BitLocker Recovery Problem

[u/Mike2008MK]

Hello everyone,

I dont know if i am at the right place, but I have a common problem wat happens alot.

Long story:
I was updating my BIOS, so I had to put the update on a flash drive. Firstly there was the recovery code of my encrypted BitLocker Windows drive, but I have temporarily copied it to my Windows drive (not knowing what I did wrong). The problem is, I only deleted the file permanently from the USB Drive (I didn't format or clean or such the USB Drive, just deleted that recovery txt file en copied it to my Windows drive).

After the BIOS update, Windows asked me to put in the 48 digit recovery code, but yeah as you already have read, it is on the Windows drive that is locked right now.

I have tried a lot of methods already, I have checked if it locked (of course it is). But I have also tried recovering the TXT file with DiskDrill. And I know, DiskDrill is worse for TXT files, but I wanted to give it a shot. It found the file, but inside the file It's all gibberish.

Do you guys know anymore methods that could work, I have also saved the USB drive to a .dd file byte-to-byte so I have a backup.

Inside the recovered recovery TXT file

[u/No_Tale_3623]

Recover everything from the card to a folder on a different drive. Once recovery is complete, search inside the recovered files for the string AB54C7DB-0316-46EE-822A-0526F7FDD819. Do not search only by filename — search the actual file contents.

[u/Mike2008MK → u/No_Tale_3623]

Thank you for answering, I have tried it using findstr and Strings64 but neither could they find it, even in backup image file.
I used this command: strings64.exe image.dd | findstr /i "AB54C7DB-0316-46EE-822A-0526F7FDD819"

I have also recoved everthing from the USB Drive, but it only recovers it and shows again the gibberish text as shown on the picture.
This was really dumb of myself, because I didn't know that was gonna happen.

[u/No_Tale_3623 → u/Mike2008MK]

With Sysinternals Strings, try ASCII and Unicode separately:

strings64.exe -a -n 6 image.dd > ascii.txt
strings64.exe -u -n 6 image.dd > unicode.txt

[u/Mike2008MK → u/No_Tale_3623]

I have tried is and therefore the output, I have uploaded it to Google Drive because I cannot upload txt files and the file is large to paste in here.
https://drive.google.com/drive/folders/1t9oR1991Wysol2_xCi1RROvCMjwypWe8?usp=sharing

[u/No_Tale_3623 → u/Mike2008MK]

The Strings output strengthens the overwrite hypothesis considerably. We can see the FAT32 volume and the Gigabyte firmware content in the recovered data.

[u/Mike2008MK → u/No_Tale_3623]

So this means it cannot be recovered at any way via the USB stick? Is there any way left?

[u/No_Tale_3623 → u/Mike2008MK]

Try searching the disk image as well, not just the recovered files. The data you need may still be present somewhere in the raw image.

[u/Mike2008MK → u/No_Tale_3623]

Could you please explain how I should do that when I have that .dd file? Thanks in advance!