VMFS Recovery
Recovers data from VMware ESXi servers

Recover VMDK with Bitlocker inside

To recover data from VMDK that contains a Bitlocker encrypted disk, you need to mount it in the disk list as a disk image.

Bitlocker disks have 3 signatures that distinguish them from other file systems and contain a Bitlocker Volume Master Key (VMK). VMK is required to decrypt data stored on the volume and is also encrypted with the user password and recovery key. Thus to decrypt Bitlocker volume, you need the Volume Master Key and user password (or recovery key).

If one of the requirements is not met, my apologies, but your data is lost irrevocably.

If all the basic requirements are met, let’s continue to the recovery of Bitlocker volume in VMFS Recovery™. There are two possibilities: either Bitlocker volume preserved the integrity and was detected by VMFS Recovery™ fine, or VMDK is corrupt and you need to scan for VMK (Volume Master Keys).
Correct detection of the encrypted disk will result in displaying a partition with the “Bitlocker” file system in the disk list.

Force open disk as Bitlocker

Otherwise, please enable “Developer” mode by going to “View->Preferences”, pressing CTRL+E, checking the “Developer Mode” option, and clicking “Ok” to save settings. Now right-click on the disk with Bitlocker volume and select “Open as Bitlocker”. Btw. developers have promised to introduce this feature to user mode operations in the next build. See if they will keep this promise.

Scanning disk as Bitlocker

One way or another your Volume Master Keys are to be found and the volume should be recognized as a Bitlocker encrypted disk. Double-click on it to open it and enter the password the user used to access this volume or recovery key.

Browse files and folders inside and check with built-in preview if they are recoverable. If data was decrypted successfully, you should see a correct preview of the files. I.e. Documents\multimedia\databases, etc.

Preview of Bitlocker encrypted database




Return to contents