trying to recover deleted files from two Bitlocker drives


F

Fra

New member
Local time
4:34 PM
Posts
2
OS
Windows 10
Hi all

I'm trying to recover videos from 2 external USB drives with Bitlocker (one Seagate Backup Plus 4TB, and one Western Digital My passport Ultra 4TB) but results are quite bad.

After deleting the files (SHIFT+DEL) I did not write on the disks, so there shouldn't be any overwriting; nevertheless, recovery results are poor. I tried with at least 10 recovery software and more or less all of them are able to identify the same number of files on both disks, but when I attempt to recover them the larger Mp4 or MOV files are unplayable. Majority of them.

I can open the smaller AVI videos, but not the larger Mp4/MOV (larger than 1GB). I tried to open them on some HeX editor and the content appears mixed: no Mp4 signatures, no atoms, and no signs that they are video files, although they match in size the original files.

So, I'm wondering why this happened? Has it anything to do with BitLocker? Is there any possible way to try to restore my files? I tried the majority of the data recovery programs AND video repair programs but nothing worked.

I suspect the problem lies in how these files are located/recovered. Maybe is Bitlocker messing up? What to do then?

any help will be greatly appreciated, thanks

(I use Windows 10 version 1909)

Fra
 

My Computer

System One

  • OS
    Windows 10
Bitlocked drives cannot be accessed without the bitlocker key. That's the whole purpose of a user using bitlocker, to protect his information. Without the key, there's no way around it. There is file recovery software that can be used on bitlocked drives, but you still have to have the bitlocker password or 48 digit recovery key.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 24H2 26100.2314
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1tb Solidigm m.2 nvme+256gb SKHynix m.2 nvme /External drives 512gb Samsung m.2 sata+1tb Kingston m2.nvme+ 4gb Solidigm nvme
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 10 Pro 22H2 19045.3930
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 9020
    CPU
    i7-4770
    Memory
    24 gb
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    256 gb Toshiba BG4 M.2 NVE SSB and 1 tb hdd
    PSU
    500w
    Case
    MT
    Cooling
    Dell factory
    Mouse
    Logitech wireless
    Keyboard
    Logitech wired
    Internet Speed
    still not telling
    Browser
    Firefox
    Antivirus
    Defender+MWB Premium
Fra said:
Hi all

I'm trying to recover videos from 2 external USB drives with Bitlocker (one Seagate Backup Plus 4TB, and one Western Digital My passport Ultra 4TB) but results are quite bad.

After deleting the files (SHIFT+DEL) I did not write on the disks, so there shouldn't be any overwriting; nevertheless, recovery results are poor. I tried with at least 10 recovery software and more or less all of them are able to identify the same number of files on both disks, but when I attempt to recover them the larger Mp4 or MOV files are unplayable. Majority of them.

I can open the smaller AVI videos, but not the larger Mp4/MOV (larger than 1GB). I tried to open them on some HeX editor and the content appears mixed: no Mp4 signatures, no atoms, and no signs that they are video files, although they match in size the original files.

So, I'm wondering why this happened? Has it anything to do with BitLocker? Is there any possible way to try to restore my files? I tried the majority of the data recovery programs AND video repair programs but nothing worked.

I suspect the problem lies in how these files are located/recovered. Maybe is Bitlocker messing up? What to do then?

any help will be greatly appreciated, thanks

(I use Windows 10 version 1909)

Fra
Click to expand...
In order to encrpyt files, bitlocker needs temporary working space to do the encryption. As one would expect large deleted files are going to be overwritten i.e. although you have not specifically written to drives bitlocker has. As typical in this situation, you can sometimes recover smaller files as less likely to be overwritten than large files.

So I doubt there is anything you can do.
 

My Computer

System One

  • OS
    Windows 11 Pro + Win11 Canary VM.
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Zenbook 14
    CPU
    I9 13th gen i9-13900H 2.60 GHZ
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB soldered
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    laptop OLED screen
    Screen Resolution
    2880x1800 touchscreen
    Hard Drives
    1 TB NVME SSD (only weakness is only one slot)
    PSU
    Internal + 65W thunderbolt USB4 charger
    Case
    Yep, got one
    Cooling
    Stella Artois (UK pint cans - 568 ml) - extra cost.
    Keyboard
    Built in UK keybd
    Mouse
    Bluetooth , wireless dongled, wired
    Internet Speed
    900 mbs (ethernet), wifi 6 typical 350-450 mb/s both up and down
    Browser
    Edge
    Antivirus
    Defender
    Other Info
    TPM 2.0, 2xUSB4 thunderbolt, 1xUsb3 (usb a), 1xUsb-c, hdmi out, 3.5 mm audio out/in combo, ASUS backlit trackpad (inc. switchable number pad)

    Macrium Reflect Home V8
    Office 365 Family (6 users each 1TB onedrive space)
    Hyper-V (a vm runs almost as fast as my older laptop)
  • Like
Reactions: Fra
glasskuter said:
Bitlocked drives cannot be accessed without the bitlocker key. That's the whole purpose of a user using bitlocker, to protect his information. Without the key, there's no way around it. There is file recovery software that can be used on bitlocked drives, but you still have to have the bitlocker password or 48 digit recovery key.
Click to expand...
The fact that he says he can identify the deleted files and even "open the smaller AVI videos" implies he has the key and is working with the volumes in the unlocked state.

OP, file recovery on an unlocked Bitlockered volume is the same as on an ordinary volume.
 

My Computer

System One

  • OS
    Windows 11
barreleye said:
The fact that he says he can identify the deleted files and even "open the smaller AVI videos" implies he has the key and is working with the volumes in the unlocked state.

OP, file recovery on an unlocked Bitlockered volume is the same as on an ordinary volume.
Click to expand...
You are missing the point - bitlocker needs space to do the encryption (or unencryption) and will overwrite some of space used by deleted files if it was done after the encryption.

This is same as a user writing data to a drive after files have been deleted where only partial recovery of deleted files is usually possible.
 

My Computer

System One

  • OS
    Windows 11 Pro + Win11 Canary VM.
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Zenbook 14
    CPU
    I9 13th gen i9-13900H 2.60 GHZ
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB soldered
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    laptop OLED screen
    Screen Resolution
    2880x1800 touchscreen
    Hard Drives
    1 TB NVME SSD (only weakness is only one slot)
    PSU
    Internal + 65W thunderbolt USB4 charger
    Case
    Yep, got one
    Cooling
    Stella Artois (UK pint cans - 568 ml) - extra cost.
    Keyboard
    Built in UK keybd
    Mouse
    Bluetooth , wireless dongled, wired
    Internet Speed
    900 mbs (ethernet), wifi 6 typical 350-450 mb/s both up and down
    Browser
    Edge
    Antivirus
    Defender
    Other Info
    TPM 2.0, 2xUSB4 thunderbolt, 1xUsb3 (usb a), 1xUsb-c, hdmi out, 3.5 mm audio out/in combo, ASUS backlit trackpad (inc. switchable number pad)

    Macrium Reflect Home V8
    Office 365 Family (6 users each 1TB onedrive space)
    Hyper-V (a vm runs almost as fast as my older laptop)
cereberus said:
You are missing the point - bitlocker needs space to do the encryption (or unencryption) and will overwrite some of space used by deleted files if it was done after the encryption.

This is same as a user writing data to a drive after files have been deleted where only partial recovery of deleted files is usually possible.
Click to expand...

I didn't see your post, so wasn't responding to it, but I do see it now after choosing to show your latest reply and making some changes. Do you have a reference for that claim, because it sounds extremely dubious to put it mildly.
 

My Computer

System One

  • OS
    Windows 11
You must log in or register to reply here.

Similar threads

recover deleted files
Replies
10
Views
3K
FreeBooter
FreeBooter
How to sort the latest data files from two to one computers?
Replies
1
Views
715
Berton
Berton

Latest Support Threads

Latest Tutorials

Back
Top Bottom