Arch Linux

860lacov

Member

Registered: 2020-05-02

Posts: 476

Data recovery from bitlocker encrypted pendrive

My friend asked me for help with his pendrive

In windows, ysually after connection to Windows PC there is a prompt for password.

Now something is changed.

Pendrive is opening without password prompt but on the pendrive there are: 
FOUND.000 direcotry 
System Volume Information directory 
\[\]\[\]P file (\[\] is square symbol) 
Pendrive is 2GB with about 1.6GB in use.

Don't know what do to next. 
I dont have w windows pc.

I did a dump of this pendrive with linux dd. 
I tried to use dislocker with an output: 
dislocker-metadata -o 16384 -V backup.img 
\[sudo\] hasło użytkownika jm:   
Mon Nov 25 14:54:35 2024 \[INFO\] dislocker by Romain Coltel, v0.7.2 (compiled for Linux/x86\_64) 
Mon Nov 25 14:54:35 2024 \[INFO\] Compiled version: : 
Mon Nov 25 14:54:35 2024 \[ERROR\] The signature of the volume (MSDOS5.0) doesn't match the BitLocker's ones (-FVE-FS- or MSWIN4.1). Abor 
t. 
Mon Nov 25 14:54:35 2024 \[CRITICAL\] Cannot parse volume header. Abort. 
Mon Nov 25 14:54:35 2024 \[CRITICAL\] Can't initialize dislocker. Abort.