No undelete option on Win10 EFI GPT partition?

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
sngordon
Posts: 1
Joined: 04 Aug 2019, 18:09

No undelete option on Win10 EFI GPT partition?

#1 Post by sngordon »

I'm trying to recover some files using Testdisk on a Windows 10 HP laptop that were deleted by a robocopy /mir process. After selecting the partition type, there is no [Undelete] option - see clipped output below. Searching this forum, the only possible clue I found was that undelete is not available for the HFS/HFS+ filesystem (viewtopic.php?f=7&t=6459&p=22195&hilit= ... ion#p22195). Is undelete also not available for EFI GPT partitions or might there be some other reason? My laptop is also part of a corporate network and the disk is encrypted using Bitlocker, but since I'm logged in and can access files normally, I assume Testdisk can also access any files. I've tried a few other recovery softwares (Recuva, EaseUS) and they show many *.tmp files in the directory I'm interested in but not the .doc/xls files that were deleted.

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA
 Disk /dev/sdb - 32 GB / 29 GiB - SanDisk Cruzer Glide

Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA
Please select the partition table type, press Enter when done.
 [Intel  ] Intel/PC partition
>[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map (legacy)
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection
Hint: EFI GPT partition table type has been detected.
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.

Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA
     CHS 31130 255 63 - sector size=512
 [ Analyse  ] Analyse current partition structure and search for lost partitions
>[ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ Quit     ] Return to disk selection

Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Partition                  Start        End    Size in sectors
  1 P EFI System                  2048    1023999    1021952 [EFI system partition]
  2 P MS Reserved              1024000    1286143     262144 [Microsoft reserved partition]
> 3 P MS Data                  1286144  495116287  493830144 [Basic data partition]
  4 P Windows Recovery Env   495116288  500117503    5001216 [Basic data partition]
[  Type  ] >[Image Creation]  [  Quit  ]
Note no Undelete option above. It is available if I choose the USB disk that I'm running Testdisk from...

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: No undelete option on Win10 EFI GPT partition?

#2 Post by cgrenier »

TestDisk Undelete doesn't work on filesystem encrypted by BitLocker. You have to turn off Bitlocker encryption ( https://www.top-password.com/blog/decry ... mand-line/ ) before running TestDisk or PhotoRec.
You will need your IT approval to do it.

Locked