1

Read This for the full story: BitLocker Recovery Key Isn't working ( Corrupted Maybe ? )

the drive isn't encrypted yet

I mentioned that in my older post, and it appears to be correct the drive isn't encrypted.

How did I know?

Well I tried so many solutions, the last one being to recover my drive using R-Studio. And it appears that Bitlocker is set on the first 8 sectors of the drive.

image1

And the basic data partition isn't encrypted or deleted at all. It just appears to be reformatted.

image2

In the reformatted partition there's a ROOT file and inside it all the system data undeleted as you can see:

image3

  • Has Been Recovered : Has A RED X on it

  • The File isn't deleted : Normal file icon

So my question is

How can I EDIT/DELETE drive sectors (the first BitLocker layer)? Or is it possible to do it?

I just want to delete BitLocker first layer and gain access to the raw data.

Improve this question
2
  • STOP. Bitlocker is actually inside the partition only. If you try to overwrite anything there you could lose your ability to recover the data. You already have access. Use it to back up.
    – Daniel B
    Jun 28, 2021 at 20:37
  • Editing and overwriting regions of a drive can be done e.g. using an hex editor like HxD. It can edit whole drives and volumes if started with admin permissions.
    – Robert
    Jun 29, 2021 at 9:49

1 Answer 1

Reset to default
0

Caution: This is dangerous and can easily wipe your data.

The easiest way to do this is if you can boot your system from a Linux Live USB stick.

Within a Linux distribution the dd command can write blocks directly to the disk. In theory you would open a terminal and then use the dd command to write zeros to the first 8 blocks of a disk like so

sudo dd if=/dev/zero bs=512 count=8 of=/dev/sda

where sda corresponds to the first physical drive in the system. sdb would be the second and so on. You can find out what drives you have by using a program such as gparted which should also be easily available on any Live USB distribution.

Apparently there is a dd for Windows bundled in with Git but you would have to find out what syntax it uses to find and interact with the disk. It may not use sda or sdb.

More examples of dd use can be found at https://linuxconfig.org/how-dd-command-works-in-linux-with-examples

I make no guarantees as to whether this will wipe Bitlocker, your partitions or your entire drive. This answers only the question of how to erase 8 blocks of hard disk drive.

Improve this answer
1
  • To do it "portably" (among drives, not OSes), bs= should be set to $(cat /sys/block/sda/queue/logical_block_size).
    – Tom Yan
    Jun 29, 2021 at 6:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .