trying to recover deleted files from two Bitlocker drives


Fra

New member
Local time
1:46 AM
Posts
2
OS
Windows 10
Hi all

I'm trying to recover videos from 2 external USB drives with Bitlocker (one Seagate Backup Plus 4TB, and one Western Digital My passport Ultra 4TB) but results are quite bad.

After deleting the files (SHIFT+DEL) I did not write on the disks, so there shouldn't be any overwriting; nevertheless, recovery results are poor. I tried with at least 10 recovery software and more or less all of them are able to identify the same number of files on both disks, but when I attempt to recover them the larger Mp4 or MOV files are unplayable. Majority of them.

I can open the smaller AVI videos, but not the larger Mp4/MOV (larger than 1GB). I tried to open them on some HeX editor and the content appears mixed: no Mp4 signatures, no atoms, and no signs that they are video files, although they match in size the original files.

So, I'm wondering why this happened? Has it anything to do with BitLocker? Is there any possible way to try to restore my files? I tried the majority of the data recovery programs AND video repair programs but nothing worked.

I suspect the problem lies in how these files are located/recovered. Maybe is Bitlocker messing up? What to do then?

any help will be greatly appreciated, thanks

(I use Windows 10 version 1909)

Fra
 

My Computer

System One

  • OS
    Windows 10

glasskuter

Well-known member
Pro User
VIP
Local time
12:46 PM
Posts
2,224
Location
The Lone Star State of Texas
OS
Windows 11 Pro 21H2 22000.832
Bitlocked drives cannot be accessed without the bitlocker key. That's the whole purpose of a user using bitlocker, to protect his information. Without the key, there's no way around it. There is file recovery software that can be used on bitlocked drives, but you still have to have the bitlocker password or 48 digit recovery key.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 21H2 22000.832
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    256 m.2 2230-256+1 tb hdd
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 10 Pro 21H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 9020
    CPU
    i7-4770
    Memory
    24 gb
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    256 gb Toshiba BG4 M.2 NVE SSB and 1 tb hdd
    PSU
    500w
    Case
    MT
    Cooling
    Dell factory
    Mouse
    Logitech wireless
    Keyboard
    Logitech wired
    Internet Speed
    still not telling
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium

cereberus

Well-known member
Pro User
VIP
Local time
6:46 PM
Posts
2,249
OS
Windows 10 Pro + others in VHDs
Hi all

I'm trying to recover videos from 2 external USB drives with Bitlocker (one Seagate Backup Plus 4TB, and one Western Digital My passport Ultra 4TB) but results are quite bad.

After deleting the files (SHIFT+DEL) I did not write on the disks, so there shouldn't be any overwriting; nevertheless, recovery results are poor. I tried with at least 10 recovery software and more or less all of them are able to identify the same number of files on both disks, but when I attempt to recover them the larger Mp4 or MOV files are unplayable. Majority of them.

I can open the smaller AVI videos, but not the larger Mp4/MOV (larger than 1GB). I tried to open them on some HeX editor and the content appears mixed: no Mp4 signatures, no atoms, and no signs that they are video files, although they match in size the original files.

So, I'm wondering why this happened? Has it anything to do with BitLocker? Is there any possible way to try to restore my files? I tried the majority of the data recovery programs AND video repair programs but nothing worked.

I suspect the problem lies in how these files are located/recovered. Maybe is Bitlocker messing up? What to do then?

any help will be greatly appreciated, thanks

(I use Windows 10 version 1909)

Fra
In order to encrpyt files, bitlocker needs temporary working space to do the encryption. As one would expect large deleted files are going to be overwritten i.e. although you have not specifically written to drives bitlocker has. As typical in this situation, you can sometimes recover smaller files as less likely to be overwritten than large files.

So I doubt there is anything you can do.
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0
  • Like
Reactions: Fra

barreleye

New member
Local time
12:46 PM
Posts
15
OS
Windows 11
Bitlocked drives cannot be accessed without the bitlocker key. That's the whole purpose of a user using bitlocker, to protect his information. Without the key, there's no way around it. There is file recovery software that can be used on bitlocked drives, but you still have to have the bitlocker password or 48 digit recovery key.
The fact that he says he can identify the deleted files and even "open the smaller AVI videos" implies he has the key and is working with the volumes in the unlocked state.

OP, file recovery on an unlocked Bitlockered volume is the same as on an ordinary volume.
 

My Computer

System One

  • OS
    Windows 11

cereberus

Well-known member
Pro User
VIP
Local time
6:46 PM
Posts
2,249
OS
Windows 10 Pro + others in VHDs
The fact that he says he can identify the deleted files and even "open the smaller AVI videos" implies he has the key and is working with the volumes in the unlocked state.

OP, file recovery on an unlocked Bitlockered volume is the same as on an ordinary volume.
You are missing the point - bitlocker needs space to do the encryption (or unencryption) and will overwrite some of space used by deleted files if it was done after the encryption.

This is same as a user writing data to a drive after files have been deleted where only partial recovery of deleted files is usually possible.
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0

barreleye

New member
Local time
12:46 PM
Posts
15
OS
Windows 11
You are missing the point - bitlocker needs space to do the encryption (or unencryption) and will overwrite some of space used by deleted files if it was done after the encryption.

This is same as a user writing data to a drive after files have been deleted where only partial recovery of deleted files is usually possible.

I didn't see your post, so wasn't responding to it, but I do see it now after choosing to show your latest reply and making some changes. Do you have a reference for that claim, because it sounds extremely dubious to put it mildly.
 

My Computer

System One

  • OS
    Windows 11
Top Bottom