Recovering a document from an Ext partition that was replaced by bitlocked NTFS partition during Windows installation.

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
u4953063563

Recovering a document from an Ext partition that was replaced by bitlocked NTFS partition during Windows installation.

#1 Post by u4953063563 »

This is a ThinkPad X270 that previously ran Debian Sid on a single unencrypted 1TB Ext4 partition.
A BitLocked NTFS partition claimed the entire SSD drive during the Windows installation. I can't recover my academic diary which was lost in the previously used Ext4 partition. It's essentially an Open Document file (.odt) made by LibreOffice Writer, and it is supposed to be a ZIP file as far as I understand.

This is how it happened: I've used Debian in the past 2 years on my ThinkPad. While using Debian, my home directory resided on a standard Ext4 partition. Ext4 permits certain characters in file names that NTFS/exFAT don't permit. So yesterday, I made a grave mistake: I should've archived my entire home directory into a .7z file and only then copy it as a whole into an exfat SD card as backup (actually I did two, but both of them failed for the same reason). Instead, I just copied the files as-are with their illegal filenames. The fuse driver apparently failed to convert the names of many of my files, so they were not copied at al, including my diary.

After reintroducing Windows 10 to my ThinkPad, the installation enabled BitLocker and Secure Boot automatically. I've noticed only today that I have many files missing, typically those which had colons, question marks and quotation marks in their names. Among these files was my diary (it had a quotation mark in its name). I desperately need help to recover it.

What I've done so far:
1. Full scan for .zip files in both of the exfat "backup" SD Cards. These scans found plenty of extremely old files, which proves that my diary wasn't even copied over there at all.

2. Full scan for .zip files in my ThinkPad's BitLocked 1TB NVMe SSD from within Windows. I asked QPhotoRec to search for .zip files all over the SSD using the scope of the "unkown" partition (which is the whole SSD), and look for Ext partitions (because Debian was installed on Ext). Unlike the SD-cards, it didn't retrieve even a single file, is BitLocker's decryption algorithm getting in the way?

3. I've prepared a Debian Stable live image to perform another full scan for all .zip files outside of Windows. I'm not yet sure if I can disable BitLocker temporarily just to be able to read the old Ext partitions of Debian and recover my diary from there. What should I do? I'm afraid BitLocker's decryption algorithm prevents PhotoRec from reading the remnants of the Ext4 as-is without any need for decryption in the first place.

I don't think it's too late. My primary SSD has 1TB of space with "only" 100-150GB written by Windows since the installation. As far as I understand (perhaps wrongly) SSDs don't overwrite recently freed sectors if there are other free sectors which were freed earlier than the recently freed sectors. Isn't that's how wear optimization works? So I suppose my diary is still somewhere past the last 150GBs of recently written data?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering a document from an Ext partition that was replaced by bitlocked NTFS partition during Windows installatio

#2 Post by cgrenier »

In Windows, start the control panel, select Bitlocker Drive Encryption, select the disk and choose "Turn Off Bitlocker".
It will take a very time.
Once it's done, try again PhotoRec.
Good luck

Locked