Jump to content

Recently deleted files on a Bitlocker volume


Spoonerta

Recommended Posts

Hi all, hope somone can help, I seem to have a particular situation.

Windows 8.1 Pro PC with an external USB3 1tb Western Digital mechanical disk drive (please note: NOT an internal C: drive etc)

The drive is reporting zero S.M.A.R.T errors, and the drive sounds and operates healthily (full read speeds)

This drive has had Bitlocker applied to it from day one.

A folder of files was accidentally deleted and emptied from recycle bin from it. (These files were copied to the drive originally about 24 hours prior.)

The rest of the remaining files on the volume are perfectly readable. The volume is NOT locked and the Bitlocker password/keys are fine and in good working order.

Within literally minutes of realising the files had been deleted, a deep scan of Recuva was attempted on it. No data has been written to the drive since.

There should have been no 'overwriting'. It is not a system drive nor has it been used for any kind of swap file location etc.

After running a deep scan for 2 hours, Recuva only seems to find a couple of 2 year old deleted files that should have been naturally overwritten ages ago by now.

The recently deleted files do not seem to be detectable. How/why could this be the case? Bare in mind as i've said no data has been written to the drive since they were deleted.

Is Recuva unable to scan properly inside (successfully unlocked) Bitlocker volumes correctly?

 

Regards.

Link to comment
Share on other sites

  • 1 month later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.