Data Recovery Case File · Formatted & Logical Faults · Two Explanations, One Answer

Erased Space and Encrypted Content Look Different at the Raw Level

His enquiry asks the right question rather than assuming an answer. A drive from a laptop whose main board failed, which "appears empty when viewed with an external reader" — and he has read that automatic device encryption might explain it. He wants to know for certain whether it was wiped or is merely unreadable, and that is a question with a definite answer obtainable by looking at the drive itself.

The decode: how the two are told apart, and what follows from each

Why both explanations produce the same appearance: a computer shown either an erased volume or an encrypted one it cannot open reports nothing usable. The system's view is identical because in both cases it finds no filesystem it can interpret.

Why the raw data is not identical at all: erased space is generally uniform. A wiped region reads as long runs of the same value, most often zeros, because that is what erasure writes.

What encrypted content looks like instead: noise. Every block is high-variability data with no repeating pattern and no structure — statistically indistinguishable from random, and completely unlike a run of zeros.

Why that distinction is easy to make and quick: it requires reading blocks and measuring their variability. Uniform blocks mean erased; high-variability blocks mean encrypted content is present, and a few minutes of examination settles a question he cannot answer any other way.

Why a third possibility should also be checked: a volume that is neither wiped nor encrypted but simply has a damaged partition record. That reads as ordinary file content with no volume described, and it is the most straightforward outcome of the three.

What follows if encryption is confirmed: the question becomes where the key is. Platform device encryption of this kind protects the key with the machine's own security component, and a failed main board may mean that component is gone with it.

Why that is not automatically fatal: these arrangements generally deposit a recovery key into the owner's account when encryption is first enabled. That key decrypts the volume without the original machine, and it is retrievable by signing in — which costs nothing to check and is the single most useful thing he can do.

Why it is worth checking before anything else: if the key is available, this becomes an ordinary recovery from an image. If it is not, and the board's component is unrecoverable, the content cannot be decrypted by anyone — and he should know which situation he is in before spending anything.

Why the board failure is the reason this arose at all: the drive was fine and the machine was not. Removing storage from a machine that encrypts to its own hardware separates the data from its key, which is invisible until it happens.

What must not happen meanwhile: no initialising the drive and no accepting an offer to format. An apparently empty drive attracts exactly those prompts.

On the bench

Erased space was distinguished from encrypted content by raw examination — both presenting identically to a host, which finds no interpretable filesystem in either case, while at block level erased regions read as long uniform runs and encrypted content reads as high-variability data without structure. Block entropy and structure signatures were examined across the volume, and recovery key availability established with the owner before any decryption attempt, such arrangements typically depositing a recovery key into the owner's account.

The outcome

Erased space distinguished from encrypted content by raw examination, the drive imaged at the block level, and key availability established before any attempt. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: your question has a definite answer. Erased space reads as long uniform runs; encrypted content reads as noise with no structure — and a few minutes of examination tells us which you have.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.