Welcome, Guest. Please login or register.
Did you miss your activation email?
December 14, 2017, 05:52:52 AM
Home Help Search Login Register
News:

+  DIY DataRecovery.nl Support forum
|-+  Support
| |-+  DiskPatch (Moderators: Tom, Joep)
| | |-+  WD3TB USB Drive : Removable Device Bitlocker Enc : Unallocated Space
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] Go Down Print
Author Topic: WD3TB USB Drive : Removable Device Bitlocker Enc : Unallocated Space  (Read 105 times)
nalaurien
member

Posts: 2


« on: December 01, 2017, 01:47:58 PM »

Firstly, I did read the support requirements and attempted to make a support log file. I successfully booted into trial diskpatch but the drive was not recognized by diskpatch. I assume this has something to do with the required usb connection. I looked at other posts from users here and indeed another had this issue with diskpatch. Problem with WD passpport ultras is that the USB hardware is soldered on to the motherboard of the HDD. So theres no chance to connect it directly.

The situation: This drive is a single partition 3TB drive encrypted with bitlocker. I am not certain what happened to it as i was looking one minute and it was fine, the next I saw the drive was completely unallocated space. I did not allow windows to initialize the device afterwards or format it. I was dealing with diskpart for another drive at the time. I am not certain but it is possible a diskpart clean command was run on it. This is the only thing i can think of to explain what i am seeing. So thats my running theory.

I am currently running a testdisk analysis on it. now at 30%. I did not ask testdisk to perform any recovery actions. Just analysis.

Analysis for Intel partitions revealed no results.
Analysis for GPT is showing the following so far:

/dev/sdb - 3000 GB / 2794 GiB - CHS 364797 255 63
Analyze cylinder ... 30%

Unknown 167677330  167677329    0 [ ~LF4
check_FAT: Bad number of sectors per cluster
Unknown 1214166346 1214166345 0 [ka^RuM

At startup it stated also the following:

Bad GPT partition, invalid signature
Trying alternate GPT
Bad GPT partition, invalid signature

I can post the full log if requested.

I was in the middle of another drive failure. which had the backups for this drive. which is now inaccessible. Then trying to use a linux distro triggered a recovery event on my main computer. For which the keys are on the backup and backup backups drive...

Suffice to say im having a bad day. I have access to some live images (which is what im using to perform the analysis.) A windows 10 VM (to check other bitlocker encrypted drives for anything useful) and a raspberry pi (what im on now) which is my only way of communication now.

How should I proceed?

 
Logged
nalaurien
member

Posts: 2


« Reply #1 on: December 02, 2017, 02:11:22 AM »

Alright so update. I was able to pull some files off of a drive that was cleaned and earmarked for destruction (good thing I didn't do it yet) off of that I got an old version of M3 data recovery.

Loading M3 Data recovery into the windows vm and attaching the drive allowed me to locate the deleted bitlocker partition and mount a virtual filesystem.

Off of that I recovered my password database and the bitlocker key for the main OS.

Main OS is now operational, and i have a backup of my keychain. So were in good shape. Now the only thing remaining is to get the bitlocker drive to not need a special tool to unlock it. This also partially verifies that the partition table was simply cleared. Most of the file structure appears intact, and the keychain data was itself inside an encrypted container. So the file integrity must have been fine. Otherwise i wouldn't have been able to decrypt it (to be clear the container recovered was not bitlocker).

So now the question is: do I attempt to rebuild the partitions somehow so i can simply mount bitlocker normally? Or take the option of pulling all the data through the virtual file system to a new drive and wipe? How delicate would repairing the partitions be?
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1459


WWW
« Reply #2 on: December 04, 2017, 10:15:54 AM »

Hello,

First of all, sorry for the late reply. Yes, that sounds like a shitty day, but it appears you have successfully recovered the data, correct? This was done using te M3 Bitlocker recovery tool?

To restore the partition in place you'd need something to write a GPT partition table, seen the disk size. DiskPatch only writes legacy partition tables which has no use on a > 2 TB disk. Maybe the Testdisk author can help you with that.





Logged

--
Kind regards,
Joep
Pages: [1] Go Up Print 
« previous next »
Jump to:  


Login with username, password and session length

Powered by MySQL Powered by PHP Powered by SMF 1.1.20 | SMF © 2013, Simple Machines Valid XHTML 1.0! Valid CSS!