Frame WitnessForensics

GUIDE · BITLOCKER · 15 OCTOBER 2026

Recover data from a BitLocker-encrypted drive

Without the recovery key no software can read a BitLocker volume. With the key, unlock a copy, not the original, then scan the unlocked volume.

Without the key

A BitLocker volume is encrypted with a key that is protected by your password, TPM or 48-digit recovery key. Without one of them the bytes are unreadable to every program, including Frame Witness. Windows 11 can turn on device encryption by itself, so a drive may be encrypted without anyone having chosen it: look for the recovery key in the Microsoft account that set up the PC.

With the key

Frame Witness finds BitLocker volumes while scanning and tells you that whatever was written to them while encrypted is unreadable without the key, and that data written before the encryption may still be recoverable. With the recovery key, unlock only a copy (a RAW image of the device) or the device behind a hardware write blocker, never the original on its own, because Windows can write to a volume it unlocks and mounts. Then scan the unlocked volume.

What cannot come back

  • Overwritten data. Bytes that new files replaced are gone for every program.
  • Full and overwrite formats. A full format in Windows writes zeros over the volume; an overwrite format or a wipe does the same with other patterns.
  • SSD TRIM. A drive that receives TRIM usually erases freed blocks itself.
  • Encryption without the key. A BitLocker volume, or a phone with file-based encryption, cannot be read without its key.

Step by step

  1. Find the recovery key. Check the Microsoft account used on that PC, a printout or a USB key saved when BitLocker was turned on.
  2. Make a copy. In Frame Witness choose Acquisition › Create RAW image… and image the encrypted device, or connect it through a hardware write blocker.
  3. Unlock the copy. Mount the image or the protected device in Windows and unlock it with the recovery key.
  4. Scan the unlocked volume. Run the scan on the unlocked volume; results on the encrypted original would be unreadable.

Frequently asked questions

Can BitLocker data be recovered without the key?

No. That is what encryption is for; no recovery program can read it.

Why does Frame Witness say it found a BitLocker volume?

So that you stop expecting results from that area and look for the key instead.

Try it on your own source

Download Frame Witness for Windows (version 1.0.14, Authenticode-signed by Aurelio Avila, SHA-256 fa22d6c7f97da0b4e5efa889e5abb9e4d98815a9b76ac0087424944b21bad6c2). The free account gives a quick scan of the first 8 GiB, up to 100 results, previews and saving files up to 1 MiB each; full scans and larger files need a licence, with current prices on the pricing page.

Sources

Related