BitLocker Repair Tool - Recover Drive in Windows 7 and 8

How to Use BitLocker Repair Tool to Recover a Drive in Windows 7 and Windows 8

​

The BitLocker Repair Tool (Repair-bde) is a command-line tool included with Windows Server 2008 R2, Windows 7, Windows Server 2012, and Windows 8. This tool attempts to repair or decrypt a damaged BitLocker-encrypted volume using the supplied recovery information to reconstruct critical parts of the drive and salvage recoverable data to another volume.

This tutorial will show you how to use the BitLocker Repair Tool to recover your data from a damaged encrypted operating system (OS) drive, fixed data drive (ex: internal volume/drive), or removable data drive (ex: USB drive) in Windows 7 and Windows 8.

You must be signed in as an administrator to be able to do the steps in this tutorial.

   Note

• You must have at least one of the following for the BitLocker encrypted drive:
  • Password
  • Recovery key
  • Startup key .BEK file location
• You will need to have an empty output volume (drive) of equal or larger size than the damaged BitLocker encrypted drive. The contents of the output volume will be completely deleted and overwritten by the decrypted contents of the damaged BitLocker drive.

   Warning

The BitLocker Repair Tool should only be used as a last resort when you were unable to decrypt or unlock the encrypted drive using either the password, recovery key, USB flash drive, or BitLocker Recovery.

   Tip

If you were signed in to your Microsoft account when you encrypted a drive with BitLocker, then you can get your recovery key from your OneDrive at the link below.

Microsoft account: BitLocker recovery keys

EXAMPLE: Before and After using BitLocker Repair Tool
NOTE: In this example, the BitLocker encrypted drive is F: and the output volume is E: .





Here's How:

1. Do step 2, 3, or 4 below depending on what you would like to do.

2. To Use the Password in Windows 8
NOTE: This option is only available in Windows 8, and would be for an OS drive, fixed data drive, or removable data drive that you have configured to be unlocked by a password.

A) Open an elevated command prompt.

B) In the elevated command prompt, type the command below, and press Enter. (see screenshot below)

repair-bde F: E: -pw -F

   Note

For only items in red in the command above:

Substitute F for the drive letter of the Bitlocker encrypted drive. Not the last F.

Substitute E for the drive letter of the output volume you want to have the contents of the Bitlocker encrypted drive decrypted and copied to.

C) When prompted in the command prompt, type the recovery password for this encrypted drive, press Enter, and go to step 5 below.
NOTE: You will not see the password as you type it.



3. To Use the Recovery Key in Windows 7 and 8
NOTE: This would be for an OS drive, fixed data drive, or removable data drive that you still have the recovery key either saved to your Microsoft account, saved to a file, saved to a USB flash drive, or printed.

A) Open an elevated command prompt.

B) In the elevated command prompt, type the command below, press Enter, and go to step 5 below. (see screenshot below)

repair-bde F: E: -rp BitLockerRecoveryKey -F


For example:

repair-bde F: E: -rp 261173-522599-237072-583517-442068-316811-199375-623755 -F

   Note

For only items in red in the command above:

Substitute F for the drive letter of the Bitlocker encrypted drive.

Substitute E for the drive letter of the output volume you want to have the contents of the Bitlocker encrypted drive decrypted and copied to.

Substitute BitLockerRecoveryKey for the actual 48 digit recovery key for the encrypted drive like below.

Saved to USB or File:




Saved to Microsoft account:

4. To Use the Startup Key in Windows 7 and 8
NOTE: This would only be for an OS drive that you have configured to be unlocked by a USB flash drive.

A) Since you will not be able to boot from the OS drive, you will need to first connect it to another Windows Server 2008 R2, Windows 7, Windows Server 2012, or Windows 8 PC.

B) Open an elevated command prompt in the other PC.

C) In the elevated command prompt, type the command below, press Enter, and go to step 5 below. (see screenshot below)

repair-bde F: E: -rk I:\StartupKey.BEK -F


For example:

repair-bde Z: E: -rk I:\AFA58D77-94CD-4300-8009-68B36AE53276.BEK -F

   Note

For only items in red in the command above:

Substitute F for the drive letter of the Bitlocker encrypted drive.

Substitute E for the drive letter of the output volume you want to have the contents of the Bitlocker encrypted drive decrypted and copied to.

Substitute I for the USB drive letter that the startup key has been saved or copied to.

Substitute StartupKey for the actual file name of the startup key for the encrypted drive like below. The BEK file (startup key) will be a hidden protected OS file.

5. When finally successfully finished, follow any given "ACTION REQUIRED" first. For example, to run chkdsk on the output volume before opening. (see screenshots below step 2, 3, and 3 above)

NOTE: The BitLocker Repair Tool may take a long time to finish, but you will still be able to use your PC during the recovery process. Just do not turn off the PC until it has finished.

6. You will now be able to open the output volume (ex: E) to view the decrypted files from the BitLocker encrypted drive (ex: F).


That's it,
Shawn

Related Tutorials

---

• How to Unlock a Windows 7 Computer Locked by BitLocker Drive Encryption
• How to Unlock a Data or Removable Drive Locked by BitLocker Drive Encryption
• How to Back Up the BitLocker Recovery Key of a Drive in Windows 8
• How to Unlock a Drive using BitLocker Recovery in Windows 8
• How to Turn On or Off BitLocker for Fixed Data Drives in Windows 8
• How to Turn On or Off BitLocker for Windows 8 OS Drive with or without TPM
• How to Copy the BitLocker Startup Key for the OS Drive in Windows 8
• How to Turn On or Off BitLocker To Go for Removable Data Drives in Windows 8
• How to Turn On or Off Auto-unlock of BitLocker Encrypted Data Drives in Windows 8
• How to Suspend or Resume BitLocker Protection of a Drive in Windows 8
• How to Choose BitLocker Drive Encryption Method and Cipher Strength in Windows 8
• Add "Lock Drive" to Unlocked BitLocker Drives Context Menu in Windows 7 and Windows 8
• How to Change or Reset the BitLocker Password of a Drive in Windows 8
• Allow or Prevent Standard Users from Changing BitLocker Password or Pin in Windows 8
• How to Check BitLocker Status of Drive in Windows 7 and Windows 8

 

[heenasar64]

Bitlocker

Respected..earlier i had windows7 ,,at that time i had encrypted D drive of my pc...but did not save its recovery key..or may be saved in the same drive..after one year of encryption i tried to change its password...it was processing,,suddenly electricity failed and my pc shut down...after that i tried a lot to open my drive...but couldnt open. and few months back i installed windows 8...kindly help me....i m very harassed...one of my friend told me about your site..i also went to Microsoft offices in gurgaon Delhi, but did not get any help.....there are my family memories pics in that drive....i shall be highly-highly-highly grateful to u...pls help me.

 

[Brink]

Hello Heenasar, and welcome to Eight Forums.

Most likely you may have lost everything on that drive due to the power outage corrupting it and your BitLocker password.

Unless you saved your BitLocker recovery key to another location as a backup, then you lost it when your formatted Windows 7 to install Windows 8.

About all you can do is try to unlock the drive with both your old or new Bitlocker password using step 2 in the tutorial to see if either will work.

....or by trying step 2 in OPTION TWO of the tutorial below.

BitLocker Drive Encryption - Unlock a Locked Data or Removable Drive - Windows 7 Help Forums​

If you are unable to, then I'm afraid that you may not be able to unlock it, and lost the contents.

 

[heenasar64]

i saved recovery in the same encrypted drive D. ...i tried to open with new and old password..but couldnt get success...
Is it possible now that if i format D drive(encrypted). will it be opend automatically.....if yes then is it also possible to recover those important data by data recovery software..pls help me. pls tell me full process in which i could get my datas back after formatting..

 

[Brink]

The whole point of BitLocker encryption is that without the password or recovery key, access will not be allowed.

You will be able to format the drive to be able to use it again, but doing so will also delete all data on the drive.

I'm sorry, but you will most likely not be able to recover any data without these. Especially since you lost power in the middle of changing the BitLocker password.

I hope you had backups of your data to restore from.

 

[heenasar64]

how to check i have back up.

please tell me how to check whether i have backup data of window 7 or not?and if i have...then how to backup ? what file are required to backup? and also tell me, what else can i try to open if i have backup data?

 

[Brink]

Unfortunately, if you don't know if you have a backup, then you most likely don't since you would have needed to manually back them up.

 

[heenasar64]

can u please elaborate? i could not understand...pls tell how to check that i have back up? and if i do not have then how can i get back up?

Unfortunately, if you don't know if you have a backup, then you most likely don't since you would have needed to manually back them up.

 

[Brink]

If you do not know that you have a backup, then you do not have one since you would have had to created a backup to have one. If you created a backup, then you would know that you had one.

You cannot create a backup after the data is gone. It must be created before.

Next time, please be sure to save a copy of your BitLocker recovery key and password in a safe place in case you may need it like in this case. In addition, you should always have any files that you do not want to lose backed up to a safe location as well.

 

[feras]

i have a problem with output HDD :

i have used

repair-bde G: F: -rp 344531-200420-ccccc-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXXX-F -LF c:\log.txt

then i did a

chkdsk f: /F

i got this message

The type of the file system is NTFS.
The first NTFS boot sector is unreadable or corrupt.
Reading second NTFS boot sector instead.
Unable to determine volume version and state. CHKDSK aborted.

any advice to get back my data on output HDD please???

 

[Brink]

Hello Feras, and welcome to Eight Forums.

Is F: a separate physical hard drive?

You might see if formatting F: and see if you are able to successfully run "chkdsk F: /F" on it. If so, then try using the BitLocker Repair Tool again.

Hope this helps,
Shawn

 

[feras]

Hello Feras, and welcome to Eight Forums.

Is F: a separate physical hard drive?

You might see if formatting F: and see if you are able to successfully run "chkdsk F: /F" on it. If so, then try using the BitLocker Repair Tool again.

Hope this helps,
Shawn

thanks for your fast replay
F: output is usb3 external HDD 3tb, new one i bought before 2 days.
G: input is usb3 external HDD is 700gb.
is any other solution to change the RAW disk to be able to read

 

[Brink]

In that case, run the "Clean" (not "clean all") command on the RAW disk, then see if you area able to create a new NTFS primary partition on it.

Disk - Clean and Clean All with Diskpart Command - Windows 7 Help Forums

Partition or Volume - Create New - Windows 7 Help Forums

If successful, see if you may be able to save to it using the BitLocker Repair Tool now.

 

[Hirkman]

Hi, A while ago I tried to use bitlocker to encrypt my external hard drive, however the process was interrupted and now I cannot access anything in it. I'm following this guide trying to move its contents to another external of the same size. I am using Windows 7 Ultimate.

I'm currently in the middle of step 3 after entering
'repair-bde F: E: -rp myBitLockerRecoveryKey -F', where the red text is replaced by my actual key, and right now I am seeing the attached screenshot.

I'm worried since it looks like something's going wrong here...

I'd appreciate any help, thanks

edit:...I'm not sure if I attached the image correctly to this post so...let me know if you can see it, thanks

 

[Brink]

Hello Hirkman, and welcome to Eight Forums.

I'm afraid that since BitLocker was interrupted while encrypting, you may be out of luck, and may need to format the hard drive to be able to use it again.

I hope you had a back up of the data on the drive.

 

[ebi bamaram]

Hello, my encrypted Drive with Bitlocker has been disappeared(exactly I dont know why!) and I had free space as much as the disappeared Drive instead of selfsame Drive. then i made a new Drive with the free space with a software but it was empty. therefore i losed my information from the encrypted Drive. how can i recover them.

 

[Brink]

Hello Ebi, and welcome to Eight Forums.

If you formatted the space when you created a new partition, then you may have permanently lost the information.

You could try using the tutorial below to recover the partition.

http://www.eightforums.com/tutorials/31950-partition-recover-deleted-partitions-windows.html

Hope this helps,
Shawn

 

[jdm43]

Hi, I am facing the following problem with an 8GB PNY Attaché USB 2.0 stick which had BitLocker encryption on.

Last week, I was in a rush to leave work and catch my train so I attempted to "Safely Remove Hardware and Eject Media" on a Windows 7 laptop while I was still accessing the aforementioned drive with DjVu. If I remember correctly, I did close the application, after viewing the warning advising me against removing the USB, and while I was shutting down the work laptop, I removed the drive. Apparently, this is what happened (according to the event viewer log entries):


Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

[FONT=courier new]DETAIL - 
 8 user registry handles leaked from \Registry\User\:
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\NamedSettings\UNIV
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\ApplicationDefaults
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\ApplicationDefaults
Process 1268 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1268 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\NamedSettings
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\NamedSettings
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\ApplicationDefaults\UNIV
[/FONT][FONT=courier new]Device action request for device 'USB\VID_154B&PID_0048\AAAB025100000314' was vetoed by 'STORAGE\Volume\_??_USBSTOR#Disk&Ven_PNY&Prod_USB_2.0_FD&Rev_8192#AAAB025100000314&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}' with veto type 5.[/FONT]

The following morning I wanted to copy some files off of the stick and tried to use it on my Windows 8.1 laptop at home; it took a long time to bring up the window informing me that this was as BitLocker-encrypted USB key, so, again, I (stupidly) removed it. As I was doing that, the window finally came up for a brief instant. When I re-inserted it, I got the all-too familiar dreaded "You need to format…" window:



When I clicked on "Cancel", I was informed that the "Location is not available":



Sure enough, the "locked disk" icon is gone:



Disk Management didn't help either – the USB is no longer an NTFS disk:





I followed your instructions for repair-bde and this is what I came up with:

[FONT=courier new]Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
 
C:\WINDOWS\system32>repair-bde G: F: -pw -F
BitLocker Drive Encryption: Repair Tool version 6.3.9600
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
 
Enter the password to unlock this volume:
Beginning scan for BitLocker metadata.
 
Scanning boot sectors for pointer to metadata: 100%
Scanning sector boundaries for metadata: 100%
Finished scanning for BitLocker metadata.
LOG INFO: 0x0000002a
Valid metadata at offset 35762176 found at scan level 4.
LOG INFO: 0x0000002b
Successfully created repair context.
Beginning decryption.
Decrypting: 100% Complete.
Finished decryption.
 
ACTION REQUIRED: Run 'chkdsk F: /f' before viewing decrypted data.
 
C:\WINDOWS\system32>chkdsk F: /f
The type of the file system is NTFS.
The first NTFS boot sector is unreadable or corrupt.
Reading second NTFS boot sector instead.
[/FONT][FONT=courier new]Unable to determine volume version and state.  CHKDSK aborted.[/FONT]

Interestingly enough, when I attempt to use a "wrong" password, it complained about it (something to do with the LOG INFO…). Using repair-bde with an ".img" file didn't work either – although I did not see any warning or error messages:

[FONT=courier new]Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
 
C:\WINDOWS\system32>repair-bde G: F:\recover.img -pw -force
BitLocker Drive Encryption: Repair Tool version 6.3.9600
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
 
Enter the password to unlock this volume:
Beginning scan for BitLocker metadata.
 
Scanning boot sectors for pointer to metadata: 100%
Scanning sector boundaries for metadata: 100%
Finished scanning for BitLocker metadata.
LOG INFO: 0x0000002a
Valid metadata at offset 35729920 found at scan level 4.
LOG INFO: 0x0000002b
Successfully created repair context.
Beginning decryption.
Decrypting: 100% Complete.
[/FONT][FONT=courier new]Finished decryption.[/FONT]

The size of the resulting *.img file is 7.46 GB (8,011,390,464 bytes), but as you probably guessed, it doesn't open with 7-Zip, WinRar, or, of course, with Windows Explorer; it's a corrupted archive.



I even tried to salvage the disk contents using a ddrescue on an Ubuntu 14.04 machine (as per the instructions at (iBoyd) » Recovering Data from a Failing Bitlocker Hard Drive – no luck either, although, once again, there were no error messages:

[FONT=courier new]user@laptop:~$ sudo ddrescue /dev/sdc /dev/sdb ~/Downloads/rescue.log -r -1 -a 10000 -d --force
[sudo] password for user:
 
 
GNU ddrescue 1.17
Press Ctrl-C to interrupt
rescued:     8019 MB,  errsize:       0 B,  current rate:   21522 kB/s
   ipos:     7356 MB,   errors:       0,    average rate:    4450 kB/s
   opos:     7356 MB,    time since last successful read:       0 s
Finished [/FONT]

I then tried test disk but, once again, nothing came up:

[FONT=courier new]Sat May  3 00:28:38 2014
Command line: TestDisk
 
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
[URL="http://www.cgsecurity.org"]CGSecurity - Data recovery: TestDisk & PhotoRec[/URL]
OS: Linux, kernel 3.13.0-24-generic (#46-Ubuntu SMP Thu Apr 10 19:11:08 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco        976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS725050A9A364, 
Disk /dev/sdb - 8019 MB / 7648 MiB - CHS 974 255 63, sector size=512 - PNY USB 2.0 FD, FW:8192
 
Partition table type (auto): Intel
Disk /dev/sdb - 8019 MB / 7648 MiB - PNY USB 2.0 FD
Partition table type: Intel
 
Analyse Disk /dev/sdb - 8019 MB / 7648 MiB - CHS 974 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
 
search_part()
Disk /dev/sdb - 8019 MB / 7648 MiB - CHS 974 255 63
 
Results
Can't open backup.log file: No such file or directory
interface_load
Change partition type:
     HPFS - NTFS              0   0  1   973 254 63   15647310
 
interface_write()
 
No partition found or selected for recovery
NTFS signature is missing.
NTFS signature is missing.
simulate write!
 
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
 
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
 
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
Can't open filesystem. Filesystem seems damaged.
New options :
 Dump : Yes
 Align partition: Yes
 Expert mode : Yes
 
[/FONT][FONT=courier new]TestDisk exited normally.[/FONT]

I've tried a number of demo/trial version of commercial packages but without success. I also looked at WinHex – whose output didn't look very promising when compared to a "healthy" BitLocker-enabled USB key:

"Good":



"Bad":



Any chance I can salvage this disk?
Many thanks in advance for your help!

 

[Brink]

Hello JDM,

Since it shows that the drive successfully 100% decrypted, you might see if using an option below may be able to help to recover the RAW drive.

http://www.eightforums.com/tutorials/31950-partition-recover-deleted-partitions-windows.html

Hope this helps for now,
Shawn

 

[abbi]

unable to unlock encrypted drive

I encrypted 2 drives. I was able to unlock 1 drive but when I tried to unlock my f drive my computer used to hang and then tried to decryption by using bde recovery tool. but my decryption process stops at 12% and dosent complete
plz help