Sunday, August 25, 2013

Recovering data from a bitlockered crashed hard disk


My hard disk of my main machine crashed on 8/9. Had most of the data on this drive. I had to now recover a bitlocker encrypted crashed 1TB hard disk.
After a LOT of experimenting and frustrated hours, I could recover most of the data back (I got all the data I cared about).

Here are the steps I took to recover the data:

  1. Remove the crashed hard disk from the machine
  2. DO not run test disk or check disk or try to unlock the drive through the UI. Any of these actions will damage the hard disk further & reduce the chances of recovering data
  3. Put the hard disk in a ziplock & stick in the freezer for a couple of hrs (sounds ridiculous but works)
  4. Get a SATA to USB cable so that you can let the hard disk breathe or you can cool it with an external fan. I bought this one, it was DOA (Dead on arrival) did not help.
  5. I got a new 3TB hard disk, had to install Intel Rapid storage technology software for windows to detect any HD > 1TB
  6. Use SystemRescue CD, a live CD linux distribution which has the awesome tool ddrescue
  7. Copy the whole hard disk image into another working hard disk (mine was a 3TB hard disk). This process takes ~6 hrs because it tries to copy the whole image. At the end of this I had a ~1TB .img file (ddrescue /corrupted drive /good drive log.txt -r 3).The no. of retries is 3.
  8. Boot back into windows & use repair-bde to recover the bitlockered data
  9. This takes a couple of hrs & creates another .img file which should have your data. J


These blogs helped me out: