0

I was busy decrypting a drive when there was a power failure. After the power was restored, I was happy to see that the decryption process continued once I turned on the PC. It was short lived, as the decryption subsequently paused stating: "This disk has one or more errors. Run chkdsk /r"

The problem is that when I try to run chkdsk, it gives me the following error: "The type of the file system is RAW. CHKDSK is not available for RAW drives." This is an internal drive (not the boot drive) that was formatted as NTFS and then bitlocker was applied to the entire drive (not just the part that was used) with Windows 8.1.

Please advise how I can get the decryption to resume, or how to get CHKDSK to scan the drive. At this stage I can access the drive, but then it gives me a "cyclic redundancy check" error.

Improve this question
1
  • There isn't much that can be done. The way the decryption process works is data is decrypted sector by sector. You will need to restore your data from a backup
    – Ramhound
    Commented Aug 30, 2015 at 19:33

1 Answer 1

Reset to default
0

If you want to play with fire a bit (make sure you back stuff up first!) you can try editing the BitLocker metadata directly using a hex editor. The best way to do this is probably to boot into a Linux partition or LiveCD - I recently did this using SystemRescueCd - and then trying to figure out what's wrong on the disk and how to repair it.

The best public source of information about the BL metadata that I know of is in the source code for dislocker (an open-source FUSE driver for BitLocker). The header files are well-commented and will tell you how the various BL structures are laid out on disk, and how to find the offsets (start with the volume information header at the start of the partition).

The failure might be due to the BL metadata not being updated constantly as each block of the disk is decrypted. If that's the case, you'll need to figure out what block of the disk was currently being decrypted - the metadata will tell you this, the decryption happens back-to-front so the "encrypted_volume_size" field is the current location where decryption was occurring when the metadata was last updated - and go see what happened there. Unfortunately, actually repairing the damage will depend on where it is and what happened, and I can't promise it will be possible.

Improve this answer
6
  • Thank you for the reply. I do not believe that the problem is in the meta data, as it reports bad sectors. I think that even if I try to examine the metadata, I might still get issues due to the bad sectors.
    – WJK
    Commented Sep 9, 2015 at 12:07
  • What does manage-bde -status say about the drive (from a booted system)? chkdsk should be able to read through an unlocked BL volume just fine, and a partially-decrypted volume should be unlocked (meaning the decryption key for the still-encrypted parts can be determined from plain-text data) which means chkdsk should be able to read the file system on the disk.
    – CBHacking
    Commented Sep 9, 2015 at 22:12
  • manage-bde -status: Size: 931.51 GB; Bitlocker Version: 2.0; Conversion Status: Decryption Paused; Percentage Encrypted: 62,0%; Encryption Method: AES 128; Protection Status: Protection Off; Lock Status: Unlocked; Identification Field: Unknown; Automatic Unlock: Disabled; Key Protectors: Password; Numerical Password; External Key; External Key; External Key
    – WJK
    Commented Sep 11, 2015 at 9:49
  • Protection Off should mean that chkdsk (at least, the version included with recent Windows versions) can read the volume. That's the same state my drive was in a couple months ago, and chkdsk worked fine. If the volume or file system metadata were corrupted, I would not expect Windows to be able to read the volume at all. I'm sorry; I really don't know what's going on.
    – CBHacking
    Commented Sep 11, 2015 at 9:58
  • I appreciate all your feedback. I also do not know what is going on. I have tried it (chkdsk) on both Windows 8.1 and Windows 10 and neither would work for me and simply states that the drive format as RAW. I truly do think I am royally screwed, since BitLocker says I must run chkdsk to fix bad sectors, chkdsk says the format is RAW, I cannot convert RAW to NTFS, because the drive is encrypted. Catch 22!
    – WJK
    Commented Sep 11, 2015 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .