• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

BitLocker Repair Tool - Recover Drive in Windows 7 and 8


Brink

Administrator
Administrator
mvp
Posts
22,871
BitLocker Repair Tool - Recover Drive in Windows 7 and 8
This tutorial will show you how to use the BitLocker Repair Tool to recover your data from a damaged encrypted OS drive, fixed data drive, or removable data drive in Windows 7 and Windows 8.
Published by Brink
#1
Synopsis
This tutorial will show you how to use the BitLocker Repair Tool to recover your data from a damaged encrypted OS drive, fixed data drive, or removable data drive in Windows 7 and Windows 8.
How to Use BitLocker Repair Tool to Recover a Drive in Windows 7 and Windows 8
The BitLocker Repair Tool (Repair-bde) is a command-line tool included with Windows Server 2008 R2, Windows 7, Windows Server 2012, and Windows 8. This tool attempts to repair or decrypt a damaged BitLocker-encrypted volume using the supplied recovery information to reconstruct critical parts of the drive and salvage recoverable data to another volume.

This tutorial will show you how to use the BitLocker Repair Tool to recover your data from a damaged encrypted operating system (OS) drive, fixed data drive (ex: internal volume/drive), or removable data drive (ex: USB drive) in Windows 7 and Windows 8.

You must be signed in as an administrator to be able to do the steps in this tutorial.


Note   Note

  • You must have at least one of the following for the BitLocker encrypted drive:
    • Password
    • Recovery key
    • Startup key .BEK file location
  • You will need to have an empty output volume (drive) of equal or larger size than the damaged BitLocker encrypted drive. The contents of the output volume will be completely deleted and overwritten by the decrypted contents of the damaged BitLocker drive.
warning   Warning
The BitLocker Repair Tool should only be used as a last resort when you were unable to decrypt or unlock the encrypted drive using either the password, recovery key, USB flash drive, or BitLocker Recovery.

Tip   Tip
If you were signed in to your Microsoft account when you encrypted a drive with BitLocker, then you can get your recovery key from your OneDrive at the link below.


Microsoft account: BitLocker recovery keys



EXAMPLE: Before and After using BitLocker Repair Tool
NOTE: In this example, the BitLocker encrypted drive is F: and the output volume is E: .

Computer_Before_BRT.jpg

Computer_After_BRT.jpg



Here's How:

1. Do step 2, 3, or 4 below depending on what you would like to do.


2. To Use the Password in Windows 8
NOTE: This option is only available in Windows 8, and would be for an OS drive, fixed data drive, or removable data drive that you have configured to be unlocked by a password.

A) Open an elevated command prompt.

B) In the elevated command prompt, type the command below, and press Enter. (see screenshot below)

repair-bde F: E: -pw -F

Note   Note
For only items in red in the command above:

Substitute F for the drive letter of the Bitlocker encrypted drive. Not the last F.

Substitute E for the drive letter of the output volume you want to have the contents of the Bitlocker encrypted drive decrypted and copied to.





C) When prompted in the command prompt, type the recovery password for this encrypted drive, press Enter, and go to step 5 below.
NOTE: You will not see the password as you type it.

BRT_CMD_Password.jpg

3. To Use the Recovery Key in Windows 7 and 8
NOTE: This would be for an OS drive, fixed data drive, or removable data drive that you still have the recovery key either saved to your Microsoft account, saved to a file, saved to a USB flash drive, or printed.

A) Open an elevated command prompt.

B) In the elevated command prompt, type the command below, press Enter, and go to step 5 below. (see screenshot below)

repair-bde F: E: -rp BitLockerRecoveryKey -F


For example:

Code:
repair-bde [COLOR=#ff0000][B]F[/B][/COLOR]: [COLOR=#ff0000][B]E[/B][/COLOR]: -rp [COLOR=#ff0000][B]261173-522599-237072-583517-442068-316811-199375-623755[/B][/COLOR] -F
Note   Note
For only items in red in the command above:


Substitute F for the drive letter of the Bitlocker encrypted drive.

Substitute E for the drive letter of the output volume you want to have the contents of the Bitlocker encrypted drive decrypted and copied to.

Substitute BitLockerRecoveryKey for the actual 48 digit recovery key for the encrypted drive like below.

Saved to USB or File:

Recover_Key-1.jpg
Recover_Key-2.jpg

Saved to Microsoft account:

Recover_Key-3.jpg





BRT_CMD_Recovery_Key.jpg


4. To Use the Startup Key in Windows 7 and 8
NOTE: This would only be for an OS drive that you have configured to be unlocked by a USB flash drive.

A) Since you will not be able to boot from the OS drive, you will need to first connect it to another Windows Server 2008 R2, Windows 7, Windows Server 2012, or Windows 8 PC.

B) Open an elevated command prompt in the other PC.

C) In the elevated command prompt, type the command below, press Enter, and go to step 5 below. (see screenshot below)

repair-bde F: E: -rk I:\StartupKey.BEK -F


For example:

Code:
repair-bde [COLOR=#ff0000][B]Z[/B][/COLOR]: [COLOR=#ff0000][B]E[/B][/COLOR]: -rk [COLOR=#ff0000][B]I[/B][/COLOR]:\[COLOR=#ff0000][B]AFA58D77-94CD-4300-8009-68B36AE53276[/B][/COLOR].BEK -F
Note   Note
For only items in red in the command above:

Substitute F for the drive letter of the Bitlocker encrypted drive.

Substitute E for the drive letter of the output volume you want to have the contents of the Bitlocker encrypted drive decrypted and copied to.

Substitute I for the USB drive letter that the startup key has been saved or copied to.

Substitute StartupKey for the actual file name of the startup key for the encrypted drive like below. The BEK file (startup key) will be a hidden protected OS file.

Startup_Key_BEK.jpg






BRT_CMD_Startup_Key.jpg


5. When finally successfully finished, follow any given "ACTION REQUIRED" first. For example, to run chkdsk on the output volume before opening. (see screenshots below step 2, 3, and 3 above)

NOTE: The BitLocker Repair Tool may take a long time to finish, but you will still be able to use your PC during the recovery process. Just do not turn off the PC until it has finished.

6. You will now be able to open the output volume (ex: E) to view the decrypted files from the BitLocker encrypted drive (ex: F).



That's it,
Shawn


Related Tutorials


 
Last edited by a moderator:

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL
Posts
4
#2
Bitlocker

Respected..earlier i had windows7 ,,at that time i had encrypted D drive of my pc...but did not save its recovery key..or may be saved in the same drive..after one year of encryption i tried to change its password...it was processing,,suddenly electricity failed and my pc shut down...after that i tried a lot to open my drive...but couldnt open. and few months back i installed windows 8...kindly help me....i m very harassed...one of my friend told me about your site..i also went to Microsoft offices in gurgaon Delhi, but did not get any help.....there are my family memories pics in that drive....i shall be highly-highly-highly grateful to u...pls help me.
 
Last edited by a moderator:

My Computer

System One

  • OS
    windows 8
    Computer type
    PC/Desktop

Brink

Administrator
Administrator
mvp
Posts
22,871
#3
Hello Heenasar, and welcome to Eight Forums.

Most likely you may have lost everything on that drive due to the power outage corrupting it and your BitLocker password.

Unless you saved your BitLocker recovery key to another location as a backup, then you lost it when your formatted Windows 7 to install Windows 8.

About all you can do is try to unlock the drive with both your old or new Bitlocker password using step 2 in the tutorial to see if either will work.

....or by trying step 2 in OPTION TWO of the tutorial below.
If you are unable to, then I'm afraid that you may not be able to unlock it, and lost the contents. :(
 

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL
Posts
4
#4
i saved recovery in the same encrypted drive D. ...i tried to open with new and old password..but couldnt get success...
Is it possible now that if i format D drive(encrypted). will it be opend automatically.....if yes then is it also possible to recover those important data by data recovery software..pls help me. pls tell me full process in which i could get my datas back after formatting..
 

My Computer

System One

  • OS
    windows 8
    Computer type
    PC/Desktop

Brink

Administrator
Administrator
mvp
Posts
22,871
#5
The whole point of BitLocker encryption is that without the password or recovery key, access will not be allowed.

You will be able to format the drive to be able to use it again, but doing so will also delete all data on the drive.

I'm sorry, but you will most likely not be able to recover any data without these. Especially since you lost power in the middle of changing the BitLocker password. :(

I hope you had backups of your data to restore from.
 

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL
Posts
4
#6
how to check i have back up.

please tell me how to check whether i have backup data of window 7 or not?and if i have...then how to backup ? what file are required to backup? and also tell me, what else can i try to open if i have backup data?
 

My Computer

System One

  • OS
    windows 8
    Computer type
    PC/Desktop

Brink

Administrator
Administrator
mvp
Posts
22,871
#7
Unfortunately, if you don't know if you have a backup, then you most likely don't since you would have needed to manually back them up. :(
 

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL
Posts
4
#8
can u please elaborate? i could not understand...pls tell how to check that i have back up? and if i do not have then how can i get back up?
Unfortunately, if you don't know if you have a backup, then you most likely don't since you would have needed to manually back them up. :(
 

My Computer

System One

  • OS
    windows 8
    Computer type
    PC/Desktop

Brink

Administrator
Administrator
mvp
Posts
22,871
#9
If you do not know that you have a backup, then you do not have one since you would have had to created a backup to have one. If you created a backup, then you would know that you had one.

You cannot create a backup after the data is gone. It must be created before. :(

Next time, please be sure to save a copy of your BitLocker recovery key and password in a safe place in case you may need it like in this case. In addition, you should always have any files that you do not want to lose backed up to a safe location as well.
 

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL

feras

New Member
Posts
2
#10

i have a problem with output HDD :

i have used


repair-bde G: F: -rp 344531-200420-ccccc-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXXX-F -LF c:\log.txt
then i did a
chkdsk f: /F
i got this message

The type of the file system is NTFS.
The first NTFS boot sector is unreadable or corrupt.
Reading second NTFS boot sector instead.
Unable to determine volume version and state. CHKDSK aborted.
1.JPG
2.JPG 3.JPG

any advice to get back my data on output HDD please???
 

My Computer

System One

  • OS
    Windows /

Brink

Administrator
Administrator
mvp
Posts
22,871
#11
Hello Feras, and welcome to Eight Forums.

Is F: a separate physical hard drive?

You might see if formatting F: and see if you are able to successfully run "chkdsk F: /F" on it. If so, then try using the BitLocker Repair Tool again.

Hope this helps, :)
Shawn
 

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL

feras

New Member
Posts
2
#12
Hello Feras, and welcome to Eight Forums.

Is F: a separate physical hard drive?

You might see if formatting F: and see if you are able to successfully run "chkdsk F: /F" on it. If so, then try using the BitLocker Repair Tool again.

Hope this helps, :)
Shawn
thanks for your fast replay
F: output is usb3 external HDD 3tb, new one i bought before 2 days.
G: input is usb3 external HDD is 700gb.
is any other solution to change the RAW disk to be able to read
 

My Computer

System One

  • OS
    Windows /

Brink

Administrator
Administrator
mvp
Posts
22,871
#13

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL

Hirkman

New Member
Posts
1
#14
Hi, A while ago I tried to use bitlocker to encrypt my external hard drive, however the process was interrupted and now I cannot access anything in it. I'm following this guide trying to move its contents to another external of the same size. I am using Windows 7 Ultimate.

I'm currently in the middle of step 3 after entering
'repair-bde F: E: -rp myBitLockerRecoveryKey -F', where the red text is replaced by my actual key, and right now I am seeing the attached screenshot.

I'm worried since it looks like something's going wrong here...

I'd appreciate any help, thanks

edit:...I'm not sure if I attached the image correctly to this post so...let me know if you can see it, thanks

Bitlocker repair screenshot.png
 
Last edited by a moderator:

My Computer

System One

  • OS
    Windows 7 Ultimate
    Computer type
    PC/Desktop

Brink

Administrator
Administrator
mvp
Posts
22,871
#15
Hello Hirkman, and welcome to Eight Forums.

I'm afraid that since BitLocker was interrupted while encrypting, you may be out of luck, and may need to format the hard drive to be able to use it again.

I hope you had a back up of the data on the drive. :(
 

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL
Posts
1
#16
Hello, my encrypted Drive with Bitlocker has been disappeared(exactly I dont know why!) and I had free space as much as the disappeared Drive instead of selfsame Drive. then i made a new Drive with the free space with a software but it was empty. therefore i losed my information from the encrypted Drive. how can i recover them.
 

My Computer

System One

  • OS
    windows 8.1
    Computer type
    Laptop

Brink

Administrator
Administrator
mvp
Posts
22,871
#17

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL

jdm43

New Member
Posts
2
#18
Hi, I am facing the following problem with an 8GB PNY Attaché USB 2.0 stick which had BitLocker encryption on.

Last week, I was in a rush to leave work and catch my train so I attempted to "Safely Remove Hardware and Eject Media" on a Windows 7 laptop while I was still accessing the aforementioned drive with DjVu. If I remember correctly, I did close the application, after viewing the warning advising me against removing the USB, and while I was shutting down the work laptop, I removed the drive. Apparently, this is what happened (according to the event viewer log entries):


Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

Code:
[FONT=courier new]DETAIL - 
 8 user registry handles leaked from \Registry\User\:
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\NamedSettings\UNIV
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\ApplicationDefaults
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\ApplicationDefaults
Process 1268 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1268 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\NamedSettings
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\NamedSettings
Process 4224 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\Software\Xerox\PrinterDriver\V5.0\ApplicationDefaults\UNIV
[/FONT][FONT=courier new]Device action request for device 'USB\VID_154B&PID_0048\AAAB025100000314' was vetoed by 'STORAGE\Volume\_??_USBSTOR#Disk&Ven_PNY&Prod_USB_2.0_FD&Rev_8192#AAAB025100000314&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}' with veto type 5.[/FONT]
The following morning I wanted to copy some files off of the stick and tried to use it on my Windows 8.1 laptop at home; it took a long time to bring up the window informing me that this was as BitLocker-encrypted USB key, so, again, I (stupidly) removed it. As I was doing that, the window finally came up for a brief instant. When I re-inserted it, I got the all-too familiar dreaded "You need to format…" window:

01. Format.png

When I clicked on "Cancel", I was informed that the "Location is not available":

02. Location is not available.png

Sure enough, the "locked disk" icon is gone:

03. Explorer.png

Disk Management didn't help either – the USB is no longer an NTFS disk:

04. Disk Management.png

05. PNY USB 2.0 FD USB Device Properties.png

I followed your instructions for repair-bde and this is what I came up with:

Code:
[FONT=courier new]Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
 
C:\WINDOWS\system32>repair-bde G: F: -pw -F
BitLocker Drive Encryption: Repair Tool version 6.3.9600
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
 
Enter the password to unlock this volume:
Beginning scan for BitLocker metadata.
 
Scanning boot sectors for pointer to metadata: 100%
Scanning sector boundaries for metadata: 100%
Finished scanning for BitLocker metadata.
LOG INFO: 0x0000002a
Valid metadata at offset 35762176 found at scan level 4.
LOG INFO: 0x0000002b
Successfully created repair context.
Beginning decryption.
Decrypting: 100% Complete.
Finished decryption.
 
ACTION REQUIRED: Run 'chkdsk F: /f' before viewing decrypted data.
 
C:\WINDOWS\system32>chkdsk F: /f
The type of the file system is NTFS.
The first NTFS boot sector is unreadable or corrupt.
Reading second NTFS boot sector instead.
[/FONT][FONT=courier new]Unable to determine volume version and state.  CHKDSK aborted.[/FONT]

Interestingly enough, when I attempt to use a "wrong" password, it complained about it (something to do with the LOG INFO…). Using repair-bde with an ".img" file didn't work either – although I did not see any warning or error messages:


Code:
[FONT=courier new]Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
 
C:\WINDOWS\system32>repair-bde G: F:\recover.img -pw -force
BitLocker Drive Encryption: Repair Tool version 6.3.9600
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
 
Enter the password to unlock this volume:
Beginning scan for BitLocker metadata.
 
Scanning boot sectors for pointer to metadata: 100%
Scanning sector boundaries for metadata: 100%
Finished scanning for BitLocker metadata.
LOG INFO: 0x0000002a
Valid metadata at offset 35729920 found at scan level 4.
LOG INFO: 0x0000002b
Successfully created repair context.
Beginning decryption.
Decrypting: 100% Complete.
[/FONT][FONT=courier new]Finished decryption.[/FONT]

The size of the resulting *.img file is 7.46 GB (8,011,390,464 bytes), but as you probably guessed, it doesn't open with 7-Zip, WinRar, or, of course, with Windows Explorer; it's a corrupted archive.

06. Couldn't Mount File.png

I even tried to salvage the disk contents using a ddrescue on an Ubuntu 14.04 machine (as per the instructions at (iBoyd) » Recovering Data from a Failing Bitlocker Hard Drive – no luck either, although, once again, there were no error messages:


Code:
[FONT=courier new][email protected]:~$ sudo ddrescue /dev/sdc /dev/sdb ~/Downloads/rescue.log -r -1 -a 10000 -d --force
[sudo] password for user:
 
 
GNU ddrescue 1.17
Press Ctrl-C to interrupt
rescued:     8019 MB,  errsize:       0 B,  current rate:   21522 kB/s
   ipos:     7356 MB,   errors:       0,    average rate:    4450 kB/s
   opos:     7356 MB,    time since last successful read:       0 s
Finished [/FONT]
I then tried test disk but, once again, nothing came up:


Code:
[FONT=courier new]Sat May  3 00:28:38 2014
Command line: TestDisk
 
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <[email protected]>
[URL="http://www.cgsecurity.org"]CGSecurity - Data recovery: TestDisk & PhotoRec[/URL]
OS: Linux, kernel 3.13.0-24-generic (#46-Ubuntu SMP Thu Apr 10 19:11:08 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco        976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS725050A9A364, 
Disk /dev/sdb - 8019 MB / 7648 MiB - CHS 974 255 63, sector size=512 - PNY USB 2.0 FD, FW:8192
 
Partition table type (auto): Intel
Disk /dev/sdb - 8019 MB / 7648 MiB - PNY USB 2.0 FD
Partition table type: Intel
 
Analyse Disk /dev/sdb - 8019 MB / 7648 MiB - CHS 974 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
 
search_part()
Disk /dev/sdb - 8019 MB / 7648 MiB - CHS 974 255 63
 
Results
Can't open backup.log file: No such file or directory
interface_load
Change partition type:
     HPFS - NTFS              0   0  1   973 254 63   15647310
 
interface_write()
 
No partition found or selected for recovery
NTFS signature is missing.
NTFS signature is missing.
simulate write!
 
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
 
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
 
 1 * HPFS - NTFS              0   1  1   973 254 63   15647247
Can't open filesystem. Filesystem seems damaged.
New options :
 Dump : Yes
 Align partition: Yes
 Expert mode : Yes
 
[/FONT][FONT=courier new]TestDisk exited normally.[/FONT]
I've tried a number of demo/trial version of commercial packages but without success. I also looked at WinHex – whose output didn't look very promising when compared to a "healthy" BitLocker-enabled USB key:

"Good":

WinHex Output (test disk + bitlocker - partition).png

"Bad":

WinHex Output (test disk + bitlocker).png

Any chance I can salvage this disk?
Many thanks in advance for your help!
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1
    Computer type
    Laptop
    System Manufacturer/Model Number
    Lenovo
    CPU
    Mobile QuadCore Intel Core i7-3632QM, 2400 MHz (24 x 100)
    Motherboard
    Lenovo
    Memory
    8048 MB (DDR3-1600 DDR3 SDRAM)
    Graphics Card(s)
    Intel(R) HD Graphics 4000 (2112 MB)

Brink

Administrator
Administrator
mvp
Posts
22,871
#19

My Computer

System One

  • OS
    64-bit Windows 10
    Computer type
    PC/Desktop
    System Manufacturer/Model Number
    Custom self built
    CPU
    Intel i7-3930K 3.2 Ghz (O/C to 4 Ghz)
    Motherboard
    ASRock X79 Extreme11
    Memory
    32 GB (8GBx4) G.SKILL DDR3 Quad PC3-19200 2400 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    SB Recon 3Di Integrated Chip
    Monitor(s) Displays
    3 x 27" Asus VE278Q
    Screen Resolution
    1920x1080
    Hard Drives
    256GB OCZ Vector
    6TB WD Black WD6001FZWX
    PSU
    OCZ Series Gold OCZZ1000M 1000W
    Case
    Corsair Air 740
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master
    Internet Speed
    100 Mb/s Download and 10 Mb/s Upload
    Browser
    Internet Explorer 11
    Antivirus
    Malwarebyte Anti-Malware Premium
    Other Info
    Lite-On iHBS212 12x BD Writer
    Creative F200 webcam
    Samsung CLX-3175FW Printer
    Linksys EA9500 Router
    Arris SB6190 Cable Modem
    APC SMART-UPS RT 1000 XL

abbi

New Member
Posts
4
#20
unable to unlock encrypted drive

I encrypted 2 drives. I was able to unlock 1 drive but when I tried to unlock my f drive my computer used to hang and then tried to decryption by using bde recovery tool. but my decryption process stops at 12% and dosent complete
plz help
 

My Computer

System One

  • OS
    Windows 7