How to recover data from a volume encrypted with BitLocker
The BitLocker security feature of Microsoft Windows as well as BitLocker To Go, which is employed on portable devices, such as USB flash drives, are known to provide solid protection of sensitive information against theft or unauthorized access by encrypting the content of entire partitions. Yet, this option in no way makes such volumes resistant to unexpected issues within the system or negligent actions of valid users which result in data loss. Fortunately, if the area on the disk which holds BitLocker metadata wasn’t severely damaged or overwritten, files lost from BitLocker-encrypted partitions can be recovered, provided that the correct decryption password or recovery key is known. The following instructions will help you to safely decrypt the storage and get the missing data back using UFS Explorer Professional Recovery.
1. Connect the problem device to the computer
Plug the encrypted removable medium into the USB port or skip this step, if you are working with an encrypted partition of an internal drive. If a TPM device was used for encryption, it must be present in the computer during the recovery procedure: in case of a built-in TPM chip, decryption and data recovery are only possible on the same machine on which encryption has been performed.
2. Run the program
The software will detect all the attached drives automatically, displaying them in the tree of connected storages in the left pane. Each device will have its logical volumes listed below.
3. Select the needed encrypted volume
Navigate through the list to find the necessary encrypted volume: it can be identified by a yellow padlock icon.
4. Decrypt the storage
Even if its file system is recognized as accessible, the volume needs to be decrypted for further operations. Open its context menu, choose the "Decrypt encrypted storage" option and then the "BitLocker metadata" decryption method. Enter the right password or provide a 48-digit BitLocker recovery key, including all the dashes.
5. Scan the storage
After the volume is decrypted, the intact data it contains gets available for access. To find the deleted or lost files, you will need to run the storage scan. For this choose the respective tool from the toolbar, deselect all extra file systems or leave the scan parameters as they are and press "Start scan".
6. Pick out and save the needed files and folders
When the process is completed, you can browse through the reconstructed file system to find the necessary items. To choose the ones to be copied click "Define selection", put check marks right next to them and press "Save selection". After that, define a safe destination folder for the recovered data in the pop-up window.
The overall process is illustrated in the following video-guide:
Last update: September 4, 2019