How to remove full disk encryption from any windows disk

Assuming you have full access to the system and don’t have an ‘official’ way to remove it. Follow this to remove any full disk encryption software, even if you do not have keys to the full disk encryption software. You do need full admin rights and physical access.

  1. Run disk2vhd to take a snapshot past the transparent encryption level. Save it somewhere outside the system and convert VHD to a raw image. Do it on the live system, so the data is saved after decryption

To copy it back onto the physical system:

  1. Convert vhd to the raw disk format
  2. Boot into a linux based recovery disk and dd the raw disk over the partition you dumped.
  3. Boot into a safe mode, disable the full disk encryption services/drivers, so they don’t try to reencrypt your plain data and boot normally

To copy it into a VM:

  1. Convert that image to vdi
  2. Mount it as a second disk
  3. Boot into linux, copy the mounted disk over the encrypted partition (dd if=/dev/sdb of=/dev/sda1)
  4. You might need to fix the partition table with testdisk
  5. Boot into a safe mode, disable the full disk encryption services/drivers, so they don’t try to reencrypt your plain data and boot normally
Based off the Stack theme.