Start a Conversation

Unsolved

C

5 Posts

16589

April 18th, 2019 16:00

Secondary drive locked with Bitlocker after factory reset

I had to perform a factory reset on my Dell Inspiron 17-1779 after Dell updates were installed.   My machine has an SSD primary drive and a secondary SATA drive. I can not access the secondary drive after the reset because it is locked with Bitlocker.  I have gone to oneDrive and get the message "You don't have any BitLocker recovery keys in your Microsoft account."  When I go to the "more info" I get instructions like find where you wrote it down...I never wrote it down because I didn't activate it.  I have never heard of Bitlocker before, and now I am having a nightmare!!! My secondary drive is where I backed up my documents and work!

I have downloaded Dell OS Recovery to two separate thumb drives (32 gb), and when I try to boot to either one, I get that there is no Boot Record, so I cannot even get a clean install!  I am at an impasse and ready to pitch this out the window!!!

4 Operator

 • 

14K Posts

April 18th, 2019 17:00

I can't account for this.  I do know that some Dell systems ship with BitLocker "prepped", and if you choose to link your Windows logon account to a Microsoft account, BitLocker is automatically enabled because the Recovery Key is backed up to the Microsoft account you linked with.  Unfortunately the user is never notified that this has happened OR that they can access their Recovery Key from their Microsoft account, and even the Recovery Key prompt if they ever see it doesn't suggest that.  I think it's a really bad implementation of a decent idea (protecting user data).  However, all of that only ever applies to the OS partition.  For any other drives, including other partitions on the same physical disk, BitLocker has to be manually enabled, and if you go through the regular wizard rather than using something like PowerShell, you are FORCED to back up the Recovery Key before encryption will enable.  In addition, the only way your secondary drive could have been locked without you realizing it would have been if it had been enabled for auto-unlock on that system, but that would require your OS partition to also be encrypted with BitLocker, since any auto-unlock keys get stored on that partition.  But auto-unlock would also have to be manually enabled.  And BitLockered partitions have a lock icon shown over the drive icon when you view them in the "This PC" view of Windows Explorer.  Do you ever recall seeing that?

For a moment I thought this might have been a case of malware or ransomware encrypting your secondary drive, but it doesn't seem likely that it would also have enabled auto-unlock so you wouldn't notice this problem until you wiped your OS partition (and therefore the auto-unlock key).  It seems more likely that it would have encrypted your secondary drive and then locked you out of it with a ransom note.

Anyhow, unfortunately if you don't know the password, don't have a Recovery Key, and don't have an auto-unlock file anymore elsewhere, then the data is lost.  If there was some way to access the data without any of those things, then unfortunately the encryption would be effectively useless.

5 Posts

April 18th, 2019 18:00

In addition, I cannot get the system to reset...it just flashes and goes back to the request screen. 

I have a question someone here might answer:  If I disable the PTT in the bios, will it kill the encryption.  I know it will get rid of any passkeys (like I have any!). I just don't want to lose ALL my data on that drive!

4 Operator

 • 

14K Posts

April 18th, 2019 20:00


@camntx wrote:

In addition, I cannot get the system to reset...it just flashes and goes back to the request screen. 

I have a question someone here might answer:  If I disable the PTT in the bios, will it kill the encryption.  I know it will get rid of any passkeys (like I have any!). I just don't want to lose ALL my data on that drive!


@camntxI'm not sure what you're referring to when you say "PTT".  But if BitLocker is using software encryption, then no BIOS changes will "kill" the encryption.  The way to kill it would be to wipe the disk.  If BitLocker was enabled in a way that causes it to leverage hardware encryption support built into the drive (this is rather unlikely because the steps to achieve this are pretty involved), then you'd have to perform a secure erase of the drive, typically using a utility provided by the drive manufacturer.  But either way, any data that's encrypted in a way that you don't have the necessary knowledge or materials (e.g. auto-unlock files) to decrypt should be considered lost.  If you suspect that there might be other partitions on the drive that are unencrypted, you can try following the instructions I recently wrote in this post to help someone whose system had become unbootable and who wanted to try to recover some files.  That same Rescue environment would allow you to freely browse the contents of any partitions that aren't encrypted.

3 Apprentice

 • 

4.3K Posts

April 19th, 2019 08:00

Could you confirm your model number?  I am familiar with an Inspiron 17 7779 but I do not see any 1779s

5 Posts

April 20th, 2019 08:00

"PTT" is "Platform Trust Technology"; it is used on some laptops such as the Inspiron 13.

5 Posts

April 21st, 2019 19:00

This is what I have been able to discover:
 
C:\WINDOWS\system32>manage-bde -status
BitLocker Drive Encryption: Configuration Tool version 10.0.15063
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume E: [Label Unknown]
[Data Volume]
    Size:                 Unknown GB
    BitLocker Version:    2.0
    Conversion Status:    Unknown
    Percentage Encrypted: Unknown%
    Encryption Method:    XTS-AES 128
    Protection Status:    Unknown
    Lock Status:          Locked
    Identification Field: Unknown
    Automatic Unlock:     Disabled
    Key Protectors:
        Numerical Password
        External Key

Volume C: [OS]
[OS Volume]
    Size:                 476.78 GB
    BitLocker Version:    None
    Conversion Status:    Fully Decrypted
    Percentage Encrypted: 0.0%
    Encryption Method:    None
    Protection Status:    Protection Off
    Lock Status:          Unlocked
    Identification Field: None
    Key Protectors:       None Found
 
 
C:\WINDOWS\system32>manage-bde -protectors e: -get
BitLocker Drive Encryption: Configuration Tool version 10.0.15063
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
Volume E: [Label Unknown]
All Key Protectors
Numerical Password:
      ID: {D226B5D9-8319-422F-BC63-A4DCBDE84193}
External Key:
      ID: {28BF2143-8A80-4528-917A-0F300E6AAA50}
      External Key File Name:
        28BF2143-8A80-4528-917A-0F300E6AAA50.BEK

C:\WINDOWS\system32>manage-bde -unlock e: -RecoveryKey "c:\pathtofil28BF2143-8A80-4528-917A-0F300E6AAA50.BEK"
BitLocker Drive Encryption: Configuration Tool version 10.0.15063
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
ERROR: An error occurred while attempting to read the key from disk.
 
Is there anything I can do with any of this information? It appears that, perhaps, no password was ever generated.

 

 

96 Posts

May 7th, 2019 16:00

Appears there are two things:
1. You need to try to repair your installation of Windows and/or get your data. For this, I would go to Microsoft, and ask "them" what to do - they are the ones who "own" Bitlocker and OneDrive. Not sure, if Dell will be of any help - it appears that all they want is sell more laptops.
Personally, I started to keep things on OneDrive. When Dell broke my Windows on brand-new Inspiron 7786, by force-pushing an unwanted update,  I had my HDD decrypted (just switched Bitlocker off, as I had discovered that it was a Windows 10 Pro feature, and wasn't supposed to be on my Windows 10 Home). I had therefore no problem retrieving my "not-so-plentiful, non-OneDrive" data by loading into Fedora from a Live USB. I was just lucky...
2. Depending on the success with (1), and assuming you will not be able to boot info your installation of Windows and/or get your encrypted data out, you will need to reinstall Windows 10, which will destroy the data forever. (There are complex tools to try to retrieve it, even from formatted disks, but yours is also encrypted, so, if neither Dell nor MSFT can help, not sure if anything can be done with it.)
I would suggest using Microsoft's original version of Windows from here https://www.microsoft.com/en-us/software-download/windows10 This will make sure that you don't get the unwanted Dell software that will trick you into installing dangerous updates. And there will be no need for two 32GB USB disks - just one 8GB disk will suffice. Once I had the media disk ready, I called Dell, and had someone guide me through the installation (this HDD+Intel Optane drive was the part that puzzled me, I would have done it all by myself, if I'd had the "simple" SSD instead).  Then, we installed DellAssist, got the drivers and updates. Once done, I immediately uninstalled the only Dell piece on my computer. I'll check for updates myself, from time to time.
To sum it up, I really wish that the root cause of the issue could be dealt with as well, and it's Dell pushing updates that break computers. Wondering, if business development is one of the reasons?

5 Posts

May 7th, 2019 19:00

I really appreciate your in-depth response. I contacted Dell and was told that because my computer is out of warranty (my warranty expired 3-28-2019, and the problem started 4-4-2019 after a Dell "critical" update) I was told to use this forum.  I searched the internet for software that might recover the password, and the only thing available is a software that would cost +$800.00, way out of my budget!!! I was able to recover the recovery key and the file name where the password is stored using the cmd prompt, unfortunately, the file does not exist on my computer! go figure.  I contact the software company who writes BitLocker, and was basically told, too bad cannot be recovered without the password and their software doesn't make mistakes. In response, I removed the hard drive, connected it to my pc with a usb connection and deleted the partition.  It now shows as a "Raw" drive.  Using recovery software, I have been able to recover some of my files, I am hoping for more success.  I will then format the drive and reinstall it in my computer.

In the meantime, I have been trying to reinstall the OS. I have downloaded the SupportAssist and have reset software on one usb thumb drive, and the windows OS on a 2nd one, downloaded through the Dell OS Recovery site. The problem I am having now is that when I boot to either one, I get to the Troubleshoot screen, it runs the diagnostic, and then tells me that there is no boot record, however, it is there when I explore the drives.  I just cannot get my computer to reset or reinstall, and the OS that is on it now is not preforming very well.  I don't want to reinstall my second drive or any of my programs until I have Windows running right, so this machine is pretty much an expensive email reader!

ARGH!!!! Very frustrated!

No Events found!

Top