Unlock External HD after locker has been deleted

3

0

I used lockMyDrive software in order to lock my external hard drive. The software locates the interface, where the user should insert the password, in the external hard drive itself. Everything was good until one day I accidentally deleted this .exe file. I know the password but there is no interface to insert this password.

I tried to install the software again but it did not recognize the password. I even tried to create another account but it did not allow me. The hard drive looks empty (no files at all are shown) although there are around 200 GB stored there out of 250GB total space. When I check the properties I can see there is 200GB full but when I open it there is nothing there. It used to be like this but when I open it there is this .exe file where I can open it and unlock the drive and then all files and folders appear.

The major issue is that the software itself is not supported anymore and their website does not open here.

Someone advise me to use some tools that extract data at the bit level. In fact I'm not sure if that is a good advice as I'm no expert in these tools. Another friend advised to use any tool and decrypt data you might get your data or you might double encrypt it instead, just give it a shot!

The data in my HD drive is all very valuable of 10 years archive. I cannot take a chance. I know I should have had another copy. To be honest I used to have a copy on my computer and a copy on the hard drive. It is just my bad luck that the accident happened in the week in which I formatted my computer.

If there is any way you advise me to use, I'd deeply appreciate your help.


Result

I tried the free versions of Mini Tool and Recuva suggested by harrymc. In addition, I tried Recover My Files suggested by saeed-em.

  • Recuva: It did not recognize the locked data at all. Only 5MB partition where the locker was installed. So I eliminated.

  • Mini Tool: gives me at the beggning unreasonable size of recovered data (~48TB). However, when I went through the folders one by one, there was only one folder causing this problme, specifically one file. When I unticked it, the size was nearly normal 223GB of recovered data. However, I could not view any of the files prior to save them (which is impossible apart from 1GB allowed in the free version).

  • Recover My Files: When I ran the automatic option, it recovered only 23GB. I ran once again using (full scan) option, and returned 70GB only, which much less thay my data (~232GB). In addition I tried the manual option where I can choose the files extension I'm looking for. Since I am not ware of all files types that I had on my HD, I had to tick all available extensions. However, this took 12 hours to scan 6% of the total drive (there is an indication how that ticking more option will significantly slow down the scan process). The great positive thing about Recover My Files, is without buying it, you can preview the recover photos. It is great feeling to see some old photos, even if you cannot save them to your computer, after long time of thinking that you had lost them forever.

It was tough decision which one to buy. Given the notes above I decided to buy Mini Tool. I here let you know that I recovered 223GB of my files. I cannot tell that I recovered every single file was locked as it is impossible to remember what was there. But after skimming the recovered data, I can say the only noticable loss the files names (renamed in sequence such as file1, file2 ... etc.).

Thank you guys for your help. I hope everybody has the same issue can benefit from this question.

N.B.: For who ever wants to down vote, please at least mention the reason

Hawk

Posted 2014-11-10T12:40:23.890

Reputation: 99

1try to open the hard drive in Linux and delete the copy that was on the hard drive may be that would help. – Kunal – 2014-11-10T12:43:55.833

1If the files are not encrypted, then just boot into any linux live distro and retrieve them. After that verify the files and format the drive. This will also give you a good understanding of how useless programs like LockMyDrive are – Art Gertner – 2014-11-10T13:30:13.927

@smc I openned the HD using ubunto and I found only two folder one $RECYCLE.BIN and the other System Volume Information I removed them. Then I openned in windows again and there was another folder .Trash-1000 which seems contains information about the removed folders. Windows shows only 3MB used out 5MB. Means the rest of hard drive (250GB) still locked. Am I missing something here? – Hawk – 2014-11-12T00:52:39.787

@Pankaj I openned the HD using ubunto and I found only two folder one $RECYCLE.BIN and the other System Volume Information I removed them. Then I openned in windows again and there was another folder .Trash-1000 which seems contains information about the removed folders. Windows shows only 3MB used out 5MB. Means the rest of hard drive (250GB) still locked. Am I missing something here? – Hawk – 2014-11-12T00:53:14.630

I read that it has two modes of encryption in the editors review on cnet. Did you use the "strong" or the "fast" mode of encryption? (just guessing that the fast may be just partitioning the drive or something like that).

– adgelbfish – 2014-11-18T07:12:37.107

Answers

3

You should not delete anything from the disk or modify it in any way, because such an action could void any chance of recovering the data. You should also not have reinstalled Lockmydrive, because that probably lost the information about the hidden files. You should rather have installed Lockmydrive on another computer and returned the deleted .exe.

There are two Lockmydrive versions, quote:

The program is available in 2 versions: LMD Instant to hide/lock all files on a drive and LMD Strong to hide/lock specific files and encrypt them by 1 of the 2 offered encryption methods (INSTANT CRYPT for immediate encryption and STRONG CRYPT for enhanced and more reliable encryption).

If you have used the Strong version, then all is lost. Only Lockmydrive can decrypt and recover the files.

But if you have used the Instant version, then using some disk-recovery program might bring back some of the data.

See the article Best Free Data Recovery and File Un-delete Utility for recommendations, among which are :

MiniTool Power Data Recovery ($69) - Very effective tool. The free version can recover 1 GB of files, try it first.
Recuva - Somewhat more limited in capability.
TestDisk - A command-line utility that does not have a GUI interface.
PC Inspector File Recovery - Has a deep-scan method of the disk which might help.
Puran File Recovery

As we do not know how Lockmydrive hides the files, it is worth trying all these utilities. If some of the files are recoverable, recover then to another disk. Do not write anything to the disk in question until you have recovered your files.

Once you have finished with the disk, I suggest to reformat it before using it for other purposes.

harrymc

Posted 2014-11-10T12:40:23.890

Reputation: 306 093

Thanks @harrymc, I tested MiniTool free version and you are right. I was able to recover 1GB to my computer hard drive. There is a small problem I am trying to work out, that is the total data size has been found by this tool is ~48TB, which is an unusual size. I even tried to filter by date of creation to the last 10 months and still giving me the same size. I would need to read further through the documentation. – Hawk – 2014-11-19T01:10:56.493

Most such tools find too many deleted files, or sometimes the chains of disk sectors of the deleted files cross one another and the files become too large. I suggest rescuing first the files of normal size. The others might have data appended or be total rubbish. Sometimes for text files the real text is at the beginning, or an image may still display correctly in an image editor and one can re-save it, but these are rare. A file larger than the disk free space is probably lost. Be careful to leave some free space on your system disk or Windows might crash (about 1 GB should be enough). – harrymc – 2014-11-19T08:21:33.907

1

I've had problems like this for 2 times on both Internal and External Hard Drives. if you Really want to get your data back safe and sound like i did, here is what you should do:

  1. Stop writing to the Drive or using free recovery software, even if they recover some files, the file names will all be scrambled. Use Recover My Files program. it's free to search and recover your files but to save the recovered files you have to buy the program or use any other way,that i know, if you want it for one time usage. it will definitely recover the whole drive using Raw recovery option along with the file needed to enter the password you accidentally deleted. just need to do a full scan that can take some times. you can use it even if your hard drive is corrupted.

  2. if you managed to recover your files using that program but the files are still locked, use "Passware Kit Forensic 13.5" to unblock the files and it'll be fast because you know the password.

  3. if above options did not work for you, you can use a couple of the thousands features of Kali Linux to search, recover or unblock your files but that takes some advanced techniques.

user326006

Posted 2014-11-10T12:40:23.890

Reputation:

I used the free trial for testing. I can see it can read my files, I can view the images at least in the software browser but cannot save them to my computer. Before I proceed to buy it, by seeing my files, does mean it still might be locked and need Kit Forensic? – Hawk – 2014-11-18T14:09:40.637

if you see ALL of your files listed in there then that program can successfully save them too but be careful about file names, depending on the program you use the file names may be scrambled or get a prefix/suffix and that can cause problem if for example you have software setups in your HDD. save them and then you'll know if you need Foresonic kit but i guess it's already unlocked if the recovery software can see them. – None – 2014-11-18T14:17:15.653

@hawk: I have never tested Recover My Files, but as they cost about the same I would suggest also testing MiniTool Power Data Recovery. I had recently a bad USB key and it was the only one to see my files among all the products that I listed in my answer. – harrymc – 2014-11-18T15:55:03.770