recovering files from a bitlocker encrypted drive
Posted: 16 Dec 2014, 18:46
Hi,
I have a bitlocker encrypted drive that is showing RAW partition. Using testdisk I can see two partitions
Disk \\.\PhysicalDrive1 - 320 GB / 298 GiB - CHS 4864 255 63
Current partition structure:
Partition Start End Size in sectors
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 32 33 38 94 56 614400
1 * HPFS - NTFS 0 32 33 38 94 56 614400
Invalid NTFS or EXFAT boot
2 P HPFS - NTFS 38 94 57 38913 37 36 624523264
2 P HPFS - NTFS 38 94 57 38913 37 36 624523264
Both show a invalid NTFS boot.. I'm rebuilding the boot sector currently, once this completes, will I be able to browse and copy the files off of the EFS?
I also get this if I do "Quick Search"
Disk \\.\PhysicalDrive1 - 320 GB / 298 GiB - CHS 4864 255 63
Analyse cylinder 14/4863: 00%
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
HPFS - NTFS 0 4 5 4 203 7 76800
If you could shed some light on what I am seeing, that would be great.
I have a bitlocker encrypted drive that is showing RAW partition. Using testdisk I can see two partitions
Disk \\.\PhysicalDrive1 - 320 GB / 298 GiB - CHS 4864 255 63
Current partition structure:
Partition Start End Size in sectors
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 32 33 38 94 56 614400
1 * HPFS - NTFS 0 32 33 38 94 56 614400
Invalid NTFS or EXFAT boot
2 P HPFS - NTFS 38 94 57 38913 37 36 624523264
2 P HPFS - NTFS 38 94 57 38913 37 36 624523264
Both show a invalid NTFS boot.. I'm rebuilding the boot sector currently, once this completes, will I be able to browse and copy the files off of the EFS?
I also get this if I do "Quick Search"
Disk \\.\PhysicalDrive1 - 320 GB / 298 GiB - CHS 4864 255 63
Analyse cylinder 14/4863: 00%
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
HPFS - NTFS 0 4 5 4 203 7 76800
If you could shed some light on what I am seeing, that would be great.