I had an employee delete all her data. I was going to remove the SSD and scan it on an different PC. In order to do this I turned off bitlocker and waited for the drive to decrypt. Recuva found all the files I need, but can not open them. I think they are still encrypted. I do have the bitlocker recovery key. Any ideas?
I’m surprised that you were able to recover deleted user files from an SSD (unless it was an networked drive and not on a PC).
The automatic TRIM (and garbage collect) usually makes that unlikely.
The only things I have ever managed to recover from an internal SSD were some deleted system icons, which had originally been on a system partition that didn’t get TRIM’med.
If you have actually recovered some files then are they the size that you would expect?
Sometimes with a recover all you have got back is the filename and header from the Master File Table and not the full file.
(The MFT itself can still hold the name of a wiped file, and we often get questions asking why people can still see filenames in recovery software after wiping a drive).
I’m not sure; but would turning off bitlocker decrypt files that had already been deleted from the drive? Why would it bother?
I don’t use bitlocker myself, but have you tried re-enabling it and rebooting (with the recovered files on the bitlocked drive) to see if it can then access the recovered files?
Not quite your scenario but does anything here help:
Thanks for the reply, I tried to re-enable bitlocker, but it generates a new recovery key. So the encryption would be different. Needless to say, I didnt want to screw myself more, so I stopped that approach
You may be better asking on a general techie forum such as BleepingComputer.
You would probably find people there who are au-fait with bitlocker and odd situations.