Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a 1.5TB hard drive that I bought it at 2010 and I placed there all my files like: university exercises, Microsoft's student projects, images and videos, also CVs, apps and many of my jobs. These files are important. I don't really care about the music or the movies that take up most of the space. I have split my drive into 2 partitions 1TB and 500MB and I encrypted the 1TB partition with my important files like above with BitLocker in Windows 7 Ultimate.

My hard drive had been affected by "tic-tak" at the end of 2012, and the computer didn't recognize it. After a few days the tic-tac was stopped and I was able to view my two partitions. I saved the files from the 500MB partition, but I was not able to explore the important files on the 1TB partition. Even after I typed my Bitlocker password, it didn't open.

It was the last time that I was able to view my first 1TB partition, so I decided to send it back to e-shop. I have 5 years of warranty and after two weeks they said that they couldn't do anything (recovery system has not any progress) so I got it back without replacing it, because I wanted the damaged disk with my files.

I made the mistake of deleting the partitions. I quick formatted my hard drive, and then I was not able to find my partitions. Also I made one new partition of the entire disk and then I deleted it! So the disk is working now!

I tried with Active Recovery, Partition Table, Magic Partition, Partition Guru and many other like the famous TestDisk to recover my files, but nothing worked!

Keep in mind that all programs were getting many time and some of them were getting an error at 54% of the disk. Also I know my password and I don't have the recovery key!

share|improve this question

migrated from Apr 18 '13 at 16:57

This question came from our site for professional and enthusiast programmers.

Do you keep any backups of your "hole life"? – jtheman Apr 18 '13 at 16:26
Saing my "hole life", my friend (jtheman), i want to tell you that i am editing this disk for 12 years, i am not saying that is my life! Help it is usefull! And no i have not a back up obiusly. Thanks (McCee) i will give it a try. – s19k15 Apr 18 '13 at 16:31
You've been working off of a single disk for 12 years and haven't made a backup? I'd say you're a few years overdue for a catastrophe. – Cody Gray Apr 18 '13 at 16:41
You cannot recover encryted files after they are deleted. The entire parition every single bit was encrypted which means all a recovery program will find is random noise. If the smaller partition contained all the important stuff I don't understand the problem. Even if you didn't wipe the partition the fact you don't have the recovery key is a huge problem. – Ramhound Apr 18 '13 at 17:23
@s19k15 - Even if you recovery the partition table. You can't recovery data off the encrypted partition since you have no way to decrypt the data. – Ramhound Apr 18 '13 at 17:41

It's doubtful that cloning the drive will do you any good at this point, since you formatted the drive.

Luckily though, when you format the drive it doesn't completely destroy your data but instead only the indexes to it, so the files are still there intact. They just can't be read by the Operating System.

Assuming that the drive is still readable at all I would say your best bet at this point is to use a tool like Unstoppable Copier or Recuva. Recuva and UC work by looking at the parts of the drive that the files are stored in to recover them and don't rely on the file index creating by the OS.

share|improve this answer
I am thinking (jmreicha) the same way you thinking so the first step is to cloning the disk and the second to find the lost partitions! The BIG question is can i find the lost encrypted partition? Can i find it? Because is encrypted! – s19k15 Apr 18 '13 at 17:22
The files on the large 1TB partition are encrypted. This means that Recuva will be unable to recover those files. All UC will see is random noise because the author is unable to decrypt the the non-existed filesystem. – Ramhound Apr 18 '13 at 17:24
This is true (Ramhound), so how can only find the partition table i had lost? – s19k15 Apr 18 '13 at 17:26
@s19k15 - The partition information should be at the very start of the disk. Of course its entirely possible that this data has been lost since you already overwrote the data. – Ramhound Apr 18 '13 at 18:38
@Ramhound I missed the unable to decrypt part, d'oh. – jmreicha Apr 18 '13 at 19:51

Here are my thoughts having gone through headaches of rebuilding & recovering my own drives/arrays which have been encrypted/non-encrypted. (I did have the recovery key for my stuff though)

You will have one very big headache trying to rebuild this drive. Even with the key you will need a lot of knowledge to recover the base tables (Partition,NTFS/FAT/Bitlocker etc).

However, the "headache" being said; you may have some hope with digging through the internet reading other groups and articles on how to recover bitlocker partition tables. Regardless if you formatted the drive or deleted the partitions.

If you work off an image of the drive you will have better luck than working off the actual drive (ie., you don't have to worry about drive failure or making a mistake). This is assuming you can get an image or partial image or base sectors off the drive. In any event, working off the image, as long as you have essential parts of the Drive in the RAW image, you may be able to reconstruct the necessary information to bootstrab the image in a VM.

Working in say a Virtual Machine you may get the system to boot strap the image and present you with the password prompt. Once you get the system to present you with a Prompt, you will then have to get the system to a decrypted state to be able to recover any data off the drive.
With the system in a decrypted state (even if the system does not boot), you will then have to use a tool (windows/linux) to pull the bits from the decrypted drive to a new image where you can then run a NTFS/FAT recovery tool.

So a lot of steps and lots of knowledge is needed. Lots of patience as well and maybe some $$$. But people have done it.

Good luck. ;)

share|improve this answer
Thanks (user218094) i will try to work in clone image! This may give me more changes! – s19k15 Apr 18 '13 at 20:48

After a year of researches over the internet and many specialist, i did serveral tries to recover my files, such as:

1)Took image of drive but then i mounted and i was unable to open the partition
2)Formated the entire drive with quick format as it not erases the data
3)Tried all famous recovery programs, to find the deleted partitions
4)Tried find a method decrypt the disk with password and not kwey but nothing

I think the only solution is to make a data plan for recovering my data without the recovery key:

1)Locate deleted-ecrypted partition
2)Write partition to partition table
3)Open partition with password

The question is how to locate a deleted-encrypted partion that may have been overriten for a little?, i know sound really heavy problem but i feel nothing is impossible on hhds!

share|improve this answer
For a non-encrypted drive it is sometimes possible to reconstruct a partition table by looking for and recognizing the "signatures" of partitions, like the VBRs if it's an MBR disk. But on a BitLocker'd partition even the VBR will be encrypted. To decrypt BL you need the volume master key (VMK) and full volume encryption key (FVEK) which BL stores (encrypted) in its metadata sectors on the drive. The various keys that permit you to access a BL'd drive actually decrypt the VMK, which in turn decrypts the FVEK. So if you've overwritten BL's metadata sectors your data is well and truly gone. – Jamie Hanrahan Sep 25 '15 at 10:07

protected by slhck Jul 21 '14 at 12:44

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.