Data Recovery Bitlocker

All things storage here: hard drives, DVD RW drives, little wicker baskets.

Moderators: morphine, Steel

Data Recovery Bitlocker

Postposted on Tue Apr 02, 2013 12:00 pm

I work for a company that encrypts every laptop drive with Bitlocker drive encryption within Windows 7. The problem is that everytime I need to recover data none of my linux based tools work as well as the GetDataBack software. Is there a recovery software that could handle this scenerio: Hard drive encrypted with bitlocker, user leaves company and the laptop is reimaged, old manager wants data recovered that was in a non-standard location for backup, e.g. AppData. I know the encryption key for the previous install before it was reimaged. The reimage has also not been encrypted yet.

Thanks
chrissodey
Gerbil
 
Posts: 14
Joined: Wed Jun 22, 2011 2:57 pm

Re: Data Recovery Bitlocker

Postposted on Tue Apr 02, 2013 4:28 pm

I guess you already tried the Bitlocker repair tool? Although I expect that might not work if you actually reimaged the drive. Otherwise you are probably at the mercy of some other commercial solution like http://www.diskinternals.com/efs-recovery/ or something similar. I've never needed to recover from a bitlocker encrypted though so I cant vouch for anything off the bat that I know will work. Or if they will work once you reimaged the driver. If it it was unencrypted from the start I know a few tools, but otherwise, just try both of the above and see. The first is free and the second has a free trial.

Before you start, you might just want to make a true block level image of the drive and try the tools on those first if the data is important.
Aphasia
Grand Gerbil Poohbah
 
Posts: 3447
Joined: Tue Jan 01, 2002 7:00 pm
Location: Solna/Sweden

Re: Data Recovery Bitlocker

Postposted on Tue Apr 02, 2013 5:05 pm

Are you in a Server 2008 or newer environment? If so, you can use AD to cache all of the laptop encryption keys on the server and remotely unlock and grab the data while connected to the network.
It is one of the blessings of old friends that you can afford to be stupid with them. Ralph Waldo Emerson.
Captain Ned
Global Moderator
Gold subscriber
 
 
Posts: 20255
Joined: Wed Jan 16, 2002 7:00 pm
Location: Vermont, USA

Re: Data Recovery Bitlocker

Postposted on Tue Apr 02, 2013 5:46 pm

Captain Ned wrote:Are you in a Server 2008 or newer environment? If so, you can use AD to cache all of the laptop encryption keys on the server and remotely unlock and grab the data while connected to the network.


The horse has already left the barn. He's got the key, but the data's gone and the laptop re-imaged, and now that this has been done (naturally) someone higher up the food chain wants probably-overwritten data recovered, on a volume that is not only encrypted with the current Bitlocker key, but hosts partially-overwritten data that was encrypted with a different Bitlocker key.

I can't help with the recovery, but it sounds like maybe OP should ask his boss for a lot of storage so that he can capture an image of everyone's drives before they get re-imaged and then store it for a set period of time. Also he should get a nice bottle of single malt because he's going to need it. :wink:
Think for yourself, schmuck!
i5-2500K@4.3|Asus P8P67-LE|8GB DDR3-1600|Powercolor R7850 2G|1.5TB 7200.11|1988 Model M|Saitek X-45 & P880|Logitech MX 518|Dell 2209WA|Sennheiser PC151|Asus Xonar DX
bthylafh
Grand Gerbil Poohbah
 
Posts: 3165
Joined: Mon Dec 29, 2003 11:55 pm
Location: Southwest Missouri, USA

Re: Data Recovery Bitlocker

Postposted on Tue Apr 02, 2013 5:48 pm

Aphasia wrote:Before you start, you might just want to make a true block level image of the drive and try the tools on those first if the data is important.


Yes, a thousand times this. Use dd to image the drive to another one of equal or greater size first.
Think for yourself, schmuck!
i5-2500K@4.3|Asus P8P67-LE|8GB DDR3-1600|Powercolor R7850 2G|1.5TB 7200.11|1988 Model M|Saitek X-45 & P880|Logitech MX 518|Dell 2209WA|Sennheiser PC151|Asus Xonar DX
bthylafh
Grand Gerbil Poohbah
 
Posts: 3165
Joined: Mon Dec 29, 2003 11:55 pm
Location: Southwest Missouri, USA

Re: Data Recovery Bitlocker

Postposted on Tue Apr 02, 2013 5:54 pm

bthylafh wrote:The horse has already left the barn.

As for the instant problem I fully agree. Just trying to make suggestions that could forestall this issue in the future.

One could also use AD to force users' data to be saved to a certain spot that then could be harvested by the network with the centrally-managed encryption keys.
It is one of the blessings of old friends that you can afford to be stupid with them. Ralph Waldo Emerson.
Captain Ned
Global Moderator
Gold subscriber
 
 
Posts: 20255
Joined: Wed Jan 16, 2002 7:00 pm
Location: Vermont, USA

Re: Data Recovery Bitlocker

Postposted on Tue Apr 02, 2013 6:59 pm

This is a policy issue more than a technical one.

The drives of departing employees needs to be archived.
"Welcome back my friends to the show that never ends. We're so glad you could attend. Come inside! Come inside!"
Ryu Connor
Global Moderator
Gold subscriber
 
 
Posts: 3538
Joined: Thu Dec 27, 2001 7:00 pm
Location: Marietta, GA

Re: Data Recovery Bitlocker

Postposted on Wed Apr 03, 2013 3:27 pm

Or rather, any important data needs to be archived, but volatile folders for temporary storage is not usually one of those things that need that unless the application just doest have good way or even a half decent way of backup up.
Aphasia
Grand Gerbil Poohbah
 
Posts: 3447
Joined: Tue Jan 01, 2002 7:00 pm
Location: Solna/Sweden

Re: Data Recovery Bitlocker

Postposted on Thu Apr 04, 2013 11:05 am

I think DiskInternals EFS is the solution I will try. Thanks for the input.
chrissodey
Gerbil
 
Posts: 14
Joined: Wed Jun 22, 2011 2:57 pm

Re: Data Recovery Bitlocker

Postposted on Sat Apr 06, 2013 5:43 pm

chrissodey wrote:I think DiskInternals EFS is the solution I will try. Thanks for the input.

EFS != Bitlocker. Don't think it can do anything there?
Image
The Model M is not for the faint of heart. You either like them or hate them.

Gerbils unite! Fold for UnitedGerbilNation, team 2630.
Flying Fox
Gerbil God
 
Posts: 24414
Joined: Mon May 24, 2004 2:19 am


Return to Storage

Who is online

Users browsing this forum: Google [Bot] and 3 guests