Bitlocker Data Recovery
Data Recovery of damaged notebook-hard disc drives combined with the use of Bitlocker - data encryption, is a combination which is getting more and more inquired by our clients. In most of thease cases thease clients do have a business or company background.
In principle the recovery of hard disc drives, regardless if they are damaged in a logical or physical way, is more or less not that much complicated for us. However, there are some conditions, which do have to be fullfilled bevor we do start a attempt to retrieve data stored on an Bitlocker encrypted hdd.
Because of the fact that Microsoft Bitlocker usually encodes its stored data on NTFS-Volumes with an AES Key-length of 128 to 256 Bit, it is essential to us that the IT-Administrator or the IT-Security consultant sets a PIN after the activation process in order to enable the encryption. Furthermore, in a best case scenario, also the filekey needs to be generated. The generated PIN or Filekey can be stored on an pen drive or can be placed within the Active Directory environment right inside of the clients network, or to be more precise: Inside the Bitlocker Management Console, if all TPM based devices are beeing managed centralised on clients side.
In case for successful data recovery, the PIN and / or the File-Key is needed, because otherwise we will not be able to run a verification-process of the recovered data or to do integrity checks in any way.
Decryption of Bitlocker data
A secure decryption of data can only be performed by the use of the correct PIN or Key. Commercial softwares, which offer a decryption of Bitlocker-Keys, do only function in a context if the device - which needs to be decrypted - is connected, mounted and activated in a system. Logically this status can only be reached if the PIN / Key is entered correctly whilst bootup proceess. After this the key remains persistent in RAM e.g. of an notebook and can be read from there, but only as long as the device itself has not been shut down completly.
Schematic overview on encryption process*
Recovery of bitlocker encrypted hdd for a fixed price
Recovery of Bitlocker encrypted hdd, regardless if logical or physical damage, is offered to institutions and enterprises for 1.699,- EUR* (excl. VAT.) and available in EXPRESS-Service (3 working days) an. Price includes the following services:
Valid for any unopened hdd with a max capacity upto 1 TB.
On-Site pick-Up service included in fee for analysis of 90,- Eur excl. VAT.
- If the recovery service is getting ordered fee for analysis will not be charged
Repairs are performed in ISO certificated clean room of class 100
One spare part included in price
Incl. target drive which carries the recovered data
File list with preview of files to be recovered included
Only valid for Windows file systems ( NTFS )
- Shipping of data carriers included (Original + Target drive)
*(c) Photo: Fraunhofer SIT / BSI