damaged BL volume, with the help of this information, using a hex editor in a Linux LiveCD.

CBHacking

Posted 2012-05-27T04:39:50.810

Reputation: 5 045