How to recover data from a deleted, BitLocker enabled partition?

Posted by on Jul 25, 2013 in BitLocker, Featured | 22 comments

Since I ran across this problem some time ago and I couldn’t find some good information about the topic I decided to write this how to.

We’ll start with a 20GB partition on one of my drives. I moved some data there, about 450MB, just so we have actually data on it. You can see information from Disk Management MMC and the folder structure in the next 2 screenshots:

Disk Management - initial configuration

Folder structure on test volume

The next screenshot shows the BitLocker status for that partition. Please take note of the 48 digit recovery key separated by dashes into 6 groups – you’ll need that one later. In enterprise environments this key should be stored in Active Directory. At home BitLocker should have asked you to save that key in a safe place while you activated BitLocker.

Bitlocker configuration of test volume

After that I “somehow accidentally” deleted the partition…

Disk Management - Volume deleted

This is normally where you would start to panic, start to search for recovery tools and may be pay money to buy some stuff you don’t really need. What I really mean is, this is the point you would recognize that something went wrong and that your data lies encrypted on a partition you cannot access. Windows offers almost everything you’ll need to recover from this scenario. There are just 2 things you’ll need: 7-zip and your BitLocker recovery key. If you don’t have 7-zip you can download it now. If you don’t have your recovery key you are screwed!
At this point please do nothing with the harddrive. Do not format it, delete it or whatever comes to your mind. You can try these things later if the following steps won’t work for you…

First recreate the partition from Disk Management (type compmgmt.msc in start menu and run as administrator) by clicking with the right mouse button on the “lost” partition and selecting “New Simple Volume…”:
Disk Management - recreate volume

It is important that you specify the exact size information, the partition used to have. It is even more imporant that you do not format the partition in the next step! Please note the drive letter you’ll assign to the new partition.

New Simple Volume Wizards - do not format

After that Windows shows a RAW filesystem on that partition. This is because it is still BitLocker enabled and locked.

Disk Management - Volume with raw file system

In the next step open an elevated command prompt and type:

repair-bde F: E:\recover.img -rp 517253-653510-042988-665027-063393-559515-700700-268224

Please substitue F: with the driveletter you chose when creating the new partition, E:\recover.img with a filename on a drive offering free diskspace of the size of the “lost” volume and substitue the recovery key in this example with yours.

If the BitLocker Drive Encryption: Repair Tool shows an error and advises you to use the -force option do so by typing:

repair-bde F: E:\recover.img -rp 517253-653510-042988-665027-063393-559515-700700-268224 -force

repair-bde - recover data to img file

Depending on the size of the partition this can take from some minutes to several hours to complete. Be patient…

In this step the BitLocker Drive Encryption: Repair Tool created the file E:\recover.img (hopefully) containing all the lost data. A feature of new versions of Windows is to mount image files. But unfortunately not this type of img file. When you try to mount it in Windows Explorer you’ll get an error and nothing else happens:

Windows Explorer - mount img file

Windows Explorer - mount img file failed

This is the time to install 7-zip. This small tool can open img files created by the BitLocker Drive Encryption: Repair Tool:

7-zip - opened img file

You can now extract all your data to a location of your choice: Select everything you need in 7-zip and hit the “Extract” button. Again, this can take several hours… After that check your data, check the folders and the files. If all your data has successfully been recovered you can finally format the lost partition, copy your data and enable BitLocker again.

Folder structure on recreated volume

22 Comments

  1. Thank you

    You save my data

    Sorry for my bad english

  2. Hi,

    I accidentally enabled BitLocker.
    I had no intention to use BitLocker at all.
    When I saw “Choose How you want to unlock this drive” popup screen I quickly clicked “CANCEL” as I did not want to go any further.
    However the problem occurred straight away.
    I clicked “My Computer” to view the Hard drive and it has disappeared.
    From Disk Management it is shown as unallocated.
    Has this partition been encrypted?
    I do not have a key to recover BitLocker partition.
    What Can I Do?

  3. Hi,
    I’ve done all the steps above. but 7-zip can not open img file.
    What Can I Do?

  4. didn’t work..
    File corrupted ,and couldn’t open it in anyway 🙁 !!!

  5. NORMAN, MAY YOU LIVE TO BE 1000 YEARS OLD.

    It didn’t work for me the first time, I had Nervento’s problem. If the drive is >2TB and was one volume, it will be GPT formatted. Windows will put a small partition in front of the main one in this case. That was my problem, partition alignment wasn’t the same. What I did was got an identical drive, partitioned it, then used partitionguru to back up the partitions (including the 128MB hidden MS reserved partition) and restore the partitions to the accidentally deleted drive, then ran repair-bde. Opened up the archive and THERE WAS MY DATA.

  6. I have successfully created the .img file but 7-zip cannot open it. What other file can open it?

  7. I gave up and spent USD 127 to acquire M# BitLocker Recovery and it works great since I am not a techie.

  8. Hello, Mr. Norman,

    Could you please help me to solve the problem i faced recently. It has some similarities(i think) to the problem you provided a solution here. Let me explain you what happened in detail.

    Initially I had 2TB Seagate Expansion Desk HDD, partitioned into 500GB, 13GB, 500GB, all three Bitlocker encrypted and 1 more 500GB unencrypted partition, the rest of the space was unallocated. Yesterday, by mistake, while I was creating Windows Recovery Disk chose the wrong drive letter and ended up whole partitions above deleted. Here’s what I have in HDD now: 32GB Windows 8 Recovery partition and 1831GB unallocated space. After that I haven’t made any changes to the drive. I was able to restore the data from the last unencrypted part by using Getdataback SW but with no luck in my Bitlocker encrypted partitions. I would appreciate any advice to restore the bitlockerencrypted partitions as I have the password to decrypt and retrieve my data back.

    Softwares at hand: Recuva. Handy Recovery. R-Studio. Getdataback. M3 Bitlocker Recovery. Starus Partition Recovery. TestDisk

    I can provide the snapshots of the results from recovery softwares should you need them. Thank you very much!

  9. Hi..I followed your instructions step by step as per your directions. Getting following error! Please let me know! Thanks

    LOG WARNING: 0X8000002c
    Failed to Lock volume. (0x80070005)
    LOG INFO: 0x00000050
    The file exists.
    LOG ERROR: 0xc0000032
    Failed to create ‘c:/recover.img’ as an output image.

    ERROR: Could not create ‘c:/recover.img’ as an output image.

  10. Thank you!!! Just saved my data.

  11. hi ..
    i have the password but havent the file of key bitlocker

    i have similair ..
    Identification complÚte de la clé de récupération : 36430C8C-637C-4B4F-B13C-577D59CA04E9
    Clé de récupération BitLocker :
    639804-652828-652883-370579-009999-458029-108042-514778

    for another partition in sem drive & sem password

    they tell me wrong key haw do get the real key of lost partition?

  12. Hi Norman,

    Thank you so much for these information sharing.
    I have follow your instrcution step by step and bring back my data successfully.
    The only step I stuck is “7zip cannot open the “img” file
    Fortunately, I have a Mac and I try to use my mac to mount the .img file and it just work perfectly.
    Just for your all reference.
    However, your method is working.

    Thanks again!!!!

  13. Hello Sir !
    Followed all your described steps. But got stuck on step to open .img file. It says “Disk image File is corrupted”. It is not opening anyway even by 7-zip. Kindly, guide in this aspect.
    Thanks in advance.

  14. I’m posting my experience in case this could be of use to anyone else; as although this article is great, it might be a little bit dated.
    Since Windows 1511 I believe, it is possible to use a new bitlocker encryption standard, called XTS-AES. Unfortunately, the idiots at Microsoft who implemented that standard did not update repair-bde at the same time…
    Also, from my experience, repair-bde does not work if the partition is lost.
    In my situation, I had a SSD encrypted with Bitlocker and the new XTS-AES standard. The disk’s MBR got corrupted and and would not show up. I could see it in the disk management interface, but it would be marked as “not initialized”.
    I tried repair-bde, I tried a ton of different softwares: nothing worked.
    Until I found M3 Bitlocker Recovery. At first, their software did not recover anything and would pretend my Bitlocker recovery key wasn’t correct. But I contacted their technical support and they were able to recover all of my data, by using different settings and helping me through Teamviewer.
    If repair-bde fails, I much recommend you give them a try.
    Lastly, I’m in no way affiliated to them; just a happy and much relieved customer.
    Best of luck,
    Guillaume

  15. Stay away from Bitlocker at all costs. Every volume/folder I have created at home and at work both have all disappeared completely after a few days. The drives just simply disappear completely with no error message or warning message at all. You’ll just boot up one day and the drive will be missing permanently without a trace.

  16. hello Friend
    i have follow your steps (and have password and identifier and recovery key) but
    When i type repair-bde F: E:\recover.img -rp 517253-653510-042988-665027-063393-559515-700700-268224 (of course with my recovery key) i get many log error of “failed to authenticate using suppling recovery information (0X8007054e)

    I am sure that it is the right recovery key why it tell me that ?
    BTW the size of the new partition is bigger the the original is it ok ?
    thanks

  17. oh god, you just saved. me
    This method really works if you have key.

    after decryption some of files are corrupt but most them are ok.

  18. Guillaume,

    Did you try the steps in the article first? I have not, but I am scanning with M3. It has not asked me for a password yet.

  19. Works !!!!

    if you do not have the Bitlocker Recovery Key but you know the password, use -pw option !
    You need to remove the Volume and create a new ‘no formated’ as described in the post.

  20. I have the same problem as Chris. Clicked cancel while decyrpting my drive and now its unallocated. Tried a few things no idea how to get my data back

  21. But do you have any recovery key or password?

  22. You’re a goddamn super hero.

    EASUS directed me here, MSFTs support site was no use.

    I owe you a beer.

Leave a Reply

Your email address will not be published. Required fields are marked *

Captcha: * Time limit is exhausted. Please reload CAPTCHA.