How can I recover data from a bitlocker encrypted volume (with the decryption key)?

Question

I have a backup drive that is used mostly for that purpose: to backup data from my computer. I did move data onto it temporarily at some point, but I believe and I hope I've moved it back off in the meantime. It's protected by bitlocker. When I was away and someone was house-sitting, they connected their Android tablet to a port replicator that the backup drive was connected to, and inadvertedly told Android to "fix" the drive (because Android doesn't recognize NTFS formatted drives, much less those protected by bitlocker), which formatted it as exFAT. It couldn't have been a deep format, because she didn't have it connected for long. Meaning: it should be possible to recover the data, right?

Here's what I have:

• The full bitlocker recovery ID
• The bitlocker recovery key
• The data on my computer used to automatically unlock the drive - however that could be extracted.
• The drive itself (obviously)

I've tried scanning the drive with Recuva, which didn't give me anything usable. I didn't have any option to enter any encryption keys, so it honestly couldn't have worked.

I then tried using repair-bde.exe, supplying it with the recovery key and a seperate drive (~twice the size of the original drive) to copy the recovered data to. It gave me this response:

ERROR: The input volume has suffered damages to critical information related to the decryption key. Please try the -KeyPackage option to specify a key package. The volume may not be recoverable.

What other options do I have? (I am also slightly worried about the fact that I currently am not backing up my computer until I get this resolved, because I don't want to overwrite anything that could still be recovered.)

I'm on Windows 10 Enterprise.

Answer 1

It couldn't have been a deep format, because she didn't have it connected for long. Meaning: it should be possible to recover the data, right?

No, unfortunately not.

The recovery key (as well as the stored auto-unlock key) does not decrypt your disk directly; it only decrypts the real encryption key that's stored in the BitLocker header, which is at the very beginning of the partition.

So if that part of the disk was overwritten (such as by writing a new FAT filesystem on top of it), the rest of the BitLocker volume becomes unrecoverable. Yes, the rest of your data is technically still there on the disk, but you no longer have the key to decrypt it.

Answer 2

The intention of the Bitlocker designers was to make it as resilient as possible to disk problems. Therefore the disk headers are duplicated on the disk. Some products claim being able to recover such disks, but they are very costly. I found only one product that is free as described below. Whether the disk can be recovered or not depends on the amount of destruction that was done.

The article How to Recover Files from Formatted Hard Drive (2023) says that "EaseUS Data Recovery Wizard Free can recover files from formatted drive free on Windows and Mac computers".

Among the features is listed :

Unformat hard drive and repair the RAW drive (BitLocker encrypted drive)

Try this product. It's free and you have nothing to lose.

Answer 3

It's possible that you might have some luck with dislocker (particularly the dislocker-metadata program). There might be multiple copies of the essential blocks.

For instance, you can use something like this:

# Show metadata for a BitLocker volume.  Hopefully it will recognize something.
dislocker-metadata -V /dev/sdd1

# Mount a USB thumbdrive protected by BitLocker.
mkdir ~/bl-data                                 # dislocker puts a virtual decrypted image here.
dislocker --user-password /dev/sdd1 ~/bl-data   # Unlock the volume.

mkdir ~/files                                   # This will be the real mount point.
mount -t ntfs3 ~/bl-data/dislocker-file ~/files # Mount the actual NTFS file system using a loop device.

# Unmount the volume.
umount ~/files                                  # Unmount the file system.
umount ~/bl-data                                # Close dislocker.