Does Bitlocker decrypt unallocated data?

Question

First thing first, I am NOT talking about full drive encryption. Bitlocker has a feature to encrypt used space only. I am talking about this.

Does Bitlocker remove encryption of unallocated data resulting from deletion of files?

My Guess: No. Because it can pose data security risk. Please confirm.
If my guess is right, does Bitlocker also decrypt unallocated data after I unlock the drive? I want to know whether I can recover my deleted data from unlocked drive or not. I am not sure about positive thing because performance is main motto of this option (encrypt only used space).

Answer 1

This question from this TechNet article helps to clear up this question:

Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data?

No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive.

What this means in relation to your question is this:

• If you already have or have had sensitive data on the drive, it is recommended to perform a full-drive encryption as this will ensure any previously deleted data is also encrypted.
• If the disk is "clean" from sensitive information, you can use the used space only option. All future data written to the disk is encrypted, and so if after using this option you later delete sensitive information, it is still encrypted on the drive.

As for recovering data from an unlocked drive, applications that do this should see the data as they would for any normal drive as their calls are intercepted by BitLocker, which handles the encryption/decryption on a block-by-block basis.

Answer 2

I want to know whether I can recover my deleted data from unlocked drive or not.

I have done this in the last 48 hours because I had a power out and lost access to an encrypted partition. It wouldn't accept the password.

I used WinHex to clone the encrypted partition to another drive so "I" could attack it and then set Passware Kit Forensic loose on it. Took 6 hours but came back with a garbage password that I was sure wouldn't work but it did. So I was able to decrypt the partition.

I couldn't find what I was look for in the live files, so I then used NTFSUndelete to search through the deleted files area of the cracked and previously encrypted partition.

While I still wasn't able to find I was looking for ( I suspect now that it was never even on this drive), I was able to pull old and previously deleted files from the partition. The encryption process did not garble these into meaningless strings / binary data, if that's what you're worried about / hoping for.

You can pull deleted files from volumes previously encrypted with BitLocker. (Win 7 Ult) Whether or not this applies in each and every case I obviously cant say but it is not completely impossible.