Step-by-Step BitLocker encrypted data recovery

Thank you for choosing SoftAmbulance. Please follow this guide to recover data stored on BitLocker encrypted disk. Should you have something that you haven't expected, or not described in this guide, please make a screen shot and let us know through support form.

In theory there are 3 copies of BitLocker keys can be found on the disk. They are encrypted, so you will need a Windows user login and password information to decipher them. EFS Recovery is a data recovery software and we don't crack private property. If these keys can not be found, EFS Recovery will not ask for BitLocker key. This also means that we are unable to recover your data.

Run EFS Recovery and you will see a disk list:

BitLocker Recovery: disk list

If the disk is really encrypted HEX-preview doesn't look like something sensible:

Bitlocker disk HEX preview

Please note that file system shown as BitLocker. You can see it if you switch to Details view mode. Double click on the disk to open it, and EFS Import Wizard will start, proceed to the following screens:

EFS and Bitlocker Import wizard EFS and Bitlocker Import wizard, scan options

Enter the BitLocker volume password when asked. Usually it is same as Windows user\password credentials.

Input password to decrypt EFS or Bitlocker volume

Please ignore this page, as information here displayed only for EFS disks, not BitLocker, simply click Next to proceed.

Recovered Encrypted\Decrypted files Recovered Encrypted\Decrypted files, certificates

Now here is a result:

Recovered and decrypted files preview

We have files and they can be previewed properly. Now we can save required data to other place.

If you exit at this point to the disk list, you will see this disk's file system is displayed as FAT16, i.e. disk has been decrypted and EFS Recovery sees correct file system.

decrypted BitLocker disk now shown as non simple FAT16 partition

Here is how HEX preview of the recovered disk looks like:

decrypted Bitlocker disk preview: you can see FAT16 identifier

Please note that now you can see a FAT16 identifier(MSDOS5.0) at the start of the disk.