Help needed with recovering files from boot drive that got wiped

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
YJMGC
Posts: 4
Joined: 26 Jun 2024, 18:42

Help needed with recovering files from boot drive that got wiped

#1 Post by YJMGC »

Hello, recently, while trying to increase the size of my EFI partition (to fix a different issue I had) in my boot drive (I believe that is what it's called? It is the main drive and the one windows is on) and restarted my computer, I got an error along the lines of my computer missing some boot files. It crashed, and I got a BSOD. I couldn't back up most my files as I lacked enough external storage previously.

So after that, I booted into a USB flash drive, to try and avoid messing up the main drive any further, and also found out the drive had completely wiped itself besides boot files. I tried using testdisk to recover, but I got stuck on this https://ibb.co/x6YqrVZ (screenshot/image). I am not sure what to do next and would prefer to ascertain what to do next to avoid causing more issues. There's around 350gb of data. My main goal is just to recover the files, but if there's any way testdisk can also possibly fix the drive itself, it would be nice, but not necessary.

Thanks.
recuperation
Posts: 3026
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Help needed with recovering files from boot drive that got wiped

#2 Post by recuperation »

Please use the most recent version of TestDisk and post your logfile.
YJMGC
Posts: 4
Joined: 26 Jun 2024, 18:42

Re: Help needed with recovering files from boot drive that got wiped

#3 Post by YJMGC »

I am using 7.2 now and I had to upload the log file to onedrive, as it was too large to attach directly. https://1drv.ms/u/c/38572feaa6971e51/EX ... A?e=XCqHdC
recuperation
Posts: 3026
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Help needed with recovering files from boot drive that got wiped

#4 Post by recuperation »

If you just use TestDisk to navigate in found partitions, mark and copy the desired files to an external location, you will reduce the chances of creating additional mess. Given the way Windows operating systems behave towards storage, running TestDisk from a linux pen drive should be the preferred way of operation.

You already used the p-key ("list files") to navigate within one partition as shown in your screenshot. The p-key appears after running the quick search function and after running the deeper search.

Sample pictures can be seen here:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I have never seen such a strange looking TestDisk log file. I would ask the manufacturer of the program that you used to manipulate your partitions for help.
YJMGC
Posts: 4
Joined: 26 Jun 2024, 18:42

Re: Help needed with recovering files from boot drive that got wiped

#5 Post by YJMGC »

Hello, since I have not used Linux before, I had not thought of doing so and was not aware that it is preferred.

I tried to do a deeper search, but it would take an estimated 2 days, which was not a concern, but it would not progress in the background, which I am not sure if it is my own user error. If in the background, it would stay at the same progress, and would start immediately progressing when moved to top. Is there any way of which I could change that? Thank you.
recuperation
Posts: 3026
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Help needed with recovering files from boot drive that got wiped

#6 Post by recuperation »

YJMGC wrote: 02 Jul 2024, 13:12 Hello, since I have not used Linux before, I had not thought of doing so and was not aware that it is preferred.

I tried to do a deeper search, but it would take an estimated 2 days, which was not a concern, but it would not progress in the background, which I am not sure if it is my own user error. If in the background, it would stay at the same progress, and would start immediately progressing when moved to top. Is there any way of which I could change that? Thank you.
Obviously there is an issue with your 512 GB NVME device as 2 days gives roughly 3 MB/sec which is 10 to a 100 times to slow.
I would suggest interrupting TestDisk and trying to clone the NVME disk as described in the manual.
The speed of TestDisk should not depend on wether it is "in the background" or not.
YJMGC
Posts: 4
Joined: 26 Jun 2024, 18:42

Re: Help needed with recovering files from boot drive that got wiped

#7 Post by YJMGC »

Sorry, but which manual are you referring to? And how/where should I clone the NVME to?

I had also just swapped the SSD (which the data is located on) with another one (so I don't need to boot off of a USB flash drive), and am now running the previous one with an enclosure, if that may affect anything. Thanks and apologies for my confusion.
recuperation
Posts: 3026
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Help needed with recovering files from boot drive that got wiped

#8 Post by recuperation »

Please check the content of your TestDisk download package and do me the favour of not just looking at the link I recommended to you already
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

but the whole Testdisk site:

https://www.cgsecurity.org

Thank you!
Locked