Home | Data Recovery | Partner Program | Data Backup | Data Conversion | Data Elimination | Data Forensics

Recovering data from encrypted hard disk drive volumes

Background

Most hard drive data encryption methods work by physically encrypting the files on the hard disk, such that any files must first be decrypted using a decryption key before they can be read. Recovering data from a damaged drive that is also encrypted is a two stage process:

> Software Encryption: Use of programs such as SafeBoot

These programs encrypt the data and rely on a decryption key to retrieve it. Sometimes, the decryption key has been lost or become damaged. Depending on the encryption program it is sometimes still possible to decrypt the recovered data without the decryption key.

> Hardware Encryption 1: Seagate's FDE (Full Disk Encryption) hard disk

Seagate have introduced a family of laptop drives (Momentus 5400 FDE series) that feature a hardware-based, full-disk encryption that automatically encrypts all the data written to the drive.
Recovering data from FDE disks: The encryption engine is active when you first turn on the drive and begin using it, although no encryption key is generated (the drive comes with a factory-installed key that is inaccessible by the user). A derivative key (not the actual encryption key) can be generated by manually setting the ATA password field, the password is cryptographically combined with the encryption key to create a derivative key that is stored in non-addressable memory, making the encryption key accessible.

> Hardware Encryption 2: ATA Password Protected Drives

We are able to remove ATA passwords from most hard disks and have written a specific page regarding recovering data from hard disks with ATA passwords

 

>> If you need to recover data from an encrypted drive please call us on 0870 7424 008 (UK) or +44-161-761-9140 (outside UK) <<

 

> General data recovery section
> Advanced data recovery section

Above: Part of the process in removing an ATA password from a laptop hard disk.