Any Bitlocker Experts About?

[UNC151]

A friend of mine has a unique situation at work--they need to try and recover some data from a machine that was running Bitlocker, but has been since re-installed. The machine was not de-crypted prior to the re-installation, it was simply deleted from the domain and then re-installed (using WDS).

I say because the machine was not de-crypted prior to re-installation any chance of recovery is zero (the machine has a new Bitlocker key--they compared the before and after keys).

He says there are tools that can still recover anything that was not overwritten by the new installation. The machine is using a 128GB SSD and is running W7 SP1.

Which is right? Can recover or cannot recover? If anyone knows for sure it would be great because the recovery service will charge no matter if they recover something or not.

Thanks for your thoughts...

 

[fusion0389]

I am no expert on bitlocker, however my company uses it to protect all the laptops that we deploy. It seems that your situation has a couple problems, #1 the data you need was overwritten and #2 it is encrypted using bitlocker.

I have had success in the past recovering data from a non-encrypted hard drive, however the problem here is that the data is encrypted so trying to find and decipher the lost data will be near impossible in my opinion... If it has not been re-encrypted yet then maybe you can find a bitlocker repair tool or something that may be able to help recover information? If the information lost is worth lots of $$$ then it may be worthwhile to look into a reputable data recovery specialist. If they can even do anything with encrypted data it would cost many thousands of dollars to recover the information.

 

[dparm]

If it's an SSD, there's a good chance the "secure erase" command was issued by the installation utility. There is no way to recover from that.

 

[UNC151]

Originally Posted By: dparm
If it's an SSD, there's a good chance the "secure erase" command was issued by the installation utility. There is no way to recover from that.

Despite that one; would not the data be lost anyway since it was not decrypted prior to re-installation? I believe (if Bitlocker encryption works as other types do) that if a new Bitlocker key was generated then there is no recovering the other data. Alternately, perhaps the old encrypted data could be recovered, but could not be decrypted? I think the company is going to waste >$3000 to find that out...

 

[dparm]

Unsure on that. I don't do Bitlocker admin.

There are many data recovery services out there that will give you a free estimate. Worth a shot, but expect to pay hundreds of dollars per GB with a minimum of about $1k usually.