6

I have a pendrive which I encrypted in the Windows OS using the bitlocker. Everything was perfect. I had 2 USB drives which are similar. Recently I accidently formatted the pendrive. Later I realized, the one I formatted was the one with encrypted files. I tried to recover the data using Recuva file recovery software. But after scanning, the result is blank. The software shows above 3000 files found, but empty results.

Is there any way I can recover data from the USB disk ? Or since it is an encrypted one, Should I forget the data ?

N.B : I have the encryption key with me.

3 Answers 3

16

By formatting the disk you have destroyed the encryption headers, and the recovery key you possess cannot help.

Sorry to say, but your data cannot be recovered.

11
  • "...cannot be recovered within the time you are willing to wait." Would you really want to wait several years or even decades? The lesson to learn most likely is: Even backup your encrypted data! Or at least back up the encryption key.
    – U. Windl
    Commented Nov 15, 2021 at 22:28
  • 2
    @harrymc - Can you explain that? Does BitLocker really store the FVEK/VMK/TWEAK only once in the bitlocker volume metadata AND the metadata is stored where the partition table / partition information is stored? If not then a normal quick format shouldn't overwrite the keys nor the encrypted data.
    – Limer
    Commented Nov 15, 2021 at 23:19
  • @U.Windl I have the encryption key. I have backed that up to some safe place. So what can I do with the key ?
    – melvin
    Commented Nov 16, 2021 at 2:46
  • 7
    @U.Windl If it is encrypted properly, it'll take you a LOT more than several decades. It is closer to the heat death of the sun.
    – Nelson
    Commented Nov 16, 2021 at 3:09
  • 7
    And just in case people think I'm exaggerating, I'm not. See this answer for both the financial limitation and thermodynamic limitation of brute-forcing a 256-bit key (TLDR: can't be done).
    – Nelson
    Commented Nov 16, 2021 at 4:17
13

1.First things first: Make an image of your USB flash drive!

With e.g. one off these tools:

... or any other tool recommended by Raymond (HDDRawCopy is good)

You can then play around with copies of that image with any tool you want and no further risk to the data. You can even mount those images to virtual drives (with e.g. OFSmount or possibly within Windows without 3rd party tools).

2.To answer your question

As long as you didn't write any data to the accidentally formatted drive I'm sure there is a way to recover the data or at least most of it.

3.Now to answer your non-asked question - how to recover the data

I've never worked with BitLocker before so I'm not much direct help but I highly doubt that a single quick format (that's usually what formatting is and you didn't supply enough information) of anything removes all of bitlockers key backups.

And there seem to be plenty of tools available for you to try.

3
  • 1
    I have done a quick format of USB and haven't used the USB drive after that. I have the backup key with me. So the recovery software 'Recuva' was not able to identify the files, all I got was a blank screen. But the software said that above 3000 files were found on scan but the result was empty, which I think no recoverable files present. So let me check with other tools that you have mentioned.
    – melvin
    Commented Nov 16, 2021 at 2:42
  • 4
    As stated by others: Recuva and other normal deleted files recovery utilities only work on unencrypted volumes (completely unencrypted or with the decryption still working on in the background). They aren't any help with encrypted volumes you're unable to open through normal channels (Windows itself or software like Veracrypt). I'd try the software by minitool.com or easeus.com first. I've used free tools from them in the past and they left a good impression. Oh, and depending how much the data is worth to you (and how private your key is): There are professional data recovery specialists.
    – Limer
    Commented Nov 16, 2021 at 12:54
  • Good to know. I let the fate win.
    – melvin
    Commented Nov 17, 2021 at 13:58
6

If the stick is encrypted then there is no data that any low level recovery software will recognise. It will all just look like random noise.

The only way to recover the data is if you know the recovery data. You might have opted to store this in your Microsoft Account. Finding your Bilocker recovery key in Windows

1
  • 1
    I have my recovery key with me. I mean when I encrypted the USB using bitlocker, I have saved the key to decrypt it. But since the data is formatted, I don't know if there is anything I could do with the decryption key
    – melvin
    Commented Nov 15, 2021 at 10:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .