Data Recover from built in NVME on Dell XPS

[Kerrya]

So this client lost a folder on his desktop and none of the files are in his recycle bin.

This is Windows 11

I removed the drive and tried to perform a recovery using ReClaimMe Ultimate by putting the NVME into an USB C adapter.

The OS of my recovery machine sees the drive and mounts it saying access deigned and to enter a Bitlocker Key.

I reached out to the owner and he said he never put Bitlocker on it, and he contacted Dell who said they don't install Bitlocker either.

Any idea of what might be going on here?

Any help appreciated.

Kerry

 

[Porthos]

The OS of my recovery machine sees the drive and mounts it saying access deigned and to enter a Bitlocker Key.

The should be in the user's MS account.

and he contacted Dell who said they don't install Bitlocker either.

Windows does it automatically.

 

[britechguy]

The should be in the user's MS account.

If they used an MS-Account-Linked Win10/11 User Account. Yet another reason to do so.

Windows does it automatically.

Yep. I seem to recall a lengthy conversation about this on these very forums not very long ago. If memory serves, that applies only to machines that shipped from the factory with Windows 10/11, but I may be wrong about that.

One of the reasons I've added a "Check Bitlocker" step to my set of things to do with brand spankin' new machines when setting those up. I ask the owner, but my advice is to turn it off.

 

[Markverhyden]

Yep. They have a M$ account when they setup the machine. It automatically BL's the drive when going that route for setting up an account.

 

[fincoder]

contacted Dell who said they don't install Bitlocker

The full Bitlocker feature is only in Windows Pro edition. In Windows Home edition there is a feature called Device Encryption that we should think of as "Bitlocker Lite", especially as some parts of the OS call it Bitlocker (e.g. the prompt for a key to unlock) and the bitlocker management commands apply to it also (e.g. "mange-bde -status" from cmd/powershell/terminal).

On some (or most?) OEM-built PCs the Device Encryption feature will kick in automatically, if certain conditions are met such as Microsoft Account login. The drive is encrypted without getting the user's permission and the encryption key is saved in the MS account (accessible via a browser). I recovered data from a non-booting PC last week using the encryption key from the customer's MS account and it worked well.

 

[Kerrya]

Just my luck. The owner says he doesn't have a M$ account . So he does but he doesn't know what it is.

 

[fincoder]

So he does but he doesn't know what it is.

Try any email addresses that he has. Any hotmail/live/outlook.com email addresses are obviously MS accounts. Any other email address can also be an MS account. Go to account.microsoft.com and enter those email addresses, if it asks for the password then it's an MS account, recover password if it can't be guessed by him.

 

[lcoughey]

Were there any errors when you cloned the SSD? Might be an explanation of the missing folder. As it is Windows 11, the bitlotcker is likely tied to the TPM chip and you may need to work around that. But, on top of encryption, you are also up against TRIM, if the files were deleted. Good luck.

 

[Kerrya]

So the Client found the Bitlocker code after all

So I have access to the data however I can’t get the NVME/USB device to stay connected long enough to get much access.

I can’t even clone it so I’m paranoid of losing his data.

I think I will politely back out if this one.

Thanks for all your help guys

Kerry

 

[Markverhyden]

Not all is lost if they're willing to pay some money. You've got a couple not far from you, @Larry Sabo and @lcoughey, you could put the customer in touch with.

 

[nlinecomputers]

Check the M$ for a Onedrive account. If the client didn't know that they had a M$ account they probably also have a Onedrive account that might have the files. During the OOBE these get setup by default.