1
Due to all the security hype about TrueCrypt I decided to try out VHD + BitLocker to create encrypted containers. This test went OK for a few days. I used this drive just yesterday with no issues.
Usually when I mount the VHD Windows 8.1 will prompt me to type in the BitLocker password. It did not do this today. I looked at Disk Management, and it sees it as a RAW partition now.
Here's a look at the partitions it has now:
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Reserved 128 MB 17 KB
* Partition 3 OEM 992 KB 128 MB
Partition 2 Primary 99 GB 129 MB
In a hex editor, I see what looks like the typical windows boot loader. However, I also see this information that appears to be about the partitions:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0000000430 00 00 00 00 00 00 00 00 4D 00 69 00 63 00 72 00 ........M.i.c.r.
0000000440 6F 00 73 00 6F 00 66 00 74 00 20 00 72 00 65 00 o.s.o.f.t. .r.e.
0000000450 73 00 65 00 72 00 76 00 65 00 64 00 20 00 70 00 s.e.r.v.e.d. .p.
0000000460 61 00 72 00 74 00 69 00 74 00 69 00 6F 00 6E 00 a.r.t.i.t.i.o.n.
0000000470 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000480 A2 A0 D0 EB E5 B9 33 44 87 C0 68 B6 B7 26 99 C7 ¢ Ðëå¹3D‡Àh¶·&™Ç
0000000490 95 C4 1D F2 FE 73 31 43 B0 04 5C 6E 59 14 0E D2 •Ä.òþs1C°.\nY..Ò
00000004A0 00 08 04 00 00 00 00 00 FF F7 7F 0C 00 00 00 00 ........ÿ÷......
00000004B0 00 00 00 00 00 00 00 00 42 00 61 00 73 00 69 00 ........B.a.s.i.
00000004C0 63 00 20 00 64 00 61 00 74 00 61 00 20 00 70 00 c. .d.a.t.a. .p.
00000004D0 61 00 72 00 74 00 69 00 74 00 69 00 6F 00 6E 00 a.r.t.i.t.i.o.n.
00000004E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000004F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000500 A1 AE ED 38 D5 E0 88 48 A9 70 8E 03 E6 0B F0 6A ¡®í8ÕàˆH©pŽ.æ.ðj
0000000510 C1 62 12 46 05 5D DD 42 9C F0 39 1D 34 FE 91 12 Áb.F.]ÝBœð9.4þ‘.
0000000520 40 00 04 00 00 00 00 00 FF 07 04 00 00 00 00 00 @.......ÿ.......
0000000530 01 00 00 00 00 00 00 00 4D 00 63 00 41 00 66 00 ........M.c.A.f.
0000000540 65 00 65 00 45 00 70 00 65 00 52 00 65 00 73 00 e.e.E.p.e.R.e.s.
0000000550 65 00 72 00 76 00 65 00 64 00 00 00 00 00 00 00 e.r.v.e.d.......
Has McAfee Endpoint Encryption somehow also encrypted my BitLocker encrypted container? Or does Microsoft Bitlocker have McAfee technology under the hood?
In any case, how can I recover what remains of my data? Looking at the raw data on the drive, it is not just blank space.
I have tried repair-bde
with both the password and the recovery key, but both give no results.
Any help would be much appreciated.
Microsoft
andBitlocker
has nothing to do withMcAfee Endpoint Encryption
which is third-party software. It does indeed look like at some pointMcAfee Endpoint Encryption
also encrypted the file. Try and decrypt the file withMcAfee Endpoint Encryption
– Ramhound – 2015-03-12T11:11:23.557Are there any other signs I can use for to tell for sure if McAfee encrypted the drive, or if it's just the partitions that got messed up? – Origin – 2015-03-12T17:06:35.750
The information you provided is enough confirmation for me. Check the application's logs if those exist or simple decrypt the file, like you normally would. – Ramhound – 2015-03-12T17:11:52.293