trying to recover deleted files from two Bitlocker drives

Fra · Jun 13, 2022

Hi all

I'm trying to recover videos from 2 external USB drives with Bitlocker (one Seagate Backup Plus 4TB, and one Western Digital My passport Ultra 4TB) but results are quite bad.

After deleting the files (SHIFT+DEL) I did not write on the disks, so there shouldn't be any overwriting; nevertheless, recovery results are poor. I tried with at least 10 recovery software and more or less all of them are able to identify the same number of files on both disks, but when I attempt to recover them the larger Mp4 or MOV files are unplayable. Majority of them.

I can open the smaller AVI videos, but not the larger Mp4/MOV (larger than 1GB). I tried to open them on some HeX editor and the content appears mixed: no Mp4 signatures, no atoms, and no signs that they are video files, although they match in size the original files.

So, I'm wondering why this happened? Has it anything to do with BitLocker? Is there any possible way to try to restore my files? I tried the majority of the data recovery programs AND video repair programs but nothing worked.

I suspect the problem lies in how these files are located/recovered. Maybe is Bitlocker messing up? What to do then?

any help will be greatly appreciated, thanks

(I use Windows 10 version 1909)

Fra

glasskuter · Jun 13, 2022

Bitlocked drives cannot be accessed without the bitlocker key. That's the whole purpose of a user using bitlocker, to protect his information. Without the key, there's no way around it. There is file recovery software that can be used on bitlocked drives, but you still have to have the bitlocker password or 48 digit recovery key.

cereberus · Jun 13, 2022

Fra said:
Hi all

I'm trying to recover videos from 2 external USB drives with Bitlocker (one Seagate Backup Plus 4TB, and one Western Digital My passport Ultra 4TB) but results are quite bad.

After deleting the files (SHIFT+DEL) I did not write on the disks, so there shouldn't be any overwriting; nevertheless, recovery results are poor. I tried with at least 10 recovery software and more or less all of them are able to identify the same number of files on both disks, but when I attempt to recover them the larger Mp4 or MOV files are unplayable. Majority of them.

I can open the smaller AVI videos, but not the larger Mp4/MOV (larger than 1GB). I tried to open them on some HeX editor and the content appears mixed: no Mp4 signatures, no atoms, and no signs that they are video files, although they match in size the original files.

So, I'm wondering why this happened? Has it anything to do with BitLocker? Is there any possible way to try to restore my files? I tried the majority of the data recovery programs AND video repair programs but nothing worked.

I suspect the problem lies in how these files are located/recovered. Maybe is Bitlocker messing up? What to do then?

any help will be greatly appreciated, thanks

(I use Windows 10 version 1909)

Fra

In order to encrpyt files, bitlocker needs temporary working space to do the encryption. As one would expect large deleted files are going to be overwritten i.e. although you have not specifically written to drives bitlocker has. As typical in this situation, you can sometimes recover smaller files as less likely to be overwritten than large files.

So I doubt there is anything you can do.

Fra · Jun 13, 2022

damn, I'm hating BitLocker now

barreleye · Jun 15, 2022

glasskuter said:
Bitlocked drives cannot be accessed without the bitlocker key. That's the whole purpose of a user using bitlocker, to protect his information. Without the key, there's no way around it. There is file recovery software that can be used on bitlocked drives, but you still have to have the bitlocker password or 48 digit recovery key.

The fact that he says he can identify the deleted files and even "open the smaller AVI videos" implies he has the key and is working with the volumes in the unlocked state.

OP, file recovery on an unlocked Bitlockered volume is the same as on an ordinary volume.

cereberus · Jun 15, 2022

barreleye said:
The fact that he says he can identify the deleted files and even "open the smaller AVI videos" implies he has the key and is working with the volumes in the unlocked state.

OP, file recovery on an unlocked Bitlockered volume is the same as on an ordinary volume.

You are missing the point - bitlocker needs space to do the encryption (or unencryption) and will overwrite some of space used by deleted files if it was done after the encryption.

This is same as a user writing data to a drive after files have been deleted where only partial recovery of deleted files is usually possible.

barreleye · Jun 15, 2022

cereberus said:
You are missing the point - bitlocker needs space to do the encryption (or unencryption) and will overwrite some of space used by deleted files if it was done after the encryption.

This is same as a user writing data to a drive after files have been deleted where only partial recovery of deleted files is usually possible.

I didn't see your post, so wasn't responding to it, but I do see it now after choosing to show your latest reply and making some changes. Do you have a reference for that claim, because it sounds extremely dubious to put it mildly.