Recovering Personal Files from Windows 10 partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
shost
Posts: 3
Joined: 11 Oct 2018, 16:18

Recovering Personal Files from Windows 10 partition

#1 Post by shost »

Hi all,

I've lurked here for many years using this site to solve many problems for friends and family, but now I'm stuck!

It used to be so easy with Windows 7 and earlier, but now for Windows 10 I just can't figure out what to do.

At work I have an employee who has Win 10 Pro and their Lenovo T560 blue screened. On reboot it said "Diagnosing PC" and attempting to repair but never did. Restore points don't work, automatic repair doesn't work, etc.

Most of the employees here store their stuff on the share drive which I encourage, but this person had a few things on the Desktop they wanted to get back. So I figured, great! Let me give this a try! :-)

As mentioned it is a Lenovo ThinkPad T560 with a Crucial MX300 275GB SSD. BIOS was set to Secure Boot with UEFI.
In order to boot to the UBCD v5.3.8 flash drive I had to disable Secure Boot and enable Legacy boot.

It boots to GParted and in File Manager I see
sda1 450M Recovery ---
sda2 100M ---
sda3 16MM ---
sda4 255G ---
sda5 793M ---

From what I understand, sda4 is where the data is stored. I figured I would open that and just copy off what she needs. However, I get an error
udevil: error 64: unable to determine device fstype - specify with -t

I run testdisk and select the Crucial and it defaults to EFI GPT, I select that. It's kind of here that I don't really know what to do. In the past, on older OS's I would simply select the partition, list the files, and copy them over to another flash drive. Now I don't really see that. I see an MS DATA partition and I can change the Type from Unknown to NTFS, but if I list files I get "can't open filesystem, seems damaged"

So what do I do to get her files back (they're not critical, but more of just a learning experience for me). I've search around these forums and read the pdf but I'm not really sure what I'm doing here!

Thanks. Sorry about the long post!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering Personal Files from Windows 10 partition

#2 Post by cgrenier »

Are the data encrypted using BitLocker ?
If it's not the case, can you try PhotoRec on the partition ? Does it recover valid files ?

shost
Posts: 3
Joined: 11 Oct 2018, 16:18

Re: Recovering Personal Files from Windows 10 partition

#3 Post by shost »

Not encrypted.
I ran photorec on the partition and finished after about 30 minutes with 0 files saved.

shost
Posts: 3
Joined: 11 Oct 2018, 16:18

Re: Recovering Personal Files from Windows 10 partition

#4 Post by shost »

Just curious if anyone had any other ideas for this?

I was going to wipe the drive and put it back into circulation. Coincidentally, this has happened on several other laptops around the office. All the laptops have Crucial MX300 275GB drives with firmware version M0CR031. I have updated all those drives to the latest M0CR060 and that appears to have fixed it. Not sure if it was something with the drive only or a conflict with a recent Windows Update and that particular drive/firmware.

Anyway, let me know if there is anything else I should try to get that partition back as it might be helpful if something like this happens in the future and someone really does need data back. :-)

Thanks!

Locked