Problems with BitLocker- urgent help needed!

[lsk3993]

Having upgraded from XP to Windows 7 I was quite eager to try out the new features such as BitLocker, so today I (admittedly quite foolishly) tried to turn Bitlocker on a usb without having backed it up...

After going through the password set screen it started encrypting then after getting to about 84% the window automatically closed.
I figured it was done so I safely removed it, no problems there...

I plugged it in again and it came up with a password entry screen, I entered the password I set and the window just closed.

The problem is now when I try to open the drive it takes ages to open (the green bar at the top moves really slowly) and when it does it says "This folder is empty".

I go to the Bitlocker options and try to turn off the encryption and it says "The system cannot find the file specified".

Help please!
I really don't want to format the drive so that would only be a last resort...

Thanks in advance

(I can use the problem steps recorder and attach the file here if it will help)


Oh and by the way, Happy New Year everyone :)

[snakedoc]

If you reboot with the drive attached, when you go into Computer, does it show your drive with a gold padlock?

[lsk3993]

If you reboot with the drive attached, when you go into Computer, does it show your drive with a gold padlock?
If I try to reboot with the drive in the computer actually doesn't boot :S

[lsk3993]

Also I can't actually attach the PSR file here because it is too large

[snakedoc]

So if you plug it in after a reboot, doe it have it? My guess is the data is lost and you may be able to find some programs which can rescue it. If it's been partly encrypted, it could all be lost.

[lsk3993]

So if you plug it in after a reboot, doe it have it? My guess is the data is lost and you may be able to find some programs which can rescue it. If it's been partly encrypted, it could all be lost.
When I plug it in and enter the password it shows a normal drive (although I set a custom image with an .ico)... then when I try to open that (after the slow opening and empty folder bit) it comes up with autoplay and the image become a locked drive with a silver key

[snakedoc]

I would look for some recovery tools on google. You might find something free in the end. It's possible you could save the data but unlikely.

[lsk3993]

I would look for some recovery tools on google. You might find something free in the end. It's possible you could save the data but unlikely.
So it's half encrypted then? Is there a way I could complete the encryption or something so it can decrypt properly? Is there anything else i can check to help work out what the problem is exactly?

[snakedoc]

I have only used it once and it worked flawlessly. You get one free help from MS when you buy retail, so it might be a plan to ask them for advice. Please let us know what they say.

[lsk3993]

When I plugged the drive in XP it seemed to agree that it was half encrypted since it said that Bitlocker to go only works on fully encrypted drives. It said I can go into Windows 7 and complete the encryption.

[snakedoc]

How does it display under Bit Locker Drive Encryption? Turn on or Off, that seems to be all the options I get.

[lsk3993]

When I opened the drive in Ubuntu I get some files...Here's a screenshot of some of the files in it, there's more of those .NG files in there

[lsk3993]

How does it display under Bit Locker Drive Encryption? Turn on or Off, that seems to be all the options I get.
I plugged it in again, unlocked it and it's trying to encrypt it again... its stuck on 86.4% though
(EDIT: It didn't move from 86.4% and the encryption window just closed, still the same problem)

The only options I have are turn off or manage

[lsk3993]

Still no luck... I really hope I don't have to format it :(

[mrgoose]

If the machine that did the encrypting has not been switched off then you might get in using COFEE [sic]. This is a Microsoft tool cracks Bitlocker and most other Microsoft security by interrogating the memory of a machine that is still switched on. Apparently, Microsoft gave COFEE to 2000 so-called "law enforcement agencies" around the planet so they could extract forensic evidence from live Microsoft computers at scenes of alleged crimes. But surprise, surprise, some dopey plod somewhere screwed up and now COFEE has leaked into the wild. Microsoft has served cease & desist orders on several websites who had it for free download. But it is still freely available as a bittorrent. I would probably be breaking site rules if I gave you a direct link. But Google: bittorent cofee

http://government.zdnet.com/?p=3781

Failing that, if your data is really valuable to you and you don't want to walk on the wild side, then you could try the latest Passware. These guys have been successfully cracking Microsoft passwords for years, legally. But this sort of power don't come cheap! And again, just like COFEE, it relies on encryption keys being available in RAM.

http://www.netcafethai.com/2009/12/first-commercial-tool-to-crack-bitlocker-arrives-updated/
http://www.lostpassword.com/news/pnl50.htm

If you have restarted your machine since the encryption keys were in RAM, then I can see no way of recovering them. In which case, I'm sorry but IMHO, you are snookered.

Best wishes, G.

[lsk3993]

If the machine that did the encrypting has not been switched off then you might get in using COFEE [sic]. This is a Microsoft tool cracks Bitlocker and most other Microsoft security by interrogating the memory of a machine that is still switched on. Apparently, Microsoft gave COFEE to 2000 so-called "law enforcement agencies" around the planet so they could extract forensic evidence from live Microsoft computers at scenes of alleged crimes. But surprise, surprise, some dopey plod somewhere screwed up and now COFEE has leaked into the wild. Microsoft has served cease & desist orders on several websites who had it for free download. But it is still freely available as a bittorrent. I would probably be breaking site rules if I gave you a direct link. But Google: bittorent cofee

http://government.zdnet.com/?p=3781

Failing that, if your data is really valuable to you and you don't want to walk on the wild side, then you could try the latest Passware. These guys have been successfully cracking Microsoft passwords for years, legally. But this sort of power don't come cheap! And again, just like COFEE, it relies on encryption keys being available in RAM.

http://www.netcafethai.com/2009/12/first-commercial-tool-to-crack-bitlocker-arrives-updated/
http://www.lostpassword.com/news/pnl50.htm

If you have restarted your machine since the encryption keys were in RAM, then I can see no way of recovering them. In which case, I'm sorry but IMHO, you are snookered.

Best wishes, G.
I'm ok with "walking on the wild side", but I have turned my computer off since :sad:...
The thing is it doesn't seem to have properly encrypted and just keeps closing the progress window before completion. I have the bitlocker recovery key text file but I can't use it because it seems stuck half encrypted.
Does it help that I can see some files when booting in Ubuntu? (not the files that were originally there, but ones created by Bitlocker)

[mrgoose]

I'm ok with "walking on the wild side", but I have turned my computer off since :sad:...
The thing is it doesn't seem to have properly encrypted and just keeps closing the progress window before completion. I have the bitlocker recovery key text file but I can't use it because it seems stuck half encrypted.
Does it help that I can see some files when booting in Ubuntu? (not the files that were originally there, but ones created by Bitlocker)

TBH, I'm sorry, no.

I may be mistaken, but the fact that Bunty only sees Bitlocker's files and not yours suggests to me that your files are scrambled. And the fact your machine has been rebooted means that any hope of recovering keys from RAM image has gone.

As Snaky said earlier, I think your only hope now is to contact Microsoft Tech Support directly. But my gut feeling is that we are grasping at straws now.

Just as a matter of interest, how big are the Bitlocker files?

Best wishes, G.

[lsk3993]

I found this: http://www.microsoft.com/downloads/details.aspx?FamilyID=4ffd0d16-a51b-48b1-9042-ae1fb2de40c6&displaylang=en
Any chance of it working? And also is there a windows 7 version?
I'm really quite desperate not to give up hope...

[snakedoc]

It's possible it may work, suck it and see. Although Windows 7 seems not to be supported.









Supported Operating Systems: Windows Server 2008; Windows Vista; Windows Vista Service Pack 1
Note: BitLocker does not need to be installed on the computer for you to use the BitLocker Repair Tool, but the system must be running.

[lsk3993]

I actually managed to repair my usb stick! Incredibly the repair-bde command worked perfectly.
If anyone is interested, you do the following in cmd

repair-bde [label of corrupt drive]: [label of drive to dump recovered files on]: -rp [recovery password] Since it formats the drive where you make to recovery to I made an 8GB partition on my HD and then used that... Also, I had to add -force at the end or it wouldn't work otherwise.

So the exact command I used was:

repair-bde G: I: -rp 522951-634821-407220-553190-669163-369281-426514-600369 -forceYou can add "\imagefile.img" after the second drive if you want it to make an img file of the contents of the drive but that didn't work too well for me...