Saving Surface Laptop "Couldn't find a bootable operating system"

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Smith0
Posts: 6
Joined: 20 Aug 2021, 17:57

Saving Surface Laptop "Couldn't find a bootable operating system"

#1 Post by Smith0 »

Hello community,

I've been reading in your forum since last thursday, when my Surface Laptop (1st Gen) crashed and then showed "Couldn't find a bootable operating system".
So far I've tried the recommendations by Microsoft up until the point where they tell you to use the rescue drive as this would delete my precious files.

So what I did thus far to try to recover them:
I created a bootable windows stick and tried to access the ssd from there - no luck
I created a bootable ​Linux stick and tried to access the data from there - no luck
I tried to check for the partitions - again, no luck

I used ddrescue to create an image of the whole drive to an external ssd with enough space (>300gb free) which seemed to work perfectly with just a teeny tiny bit of data lost - what I thought would be the reason why it can't boot:
https://ibb.co/JqZKm7Q

However, as you can see: parted had a problem with an "unrecognized disk label"

So what I did next was downloading testdisk to see what I can find. I started with a run on the Intel partition althought it showed me EFI as I was following a video tutorial. It ended up only showing 2 partitions with a huge gap in the middle.

In the next run I tried EFI and right after I click analyse I can see all those partitions:
https://ibb.co/7jjFCsg

I tried to mount the img with an offset of 796672*512 but it said it "unknown filesystem bitlocker" - although I can't remember ever activating it or something like that

So I run quick search and the result is:
https://ibb.co/fp6nszF

I can't see any of my data with "p" so I continue with a deep search.
During the search the first error pops up:
https://ibb.co/G5NP8F9

Which is followed (after a while) by:
https://ibb.co/sjtG2Zw

I hit enter and the result of the deep search at the end is:
https://ibb.co/pzzk7bh

Again no data to be found.

My last hope was to go the advanced option and there I was able to see this:
https://ibb.co/qndZ6pT

Which - to me - seems like the most likely partitiong of the drive. However, the options with Backup etc. are not there!

You are my last hope to save all my uni files and I promise, if I'll get them back I'll start doing 2 backups of everything.

Thank you very much in advance and best regards
Nick

PS: I am working full time so please don't feel neglected if I am not able to answer within 24hours
Last edited by Smith0 on 21 Aug 2021, 09:20, edited 1 time in total.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#2 Post by recuperation »

Please upload your pictures to this site.
I can't see any.

Smith0
Posts: 6
Joined: 20 Aug 2021, 17:57

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#3 Post by Smith0 »

Good morning and thank you very much for the fast reply!

I re-tried with deleting the img tags. It seems to work now?
I don't get what went wrong there as I followed the FAQ on how to insert a picture..

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#4 Post by recuperation »

Use the attachment tab on the bottom of the page to upload pictures when responding.

Smith0
Posts: 6
Joined: 20 Aug 2021, 17:57

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#5 Post by Smith0 »

Picture 1: Results from ddrescue and parted
Results from ddrescue and parted
Results from ddrescue and parted
ddrescue + parted.jpeg (293.17 KiB) Viewed 10214 times
Picture 2: Partitions shown after Analyse
Partitions shown after Analyse
Partitions shown after Analyse
Partitions shown after Analyse.jpeg (435.91 KiB) Viewed 10214 times
Picture 3: Results Quick Search
Results Quick Search
Results Quick Search
Results Quick Search.jpeg (160.9 KiB) Viewed 10214 times
I can only upload 3 at a time? Sorry..

Smith0
Posts: 6
Joined: 20 Aug 2021, 17:57

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#6 Post by Smith0 »

Picture 4: Error1_Bad jump in FAT partition
Error1_Bad jump in FAT partition
Error1_Bad jump in FAT partition
Error1_Bad jump in FAT partition.jpeg (144.8 KiB) Viewed 10213 times
Picture 5: Error2_Partition cant be rescued
Error2_Partition cant be rescued
Error2_Partition cant be rescued
Error2_Partition cant be rescued.jpeg (226.86 KiB) Viewed 10213 times
Picture 6: Results Deep Search
Results Deep Search
Results Deep Search
Results Deep Search.jpeg (194.99 KiB) Viewed 10213 times

Smith0
Posts: 6
Joined: 20 Aug 2021, 17:57

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#7 Post by Smith0 »

Picture 7: Partitions shown after Advanced
Partitions shown after Advanced
Partitions shown after Advanced
Partitions shown after Advanced.jpeg (307.04 KiB) Viewed 10212 times
I hope this was right now..
Again, sorry

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#8 Post by recuperation »

Leave the advanced menu.
Try to list the content of the partition in question using the "p"-key.
If that fails, use Photorec or any other commercial recovery software.

Smith0
Posts: 6
Joined: 20 Aug 2021, 17:57

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#9 Post by Smith0 »

Hello,

I just wanted to share the news, that I was able to save my data with a different method! I hope my solution can help others, too.

Disclaimer: I did not try PhotoRec or any other software, so it might work aswell!

I was not able to view any files within desktisk. However, as mentioned above I was able to see the partitions in the advanced tab.
I created an image of the partition I thought my data was on and then tried to directly mount the image via linux command line. The same error occured as last time "unknown filesystem bitlocker". However, as I was no longer working with an offset parameter I was able to download and use "Dislocker".

Looking into my Microsoft Account I was able to get the BitLocker Recovery Key and then decrypt the partition and mount it.
Afterwards I could just copy all needed files to an external disk.

I hope this is of some use for others and thanks again for this great tool!

Brandonrh
Posts: 3
Joined: 07 Dec 2019, 15:14

Re: Saving Surface Laptop "Couldn't find a bootable operating system"

#10 Post by Brandonrh »

First of all, I just want to say than you very much for Smith0! Without this post, I would not have figured out how to recover data from this laptop.
I am not an everyday linux user, and was unfamilliar with some of the things mentioned above in this post.

I thought it might be helpful if I made a step by step of how I recovered data from this device. I assume Smith0's process was nearly identical, but I had to do a lot of googling on how to do some specific things, and hopefully this post will save someone else in my situation some time.

This is what worked for recovering data from a Microsoft Surface Laptop Gen 1 Model 1769

Required parts for recovery:
USB hub because you will probably need more that 1 usb port (preferably USB 3.0, otherwise this is going to take a long time for you)
External HDD/SSD (500GB or bigger recomended so you can create image and then copy files from the image onto the same drive.)
USB Flash Drive (for linux distro)
USB Keyboard (some/most linux distros won't recognise the keyboard on this laptop)

Choose a linux dirsto that you want to use to recover the data. I used rescuezilla as it already had everything I needed pre installed (other than dislocker)and I'm somewhat familiar with it.
Rescuezilla will also give you an option to load the distro to ram (very usefull if your USB hub is short on ports!). If you load it to ram, you can just unplug the flashdrive once you are done loading into the OS.

First you want to create a partition on the external drive you have plugged in and mount it (I formated my external SSD in gparted within rescuezilla. I formated it as NTFS so that once I am done, I can plug it into a windows machine and access files without hastle)

To mount external drive :
figure out what your external drive is called
Open terminal type

Code: Select all

lsblk
lsblk will list all the drives and their partitions, you should be able to identify the external drive based on disk size. In my case is said that the 500GB Drive was sdb and that the partition I made was sdb1, this means the drive i want to mount is /dev/sdb1

create directory to mount to

Code: Select all

mkdir /mnt/backup 
now mount the ntfs partition to /mnt/backup

Code: Select all

mount ntfs /dev/sdb1 /mnt/backup 
in rescuezilla you can open testdisk by going to:
Click start button > Options > file recovery (undelete)

in testdisk, select the disk you need (file size should be about 128/119 GB for surface laptop 1st gen)

select the partition type you want to look for (strangely in this case it seems to be EFT even though it's windows, I assume it's because of bitlocker or something).
select advanced
you should see a list of partitions and one partition that has way more data than the rest. This is the one you want to make an image of. (mine was called 'ms data')

Select the partition with all the data and choose 'image creation'

browse to /mnt/backup (or where ever you mounted your external drive) then press 'C' to select that location to save the image.dd to.

Now you just wait for a bit for the image to finish.

When the image is finished, I suggest just attempting to mount the image to see if it has bitlocker enabled or not.

to mount the image:

first create a directory to mount to

Code: Select all

mkdir /mnt/image 
Now mount the image

Code: Select all

mount -o loop /mnt/backup/image.dd /mnt/image   
at this point it's either going to mount and you can just view the files, OR you will get a message about "unrecognized file system bitlocker" like I did and Smith0 did.
If you get the bitlocker message, you are going to have to log into your windows account and hopefully you will find your bitlocker key when you sign into your microsoft account and go to http://windows.microsoft.com/recoverykey

If you have your bitlocker recovery key, you can use dislocker to unencrypt the image in linux, then you will be able to copy all the data out of it. If you don't have your bitlocker recovery key, I am not sure how you could get into it.

Install dislocker

Code: Select all

apt-get install dislocker
These next steps I got a lot of help with dislocker from this tutorial.
https://dfir-dave.blogspot.com/2016/09/ ... image.html

Mount the Image
Create a temp directory where you will mount the image.

Code: Select all

mkdir /mnt/dislocker
Read the encrypted raw image using dislocker.

Code: Select all

dislocker -v -V /mnt/backup/image.dd -p<BITLOCKER-RECOVERY-KEY>  /mnt/dislocker
NOTE: there is no space between -p and the bitlocker recovery key, that's not a typo. And yes, you do want to incluse the dashes in the recovery key.

Code: Select all

mkdir /mnt/temp
Mount the dislocker file as read only to the /mnt/temp directory

Code: Select all

mount -o loop,ro /mnt/dislocker/dislocker-file /mnt/temp
At this point you can just open terminal and browse all the files that were locked behind bitlocker.
I just went in and coppied all the filed from the image onto the external drive.

Code: Select all

cp -r /mnt/temp /mnt/backup
Then once that copy finished, I took the drive out, plugged it into a windows machine and had full access to everything that was once lost.

Locked