Welcome, Guest. Please login or register.
Did you miss your activation email?
December 10, 2018, 08:59:18 PM
Home Help Search Login Register
News:

+  DIY DataRecovery.nl Support forum
|-+  Support
| |-+  DiskPatch (Moderators: Tom, Joep)
| | |-+  BitLocker encrypted parition recovery
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] Go Down Print
Author Topic: BitLocker encrypted parition recovery  (Read 10064 times)
dynikz
member

Posts: 5


« on: August 05, 2014, 10:38:26 PM »

Hello,

My 1TB internal hard drive was encrypted with BitLocker, however the partition table has been deleted (disk management right click delete - not format). My data is still there and I have had a look at the data using a hex editor but all of the boot sector is 0s.

Having searched through the forums I have found another forum user spyder_pk who has experienced the exact same problem as me and managed to resolve it with help.
http://www.diydatarecovery.nl/forum/index.php/topic,1367.0.html

My partition is showing as RAW and and I have actually cloned the data to a clean 2TB hard drive so I can work on it.


This is my first experience with this type of problem and my knowledge at the moment is very limited, I have read through spyder_pk's topic a few times but am not exactly sure how he's managed to resolve his issue.

I really would very much appreciate any help that can be given to me. Thanks for reading.
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1473


WWW
« Reply #1 on: August 06, 2014, 01:30:27 PM »

Can you please start with this:
http://www.diydatarecovery.nl/dp_manual/guide_supportanalysis.htm
Logged

dynikz
member

Posts: 5


« Reply #2 on: August 07, 2014, 08:10:48 AM »


.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 4.0.300
.../000:01/LOG> (C) 2000-2013 DIY DataRecovery
.../000:01/LOG> Contact info: www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 66Kb
.../000:01/LOG> CommandLineParms: /sup
.../000:01/LOG> LogDate: 08-06-2014
.../000:01/CFG> FilePath="C:DPFILES\"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> LogEachReadError="1"
.../000:01/CFG> WriteAfterReadError="1"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: EDD-3.0
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Ext13H Flags: Write with verify supported
.../000:01/13H> Drive Interface Info: USB     
.../000:01/13H> Disk 128 X13H data : 58563/16/63 125091840/512
.../000:01/13H> Disk found at 129
.../000:01/13H> Ext13H version: 2.1 / EDD-1.1
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Drive Interface Info:
.../000:01/13H> Disk 129 X13H data : 16383/16/63 3907029168/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
.../000:01/FDL> Disk found at 129
### DISKLIST ###
__D_|________LBA_|___H_|__S_|___GB_|__GEO_|___SS_
128 | .125091840 | .16 | 63 | ..59 | BIOS | .512
129 | 3907029168 | 255 | 63 | 1863 | BIOS | .512
..0 | .........0 | ..0 | .0 | ...0 | BIOS | ...0
..0 | .........0 | ..0 | .0 | ...0 | BIOS | ...0
.../000:01/IAS> AdmiSector found on disk 0 (128)
.../000:01/IAS> AdmiSector found on disk 1 (129)
.../000:01/KEY> DEMO/1
.../000:01/PFC> PQstuff signature not detected on disk 0 (128)
.../000:01/PFC> PQstuff signature not detected on disk 1 (129)
.../000:01/PFC> Disk health not checked
.../000:02/PFC> Partition State backup not found on disk 0 (128)
.../000:02/PFC> Partition State backup not found on disk 1 (129)
.../000:02/PFC> No Repair date found on disk 0 (128)
.../000:02/PFC> No Repair date found on disk 1 (129)
.../000:14/CSD> Start CheckDisk for disk 1 (129)
.../000:14/CSD> 0 (0 0 1)
.../000:14/CSD> 16064 (0 254 63)
.../000:14/CSD> 3907024065 (243201 0 1)
.../000:14/CSD> 3907029167 (243201 80 63)
.../000:14/CSD> CheckDisk complete, ReadErrors 0
.../000:14/USD> Disk 1 (129) selected
.../000:14/GSC> No geo change detected for disk 1 (129)
.../000:14/WAS> AdmiSectors in use : 0+ 1+
129/000:14/USD> MBR for disk 1 (129)
129/000:14/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00  |  3м.|ؾ.|.
016   06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB B9 04 00  |  ...Ph....
032   BD BE 07 80 7E 00 00 7C 0B 0F 85 10 01 83 C5 10  |  .~..|.....
048   E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00  |  .V.UF..F..
064   B4 41 BB AA 55 CD 13 5D 72 0F 81 FB 55 AA 75 09  |  AU.]r.Uu.
080   F7 C1 01 00 74 03 FE 46 10 66 60 80 7E 10 00 74  |  ..t.F.f`~..t
096   26 66 68 00 00 00 00 66 FF 76 08 68 00 00 68 00  |  &fh....f.v.h..h.
112   7C 68 01 00 68 10 00 B4 42 8A 56 00 8B F4 CD 13  |  |h..h..BV..
128   9F 83 C4 10 9E EB 14 B8 01 02 BB 00 7C 8A 56 00  |  .....|V.
144   8A 76 01 8A 4E 02 8A 6E 03 CD 13 66 61 73 1E FE  |  v.N.n..fas.
160   4E 11 0F 85 0C 00 80 7E 00 80 0F 84 8A 00 B2 80  |  N....~...
176   EB 82 55 32 E4 8A 56 00 CD 13 5D EB 9C 81 3E FE  |  U2V..]뜁>
192   7D 55 AA 75 6E FF 76 00 E8 8A 00 0F 85 15 00 B0  |  }Uun.v.....
208   D1 E6 64 E8 7F 00 B0 DF E6 60 E8 78 00 B0 FF E6  |  d.`x..
224   64 E8 71 00 B8 00 BB CD 1A 66 23 C0 75 3B 66 81  |  dq...f#u;f
240   FB 54 43 50 41 75 32 81 F9 02 01 72 2C 66 68 07  |  TCPAu2..r,fh.
256   BB 00 00 66 68 00 02 00 00 66 68 08 00 00 00 66  |  ..fh....fh....f
272   53 66 53 66 55 66 68 00 00 00 00 66 68 00 7C 00  |  SfSfUfh....fh.|.
288   00 66 61 68 00 00 07 CD 1A 5A 32 F6 EA 00 7C 00  |  .fah....Z2.|.
304   00 CD 18 A0 B7 07 EB 08 A0 B6 07 EB 03 A0 B5 07  |  .. .. .. .
320   32 E4 05 00 07 8B F0 AC 3C 00 74 FC BB 07 00 B4  |  2...<.t..
336   0E CD 10 EB F2 2B C9 E4 64 EB 00 24 02 E0 F8 24  |  ..+d.$.$
352   02 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74  |  .Invalid partit
368   69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20  |  ion table.Error
384   6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E  |  loading operatin
400   67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67  |  g system.Missing
416   20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65  |   operating syste
432   6D 00 00 00 00 62 7A 99 AD 53 AC 98 00 00 80 20  |  m....bzS..
448   21 00 06 FE FF FF 00 08 00 00 00 58 70 74 00 00  |  !.........Xpt..
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U
###
129/000:14/VEC> Start Verify EPBR Chain for disk 1 (129)
129/000:14/VEC> Listing current partitions on disk:
129/000:14/VEC>    FAT16 (P)        (Err)        2048  1953519616     (932 Gb)
129/000:14/VEC> Partition Table info for sector 0 (0 0 1)
129/000:14/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 .128 | ..06 | ....0..32..33 | .1023.254..63 | ......2048 | 1953519616
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
129/000:14/VEC> 55AA sig Ok
129/000:14/LOG> Boot sector dump requested at 2048 (0 32 33)
### BootSectorDump for BStype FAT16
...........Jump Code (hex): 000000
............OEM Name (txt): ........
....Bytes per Sector (dec): 0
.Sectors per Cluster (dec): 0
....Reserved Sectors (dec): 0
...........FAT count (dec): 0
....Root Entry Count (dec): 0
..Total Sectors (16) (dec): 0
....Media Descriptor (hex): 00
.......FAT Size (16) (dec): 0
...Sectors per Track (dec): 0
.....Heads per Track (dec): 0
......Hidden Sectors (dec): 0
..Total Sectors (32) (dec): 0
........Drive Number (hex): 00
............Reserved (hex): 00
......Boot Signature (hex): 00
...........Volume ID (hex): 00000000
........Volume Label (txt):
..Filesystem Type ID (txt):         
....Sector Signature (hex): 0000
1st FAT not found at      : 2048 (0 32 33)
2nd FAT not found at      : 2048 (0 32 33)
129/000:14/CF8> FAT sectors are equal
129/000:14/LOG> SectorDump requested at 2048 (0 32 33)
###
     ........... ........... ........... ...........
     ........... ........... ........... ...........
     ........... ........... ........... ...........
     ........... ........... ........... ...........
###
129/000:14/VEC> Verify EPBR Chain completed
129/000:14/USD> Select disk completed
129/000:19/SCN> DiskScan requested, ScanType is 3
129/000:19/SCN> from 0 (0 0 1) to 3907029167 (243201 80 63), 3907029168 sectors
129/000:19/SCN> Starting QuickScan (vista) at 2048 (0 32 33)
129/000:19/CDC> No DataCollection entries, CleanDatacollection aborted
129/000:19/MPL> No DataCollection entries, MakePartList aborted
129/000:19/SCN> Next QuickScan location at 0 (0 0 1)
129/000:20/SCN> QuickScan finished
129/000:20/SCN> Starting SmartScan (vista) at 0 (0 0 1)
129/000:20/RDS> Read past EOD intercept for disk 129 at 4294967295 (267349 89 4)
129/299:38/SCN> SmartScan finished
129/299:38/SCN> DiskScan completed
129/299:38/SCN> ReadErrors for disk 1 (129): 0
129/539:53/LOG> DataCollection items found: 4 / 1
### DATACOLLECTION, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 129 | .........0 | ..FAT16 | PTE1 | ......2048 | 1953519616 | PRI | .
002 | 129 | .275505158 | ....DYN | PTE3 | 4069907621 | .242766539 | LOG | I
003 | 129 | 1953521664 | ...NTFS | ..BS | 1953521664 | 1953503232 | PRI | .
004 | 129 | 3907024895 | ...NTFS | .BBS | 1953521664 | 1953503232 | PRI | .
129/539:53/LOG> DataCollection items found: 4 / 1
### DATACOLLECTION, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 129 | .........0 | ..FAT16 | PTE1 | ......2048 | 1953519616 | PRI
003 | 129 | 1953521664 | ...NTFS | ..BS | 1953521664 | 1953503232 | PRI
004 | 129 | 3907024895 | ...NTFS | .BBS | 1953521664 | 1953503232 | PRI
129/539:53/LOG> PartList items created: 2
### PARTLIST ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ..FAT16 | ..1 | ... | ..0 | ... | ..1 | ..1 | ..1 | 1 | ...
002 | ...NTFS | ... | ..3 | ..4 | ..0 | ..3 | ..3 | ..3 | 2 | ..A
### PARTLIST, INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R_|___A
001 | ..FAT16 | ......2048 | 1953519616 | 1953521663 | PRI | ... | ..V
002 | ...NTFS | 1953521664 | 1953503232 | 3907024895 | PRI | ..A | ..V
129/539:53/SST> SaveState requested for disk 1 (129)
129/539:54/WAS> AdmiSectors in use : 0+ 1+
129/539:54/SST> SaveState completed for disk 1 (129)
129/539:54/EXE> Analysis complete
129/540:00/LOG> RunTime: 540:00
129/540:00/LOG> ### CLOSE LOG ###
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1473


WWW
« Reply #3 on: August 07, 2014, 07:42:10 PM »

You scanned the clone, right?

This log shows very little promise, nothing of interest is found and the stuff that IS found is from other volumes (leftovers, old stuff from before the cloning). I have some ideas but first:
Cloning wasn't needed at this time, unless the original disk is showing hardware problems. Please create a support log for the original disk; I need to see what's really there and not what might be there.
Logged

dynikz
member

Posts: 5


« Reply #4 on: August 08, 2014, 08:02:41 AM »

This is the log file for the original 1TB hard drive.


.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 4.0.300
.../000:01/LOG> (C) 2000-2013 DIY DataRecovery
.../000:01/LOG> Contact info: www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 66Kb
.../000:01/LOG> CommandLineParms: /sup
.../000:01/LOG> LogDate: 08-07-2014
.../000:01/CFG> FilePath="C:DPFILES\"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> LogEachReadError="1"
.../000:01/CFG> WriteAfterReadError="1"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: EDD-3.0
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Ext13H Flags: Write with verify supported
.../000:01/13H> Drive Interface Info: USB     
.../000:01/13H> Disk 128 X13H data : 58563/16/63 125091840/512
.../000:01/13H> Disk found at 129
.../000:01/13H> Ext13H version: 2.1 / EDD-1.1
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Drive Interface Info:
.../000:01/13H> Disk 129 X13H data : 16383/16/63 1953525168/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
.../000:01/FDL> Disk found at 129
### DISKLIST ###
__D_|________LBA_|___H_|__S_|___GB_|__GEO_|___SS_
128 | .125091840 | .16 | 63 | ..59 | BIOS | .512
129 | 1953525168 | 255 | 63 | .931 | BIOS | .512
..0 | .........0 | ..0 | .0 | ...0 | BIOS | ...0
..0 | .........0 | ..0 | .0 | ...0 | BIOS | ...0
.../000:01/IAS> AdmiSector init complete for disk 0 (128)
.../000:01/IAS> AdmiSector init complete for disk 1 (129)
.../000:01/KEY> DEMO/1
.../000:01/PFC> PQstuff signature not detected on disk 0 (128)
.../000:01/PFC> PQstuff signature not detected on disk 1 (129)
.../000:01/PFC> Disk health not checked
.../000:03/PFC> Partition State backup not found on disk 0 (128)
.../000:03/PFC> Partition State backup not found on disk 1 (129)
.../000:03/PFC> No Repair date found on disk 0 (128)
.../000:03/PFC> No Repair date found on disk 1 (129)
.../000:30/CSD> Start CheckDisk for disk 1 (129)
.../000:30/CSD> 0 (0 0 1)
.../000:30/CSD> 16064 (0 254 63)
.../000:30/CSD> 1953520065 (121601 0 1)
.../000:30/CSD> 1953525167 (121601 80 63)
.../000:30/CSD> CheckDisk complete, ReadErrors 0
.../000:30/USD> Disk 1 (129) selected
.../000:30/GSC> First DP run, geo info for disk 1 (129) not yet recorded
.../000:30/WAS> AdmiSectors in use : 0+ 1+
129/000:30/USD> MBR for disk 1 (129)
129/000:30/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00  |  3м.|ؾ.|.
016   06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB B9 04 00  |  ...Ph....
032   BD BE 07 80 7E 00 00 7C 0B 0F 85 10 01 83 C5 10  |  .~..|.....
048   E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00  |  .V.UF..F..
064   B4 41 BB AA 55 CD 13 5D 72 0F 81 FB 55 AA 75 09  |  AU.]r.Uu.
080   F7 C1 01 00 74 03 FE 46 10 66 60 80 7E 10 00 74  |  ..t.F.f`~..t
096   26 66 68 00 00 00 00 66 FF 76 08 68 00 00 68 00  |  &fh....f.v.h..h.
112   7C 68 01 00 68 10 00 B4 42 8A 56 00 8B F4 CD 13  |  |h..h..BV..
128   9F 83 C4 10 9E EB 14 B8 01 02 BB 00 7C 8A 56 00  |  .....|V.
144   8A 76 01 8A 4E 02 8A 6E 03 CD 13 66 61 73 1E FE  |  v.N.n..fas.
160   4E 11 0F 85 0C 00 80 7E 00 80 0F 84 8A 00 B2 80  |  N....~...
176   EB 82 55 32 E4 8A 56 00 CD 13 5D EB 9C 81 3E FE  |  U2V..]뜁>
192   7D 55 AA 75 6E FF 76 00 E8 8A 00 0F 85 15 00 B0  |  }Uun.v.....
208   D1 E6 64 E8 7F 00 B0 DF E6 60 E8 78 00 B0 FF E6  |  d.`x..
224   64 E8 71 00 B8 00 BB CD 1A 66 23 C0 75 3B 66 81  |  dq...f#u;f
240   FB 54 43 50 41 75 32 81 F9 02 01 72 2C 66 68 07  |  TCPAu2..r,fh.
256   BB 00 00 66 68 00 02 00 00 66 68 08 00 00 00 66  |  ..fh....fh....f
272   53 66 53 66 55 66 68 00 00 00 00 66 68 00 7C 00  |  SfSfUfh....fh.|.
288   00 66 61 68 00 00 07 CD 1A 5A 32 F6 EA 00 7C 00  |  .fah....Z2.|.
304   00 CD 18 A0 B7 07 EB 08 A0 B6 07 EB 03 A0 B5 07  |  .. .. .. .
320   32 E4 05 00 07 8B F0 AC 3C 00 74 FC BB 07 00 B4  |  2...<.t..
336   0E CD 10 EB F2 2B C9 E4 64 EB 00 24 02 E0 F8 24  |  ..+d.$.$
352   02 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74  |  .Invalid partit
368   69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20  |  ion table.Error
384   6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E  |  loading operatin
400   67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67  |  g system.Missing
416   20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65  |   operating syste
432   6D 00 00 00 00 62 7A 99 AD 53 AC 98 00 00 80 20  |  m....bzS..
448   21 00 06 FE FF FF 00 08 00 00 00 58 70 74 00 00  |  !.........Xpt..
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U
###
129/000:30/VEC> Start Verify EPBR Chain for disk 1 (129)
129/000:30/VEC> Listing current partitions on disk:
129/000:30/VEC>    FAT16 (P)        (Err)        2048  1953519616     (932 Gb)
129/000:30/VEC> Partition Table info for sector 0 (0 0 1)
129/000:30/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 .128 | ..06 | ....0..32..33 | .1023.254..63 | ......2048 | 1953519616
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
129/000:30/VEC> 55AA sig Ok
129/000:30/LOG> Boot sector dump requested at 2048 (0 32 33)
### BootSectorDump for BStype FAT16
...........Jump Code (hex): 000000
............OEM Name (txt): ........
....Bytes per Sector (dec): 0
.Sectors per Cluster (dec): 0
....Reserved Sectors (dec): 0
...........FAT count (dec): 0
....Root Entry Count (dec): 0
..Total Sectors (16) (dec): 0
....Media Descriptor (hex): 00
.......FAT Size (16) (dec): 0
...Sectors per Track (dec): 0
.....Heads per Track (dec): 0
......Hidden Sectors (dec): 0
..Total Sectors (32) (dec): 0
........Drive Number (hex): 00
............Reserved (hex): 00
......Boot Signature (hex): 00
...........Volume ID (hex): 00000000
........Volume Label (txt):
..Filesystem Type ID (txt):         
....Sector Signature (hex): 0000
1st FAT not found at      : 2048 (0 32 33)
2nd FAT not found at      : 2048 (0 32 33)
129/000:30/CF8> FAT sectors are equal
129/000:30/LOG> SectorDump requested at 2048 (0 32 33)
###
     ........... ........... ........... ...........
     ........... ........... ........... ...........
     ........... ........... ........... ...........
     ........... ........... ........... ...........
###
129/000:30/VEC> Verify EPBR Chain completed
129/000:31/USD> Select disk completed
129/000:36/SCN> DiskScan requested, ScanType is 3
129/000:36/SCN> from 0 (0 0 1) to 1953525167 (121601 80 63), 1953525168 sectors
129/000:36/SCN> Starting QuickScan (vista) at 2048 (0 32 33)
129/000:36/CDC> No DataCollection entries, CleanDatacollection aborted
129/000:36/MPL> No DataCollection entries, MakePartList aborted
129/000:36/SCN> Next QuickScan location at 0 (0 0 1)
129/000:36/SCN> QuickScan finished
129/000:36/SCN> Starting SmartScan (vista) at 0 (0 0 1)
129/000:36/RDS> Read past EOD intercept for disk 129 at 4294967295 (267349 89 4)
129/121:07/SCN> SmartScan finished
129/121:07/SCN> DiskScan completed
129/121:07/SCN> ReadErrors for disk 1 (129): 0
129/534:40/LOG> DataCollection items found: 2 / 1
### DATACOLLECTION, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 129 | .........0 | ..FAT16 | PTE1 | ......2048 | 1953519616 | PRI | .
002 | 129 | .275505158 | ....DYN | PTE3 | 4069907621 | .242766539 | LOG | I
129/534:40/LOG> DataCollection items found: 2 / 1
### DATACOLLECTION, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 129 | .........0 | ..FAT16 | PTE1 | ......2048 | 1953519616 | PRI
129/534:40/LOG> PartList items created: 1
### PARTLIST ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ..FAT16 | ..1 | ... | ..0 | ... | ..1 | ..1 | ..1 | 1 | ...
### PARTLIST, INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R_|___A
001 | ..FAT16 | ......2048 | 1953519616 | 1953521663 | PRI | ... | ..V
129/534:40/SST> SaveState requested for disk 1 (129)
129/534:41/WAS> AdmiSectors in use : 0+ 1+
129/534:41/SST> SaveState completed for disk 1 (129)
129/534:41/EXE> Analysis complete
129/534:54/LOG> RunTime: 534:54
129/534:54/LOG> ### CLOSE LOG ###
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1473


WWW
« Reply #5 on: August 08, 2014, 09:42:07 AM »

As I feared. There is absolutely nothing here. The thread you mentioned (with the similar problem) had more information than this log, there is no trace of anything. That makes fixing this pretty much impossible.

How was the original volume created? With Windows 7? or another way?
Was the original volume a Simple volume or a Dynamic volume?
Logged

dynikz
member

Posts: 5


« Reply #6 on: August 08, 2014, 07:02:31 PM »

The original volume was created with Windows 7, an NTFS simple volume, then the entire drive was BitLocker encrypted. A right click and delete volume was done in disk management.

I would attempt to use the MS bde-repair tool but I only have the password for the drive and not any of the recovery keys.

Am I not able to manually edit the hex data or use some tool for the MBR to tell the drive it's an NTFS drive again?
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1473


WWW
« Reply #7 on: August 08, 2014, 09:38:28 PM »

Could you try this for me please:
- start DiskPatch
- select the disk
- go to utilities / Diskeditor
- press F7 (export)
- when asked, enter 3000 sectors (number of sectors to export)
- leave other stuff at default, press enter to start the export
- exit DiskPatch
- find the export file, ZIP it and send it to me (tom@diydatarecovery.nl)
Logged

dynikz
member

Posts: 5


« Reply #8 on: August 08, 2014, 09:50:13 PM »

Okay I will do that now.

If it's any help at all, apart from the small bit at the start of the disk, all data is 0s until sector 2049. Sector 2049 is exactly where first bit of data starts up until sector 1953521901. Sector 1953521901 is the first sector at which the data goes back to 0s.

Thank you very much for helping me attempt to get my data back from this situation. It really is massively appreciated.
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1473


WWW
« Reply #9 on: August 10, 2014, 03:10:47 PM »

Bad news.

I was hoping to find traces of the boot sector but oddly enough there's nothing there. It should be at 2048 (also based on what you said) but 2048 is blank, as are any other potential locations for the boot sector.
I've tested the 'deleting a bitlocker drive' scenario here and in my situation the boot sector is not deleted when the bitlocker volume is deleted. So I'm not sure what happened on your end but without that boot sector there's nothing we can do.
I've also looked into recovering a bitlocker volume when structures (like the boot sector) are damaged and I haven't found anything that may be of help, but I'm not a bitlocker specialist so you might be able to find help in other places.
So that's it I'm afraid, sorry.

You could try contacting Microsoft Support with this, they may have some ideas.
Logged

Pages: [1] Go Up Print 
« previous next »
Jump to:  


Login with username, password and session length

Powered by MySQL Powered by PHP Powered by SMF 1.1.20 | SMF © 2013, Simple Machines Valid XHTML 1.0! Valid CSS!