Disk encryption has become one of the most common forms of protecting data from prying eyes. It’s used on every level – by consumers and enterprises alike – to safeguard confidential or sensitive information.
However, today’s encryption is extremely sophisticated. It’s so advanced, in fact, that users sometimes run into problems when it comes to recovering data from an encrypted disk. Whether it’s due to a sudden hard drive failure or even if you’ve simply forgotten your encryption key, there are only a few solutions available to you.
Recovering Data from an Encrypted Drive in Windows
Disk partitions that have been encrypted through the Windows operating system are stored in the EFS (Encrypted File System) format. If you’ve lost your encryption key, the easiest way to access the data stored within is by importing a certificated for the drive in question.
If you have a certificate, open up the Windows Certificate Manager (by opening up the Run dialogue and typing “certmgr.msc” within the box) and locate the Personal folder. From there, select “Action,” “All Tasks,” and, finally, “Import” to begin the Certificate Import Wizard and start the restoration process. Simply follow the on-screen prompts to complete the task.
For those without a certificate, your next option is to attempt to decrypt the drive in question. First, type “Diskpart” into the Windows search bar to load the program. Once you’ve arrived at the command prompt, type “list disk” for a comprehensive list of all the disks that are currently connected to your system. You can easily locate the encrypted disk by its size.
Next, type “select disk X,” where “X” is the number of your encrypted disk, and hit Enter. From there, type “clean,” “create partition primary,” “select partition 1,” “active,” “format fs=nfs quick /override,” and, finally, type “exit.” Make sure to hit Enter in between each command you type into the prompt.
Recovering Data from an Encrypted Drive in Mac
Although Mac operating systems tend to be a little more difficult when it comes to recovering an encrypted drive without the encryption key, it’s still possible to perform successful recovery.
Start by opening Terminal and typing “sudo chflags 0 /Volumes/” and press Enter. Next, type in your admin password, press Enter again and type “sudo chmod a+rx /Volumes/.” Press Enter again, type “killall Finder” and hit Enter one more time.
Once the above setup has been completed, it’s time to begin the restoration process – which is ideal if you’ve forgotten your encryption key.
Launch Terminal and type “diskutil cs.” Press Enter and copy the alphanumeric code that appears next to the Logical Volume Group. Finally, type “diskutil cs delete XXXX____YYYY___ZZZZ___XYZ” and press Enter.
If the operation is successful, you’ll find the drive is no longer encrypted or protected by a password of any kind. You should now be able to access the drive’s entire contents by any traditional means, and you’ll be able to copy the data to a new drive, delete it altogether, or even re-encrypt it with a brand new key.
Leave a Reply