Bitlocker encrypted drive, windows fails to boot, data recovery options

I just had a phone call, and it seems I’ll have to solve that puzzle.
There’s a laptop with bitlocker encrypted drive, after an upgrade, the bitdefender antivirus did something unusual, now Windows doesn’t boot.
Of course why on earth would she have a backup??? :angry:
After all, I’ll get the laptop on monday, to try to get some data back.
Theoretically the recovery password is available - but this is an unconfirmed information.
Let’s hope the best.
I looked up dislocker, so I’ll try it from Linux.
Anyone here with expereince with this kind of problem?
@callpaul.eu maybe?
If there’s a known “best practice” that worked for someone already, I’d appreciate to read about it.
Thank’s a lot in advance!

4 Likes

Sorry to hear of the problem. Good luck.

I try to stay away from bitlocker encryption.

3 Likes

https://www.baeldung.com/linux/bitlocker-encrypted-device

https://answers.microsoft.com/en-us/windows/forum/all/rescue-files-when-windows-wont-start/862c143f-9239-4e63-8968-635e8ba9efd6

Good luck, you will need all your skills.

5 Likes

Surely, the encrypted passkey was stored in a safe place!!!
Does the encryption hold if the drive is pulled and mounted in a caddy on a different machine?

I used this on a machine with the same issue, but it is Window’s software, and I had to purchase a one month key, depends on how
valuable the data is!!
Only other recourse is to reformat and start over!!!

5 Likes

Bitlocker is a pain in the ass

Even microsoft techs struggle, last time I had one to solve it was a brand new machine with nothing on it except windows no files to recover. The client took it back to the shop who also could do nothing … not even format it. New machine offered.

Take the disk out and put in external box
Connect to linux machine
Try opening the drive by at least mounting it

See if you can see the drive then access files, let us know

I did discover puppy linux (32 bit) could access the drive better than mint (64) but no idea why that was

Bonne courage

5 Likes

This is a relatively new laptop under warranty, the drive is a nvme ssd.
My plan is to boot a live system from USB, then attach an other Hdd to save the data to.
Thank you all!

I’ll report how it went…
Have a nice sunday!

3 Likes

You may find you cannot get to the bios to change boot to usb bitlocker quite often stops everything, hence why i said remove the internal disk… but if its new and a slimline case taking it apart may not be an option without damage.

Return to supplier and hope they will help if its a local computer shop but if you bought through amazon or similar … bye bye data

I hate bitlocker

3 Likes

@callpaul.eu
I second that!!! Did not realize it was nvme, taking it out is a no-no, leave it in and find some software that might crack that encryption or return the PC!!!

2 Likes

Can you explain why an nvme disk should not be taken out?

2 Likes

Personally I don’t see a reason for that. I changed configuration in laptops, replaced HDD’s with SSD, replaced nvme with a bigger one, etc…
Before doing the actual disassmbly, I looked up a video on Yt, how to disassmble that particular type - so I knew where hidden screws maybe.
About this laptop in my original qestion I know only, it is an Asus model, zen-something, the drive is nvme, the machi e is still under warranty: so I won’t disassemble it.
I’ll know more monday evening :wink:

1 Like

Windows never shuts down so when you take it out the session is still open. Making access blocked

1 Like

I am not saying the nvme cannot or should not be taken out!!! A laptop is finicky creature to work on, if I disassemble a laptop to that point, then the nvme would be replaced and Windows or Linux would be reinstalled!! I wish @kovacslt the best, but that nvme may be lost forever!!!

3 Likes

As its new you dont want to start taking it apart.

My difficulty was finding a box to put it in to access the data, too many standards to stock them all preferd sata disks as a safe bet but you dont always know befire you open the box. Give me a tower anyday

2 Likes

By default it does that so the next startup is quicker. I have that disabled on all my Windows installs. The difference with modern CPU, RAM, and SSD is so small I don’t think it’s worth it.

2 Likes

I agree but suppliers are still shipping with 4gb memory ram which runs windows but if you try multitasking it is dire.

Main issue with this box I guess that has not been changed so the system may be locked

2 Likes

I see a design problem here.
Instead of fixing the slow startup ( you just need a decent init system) they avoid the issue by leaving it suspended or hibernated or something?

I am with you… turn if off… unmount the disks… be prepared for a power outage.

6 Likes

Another thought

If you create a boot usb with windows and start up on that could you disable on the other drive

Click Start, click Control Panel, click System and Security, and then click BitLocker Drive Encryption.
Select internal drive
Select disable

Then restart on internal drive ?

3 Likes

Seems I’ll get the laptop afternoon.
I’ll see what I can do with it, but I’ll try everything possible (according to my skills) to get the data back.
Well, if the recovery password deos not work, it’s a lost battle anyway.
Could it be tuesday already! I’d know what to tell, a success story, or just singin about a losing battle :slight_smile:

Edit: now it’s 12:15 here. in 15 minutes the laptop arrives.
Fingers crossed :crossed_fingers:

5 Likes

I can’t help with the issue but wishing you good luck with it!

5 Likes

An update here:

I booted Debian live, the SSD is there (I mean it is found by the system).
/dev/nvme0n1p3 is the partition in question.
According to the article linked by @nevj, dislocker seems to work, recovery password seems to be OK.
(I tried dislocker with an intentionally wrong password, and I got bad result -as expected.)
However, mounting the “dislocked” partition is not possible, the filesystem there is broken.
I ran photorec on the loop device based on the dislocked partition, it saved quite few files.
I’m gonig to try ntfsfix on the loop device, then I’ll try to mount it again.
But that means altering the disk, so I’m wating for dd to finish, which creates a bitperfect copy of the current disk content. Just in case…

5 Likes