BitLocker Partition Recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ds5105119
Posts: 1
Joined: 04 Dec 2022, 16:48

BitLocker Partition Recovery

#1 Post by ds5105119 »

Hello,

My computer has a 256GB SSD (C:) with Windows installed and a 1.0TB (D:) hard disk. (both GPT)
The 256GB SSD has 4 partitions.

1. Recovery Partition
2. EFI System Partition
3. maybe OEM Partition
4. BitLocker Partition

The important thing is that since I installed Ubuntu on the D drive, Windows fell into an automatic repair loop.
So I checked the C drive with Ubuntu, the 4th BitLocker partition was showen as Free Space.

I ran EFI GPT>Analyse>Quick Search in Testdisk.
After the MS Data, EFI System, and Unknows partitions appear, only the MS Data and EFI System partitions remain when the process is finished.
After using Deeper Search more partitions appear, at the end of the process there are 5 MS Data and EFI System partitions left.
After going through the None>Analyse>Quick Search process, a partition named "Sys=0C" appears with "the following partitions can't be recovered" message.

I will be dumping the c drive soon using ddrescue. I want to recover the 4th BitLocker partition and boot windows again. What should I do?
Thanks.

Code: Select all



Sun Dec  4 20:23:32 2022
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.0-56-generic (#62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022) x86_64
Compiler: GCC 11.2
ext2fs lib: 1.46.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
User is not root!
Hard disk list


TestDisk exited normally.
Using locale 'LC_CTYPE=en_US.UTF-8;LC_NUMERIC=ko_KR.UTF-8;LC_TIME=ko_KR.UTF-8;LC_COLLATE=en_US.UTF-8;LC_MONETARY=ko_KR.UTF-8;LC_MESSAGES=en_US.UTF-8;LC_PAPER=ko_KR.UTF-8;LC_NAME=ko_KR.UTF-8;LC_ADDRESS=ko_KR.UTF-8;LC_TELEPHONE=ko_KR.UTF-8;LC_MEASUREMENT=ko_KR.UTF-8;LC_IDENTIFICATION=ko_KR.UTF-8'.


Sun Dec  4 20:23:32 2022
Command line: TestDisk /debug

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.0-56-generic (#62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022) x86_64
Compiler: GCC 11.2
ext2fs lib: 1.46.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       500118192 sectors
/dev/sda: user_max   500118192 sectors
/dev/sda: native_max 500118192 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       1953525168 sectors
/dev/sdb: user_max   1953525168 sectors
/dev/sdb: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop13 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SanDisk SD8SBAT256G1122, S/N:161015400171, FW:Z2333000
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - HGST HTS541010A9E680, S/N:JD1002DM27ARZK, FW:JA0OA560
Disk /dev/loop0 - 122 MB / 116 MiB - 238984 sectors (RO), sector size=512
Disk /dev/loop1 - 64 MB / 61 MiB - 126896 sectors (RO), sector size=512
Disk /dev/loop10 - 52 MB / 49 MiB - 101624 sectors (RO), sector size=512
Disk /dev/loop11 - 290 KB / 284 KiB - 568 sectors (RO), sector size=512
Disk /dev/loop12 - 311 KB / 304 KiB - 608 sectors (RO), sector size=512
Disk /dev/loop2 - 4096 B - 8 sectors (RO), sector size=512
Disk /dev/loop3 - 420 MB / 400 MiB - 820832 sectors (RO), sector size=512
Disk /dev/loop4 - 248 MB / 236 MiB - 484392 sectors (RO), sector size=512
Disk /dev/loop5 - 66 MB / 63 MiB - 129520 sectors (RO), sector size=512
Disk /dev/loop6 - 363 MB / 346 MiB - 709280 sectors (RO), sector size=512
Disk /dev/loop7 - 96 MB / 91 MiB - 187776 sectors (RO), sector size=512
Disk /dev/loop8 - 48 MB / 45 MiB - 93928 sectors (RO), sector size=512
Disk /dev/loop9 - 48 MB / 45 MiB - 94064 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sda - 256 GB / 238 GiB - SanDisk SD8SBAT256G1122
Partition table type: EFI GPT

Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=500118191 (expected 500118191)
hdr_lba_start=34
hdr_lba_end=500118158
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 3 P MS Reserved              1288192    1320959      32768 [Microsoft reserved partition]
Current partition structure:
 1 P Windows Recovery Env        2048    1085439    1083392 [Basic data partition]
 2 P EFI System               1085440    1288191     202752 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Reserved              1288192    1320959      32768 [Microsoft reserved partition]
 3 P MS Reserved              1288192    1320959      32768 [Microsoft reserved partition]

search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/32/33
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048    1085439    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 67/144/14
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
set_FAT_info: name from BS used

FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
     EFI System               1085440    1288191     202752 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB
       0 0000 0000 00 00 00 00 00 00 00 00
     Unknown                175387403 2359246504 2183859102
     FATX, 1118 GB / 1041 GiB
       0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

Results
   P MS Data                     2048    1085439    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
   P EFI System               1085440    1288191     202752 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1083392 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 1085440" | dmsetup create test1

interface_write()
 1 P MS Data                     2048    1085439    1083392
 2 P EFI System               1085440    1288191     202752 [EFI System Partition] [NO NAME]

search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/32/33
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048    1085439    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
NTFS at 18/186/1
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                   294715     300888       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 18/186/1
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                   300888     307061       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 67/144/13
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048    1085439    1083392
     NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
NTFS at 67/144/13
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1085439    2168830    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 67/144/14
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
set_FAT_info: name from BS used

FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
     EFI System               1085440    1288191     202752 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB
FAT32 at 67/144/20
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
FAT differs, FAT sectors=752-761/761
set_FAT_info: name from BS used

FAT32 at 67/144/20
FAT: cluster=2(0x2), pos=1093632
     EFI System               1085440    1288191     202752 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB
FAT32 at 67/144/20
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
FAT differs, FAT sectors=752-761/761
set_FAT_info: name from BS used

FAT32 at 67/144/20
FAT: cluster=2(0x2), pos=1093638
FAT: cluster=771(0x303), pos=1095176
FAT: cluster=1540(0x604), pos=1096714
FAT: cluster=2309(0x905), pos=1098252
FAT: cluster=3078(0xc06), pos=1099790
FAT: cluster=3847(0xf07), pos=1101328
FAT: cluster=4616(0x1208), pos=1102866
FAT: cluster=5385(0x1509), pos=1104404
FAT: cluster=6154(0x180a), pos=1105942
FAT: cluster=6923(0x1b0b), pos=1107480
FAT: cluster=7692(0x1e0c), pos=1109018
FAT: cluster=8461(0x210d), pos=1110556
FAT: cluster=9230(0x240e), pos=1112094
     MS Data                  1085446    1288197     202752 [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB
       0 0000 0000 00 00 00 00 00 00 00 00
     Unknown                175387403 2359246504 2183859102
     FATX, 1118 GB / 1041 GiB
       0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

Results
     MS Data                     2048    1085439    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
     MS Data                   294715     300888       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
     MS Data                   300888     307061       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
     MS Data                  1085439    2168830    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
     EFI System               1085440    1288191     202752 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB
     MS Data                  1085446    1288197     202752 [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1083392 linear /dev/sda 2048" | dmsetup create test0
echo "0 6174 linear /dev/sda 294715" | dmsetup create test1
echo "0 6174 linear /dev/sda 300888" | dmsetup create test2
echo "0 1083392 linear /dev/sda 1085439" | dmsetup create test3
echo "0 202752 linear /dev/sda 1085440" | dmsetup create test4
echo "0 202752 linear /dev/sda 1085446" | dmsetup create test5

interface_write()
 
No partition found or selected for recovery
simulate write!
Partition table type (auto): EFI GPT
Disk /dev/sda - 256 GB / 238 GiB - SanDisk SD8SBAT256G1122
Partition table type: None

Interface Advanced
   P Unknown                  0   0  1 31130 233 63  500118192

Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Current partition structure:
   P Unknown                  0   0  1 31130 233 63  500118192

search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/32/33
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           1083392
sectors_per_cluster       8
mft_lcn                   45141
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0  32 33    67 144 13    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 67/144/14
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
set_FAT_info: name from BS used

FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
     FAT32                   67 144 14    80  47 31     202752 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB
     Sys=0C               10917  92  3 146856  77 14 2183859102
     FATX, 1118 GB / 1041 GiB
This partition ends after the disk limits. (start=175387403, size=2183859102, end=2359246504, disk end=500118192)
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (256 GB / 238 GiB) seems too small! (< 1207 GB / 1124 GiB)
The following partition can't be recovered:
     Sys=0C               10917  92  3 146856  77 14 2183859102
     FATX, 1118 GB / 1041 GiB

Results
   P NTFS                     0  32 33    67 144 13    1083392
     NTFS, blocksize=4096, 554 MB / 529 MiB
   P FAT32                   67 144 14    80  47 31     202752 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 103 MB / 99 MiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1083392 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 1085440" | dmsetup create test1

interface_write()
   P NTFS                     0  32 33    67 144 13    1083392
   P FAT32                   67 144 14    80  47 31     202752 [EFI System Partition] [NO NAME]
 
Write isn't available because the partition table type "None" has been selected.

TestDisk exited normally.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: BitLocker Partition Recovery

#2 Post by recuperation »

ds5105119 wrote: 04 Dec 2022, 17:01 I will be dumping the c drive soon using ddrescue. I want to recover the 4th BitLocker partition and boot windows again.
To boot windows again use windows recovery media.
To gain access to your Bitlocker partition connect your disk as a secondary one to another machine.

Locked