Can I recover data from an encrypted drive?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
michaelshaw
Posts: 2
Joined: 06 Jan 2014, 09:46

Can I recover data from an encrypted drive?

#1 Post by michaelshaw »

Hello, a cry for help from Hiroshima...

I have in hand a Buffalo 320Gb external USB hard drive, model HD-PF320U2, and I'm stuck. The drive is picked up as a healthy volume in Win XP, 7 and 8 but I can't assign a drive letter and my only right-click option in Disk Management is to delete the volume.

Testdisk can't find a partition and Photorec returns some 8~9Gb and larger image files, ie not valid files.

I used DDrescue to copy the data on the Buffalo drive to a new Seagate (500Gb) identifying some bad sectors on the Buffalo in the process. The Seagate wouldn't mount either.

After trying Testdisk, Photorec and DDRescue I learned of Buffalo's Securelock 256-bit encryption and also learned that the owner of the drive accessed the info on it with a password. So I'm assuming the data on the drive is encrypted, which is why Photorec cannot retrieve the photos on the drive.

Buffalo's telephone support tells me encryption is unique to each drive - not the model, but each single drive.

So I have a Buffalo hard drive with encrypted data and bad sectors which I guess equals a corrupt partition table. I also have the same data on a healthy drive that can never be read from that drive.

If the partition table on the Buffalo is not encrypted can I rebuild it somehow with Testdisk?

Or can I possible delete the volume on the Buffalo Drive, create a new partition and then restore the encrypted data from the Seagate?

Sorry, I'm clutching at straws. Any advice you can offer would be deeply, sincerely appreciated.

Michael

michaelshaw
Posts: 2
Joined: 06 Jan 2014, 09:46

Re: Can I recover data from an encrypted drive?

#2 Post by michaelshaw »

Still trying to make some progress here.

I installed an old version of Buffalo's SecureLock software under XP, and recovered the password from the owner's brain, so the disk is no longer password-protected and mounts as the H: drive. Unfortunately TestDisk still can't detect a partition.

In a post that seems to describe a situation very similar to the one I have with the disk I'm trying to recover (minus any encryption issues) Fiona wrote:

In TestDisk you can try to use Delete to clear the partition table, in case if there is any error.
Currently there is no MBR or partition table, so you can't do anything wrong.
If you get your disk initialized, then windows and testdisk can handle it.
Initializing only writes a 4 byte signatur to the MBR.
After initializing you can use Testdisk or Datenrecovery software to have a try to recover your data.


I have no idea how to initialise the disk. Is deleting the data in the partition table a possible way forward?

Another idea, maybe far-fetched. As mentioned in my first post I have the data from the bad drive backed up on another external drive, courtesy of DDRescue. If I reformat the drive I'm struggling with, can I transfer encrypted data back to the original drive somehow? Feasible?

Thanks in advance for any advice that comes my way...

Michael

Locked