Seems Yes. People always tell us, it is very hard (or almost impossible) to recover an encrypted hard disk.
But after a second thought. I think this is not true.
Given that we know the KEY, and the method/algorithm of decryption, the
decryption(key, encrypted_data) should be no different from
- We mistakenly deleted a file. We have to examine the bits on the hard disk, identify the start and end positions of the file, and un-delete it. Of course the bits on the hard disk looks meaningless. However after decrypted, it appears no different from an ordinary hard disk.
- Bad sector happens to the hard disk. For those error bits, those bits are lost, no matter encrypted or not. (Of course you can guess those bits and recover them.) For the rest intact parts of the hard disk, we can still decrypt those files as normal.
However there are some concerns that I am not clear about.
- As some (or most) disk encryption algorithms are chaining previous and next sectors. Will this lead to whole hard disk not recoverable with just one error bit?
- Consider the "bad sector example" above. If an error bit falls on an JPEG file. With a normal hard disk, we can still view the image, with display error on certain parts only. However with an encrypted hard disk, will encryption leads to whole image not viewable?
All-in-all, given that we know the KEY, and the decryption algorithm, does Encryption still add difficulties to File Recovery?