cgsecurity.org

Hello community,

I've been reading in your forum since last thursday, when my Surface Laptop (1st Gen) crashed and then showed "Couldn't find a bootable operating system".
So far I've tried the recommendations by Microsoft up until the point where they tell you to use the rescue drive as this would delete my precious files.

So what I did thus far to try to recover them:
I created a bootable windows stick and tried to access the ssd from there - no luck
I created a bootable ​Linux stick and tried to access the data from there - no luck
I tried to check for the partitions - again, no luck

I used ddrescue to create an image of the whole drive to an external ssd with enough space (>300gb free) which seemed to work perfectly with just a teeny tiny bit of data lost - what I thought would be the reason why it can't boot:
https://ibb.co/JqZKm7Q

However, as you can see: parted had a problem with an "unrecognized disk label"

So what I did next was downloading testdisk to see what I can find. I started with a run on the Intel partition althought it showed me EFI as I was following a video tutorial. It ended up only showing 2 partitions with a huge gap in the middle.

In the next run I tried EFI and right after I click analyse I can see all those partitions:
https://ibb.co/7jjFCsg

I tried to mount the img with an offset of 796672*512 but it said it "unknown filesystem bitlocker" - although I can't remember ever activating it or something like that

So I run quick search and the result is:
https://ibb.co/fp6nszF

I can't see any of my data with "p" so I continue with a deep search.
During the search the first error pops up:
https://ibb.co/G5NP8F9

Which is followed (after a while) by:
https://ibb.co/sjtG2Zw

I hit enter and the result of the deep search at the end is:
https://ibb.co/pzzk7bh

Again no data to be found.

My last hope was to go the advanced option and there I was able to see this:
https://ibb.co/qndZ6pT

Which - to me - seems like the most likely partitiong of the drive. However, the options with Backup etc. are not there!

You are my last hope to save all my uni files and I promise, if I'll get them back I'll start doing 2 backups of everything.

Thank you very much in advance and best regards
Nick

PS: I am working full time so please don't feel neglected if I am not able to answer within 24hours

Please upload your pictures to this site.
I can't see any.

Good morning and thank you very much for the fast reply!

I re-tried with deleting the img tags. It seems to work now?
I don't get what went wrong there as I followed the FAQ on how to insert a picture..

Use the attachment tab on the bottom of the page to upload pictures when responding.

Picture 1: Results from ddrescue and parted Picture 2: Partitions shown after Analyse Picture 3: Results Quick Search I can only upload 3 at a time? Sorry..

Picture 4: Error1_Bad jump in FAT partition Picture 5: Error2_Partition cant be rescued Picture 6: Results Deep Search

Picture 7: Partitions shown after Advanced I hope this was right now..
Again, sorry

Leave the advanced menu.
Try to list the content of the partition in question using the "p"-key.
If that fails, use Photorec or any other commercial recovery software.

Hello,

I just wanted to share the news, that I was able to save my data with a different method! I hope my solution can help others, too.

Disclaimer: I did not try PhotoRec or any other software, so it might work aswell!

I was not able to view any files within desktisk. However, as mentioned above I was able to see the partitions in the advanced tab.
I created an image of the partition I thought my data was on and then tried to directly mount the image via linux command line. The same error occured as last time "unknown filesystem bitlocker". However, as I was no longer working with an offset parameter I was able to download and use "Dislocker".

Looking into my Microsoft Account I was able to get the BitLocker Recovery Key and then decrypt the partition and mount it.
Afterwards I could just copy all needed files to an external disk.

I hope this is of some use for others and thanks again for this great tool!

First of all, I just want to say than you very much for Smith0! Without this post, I would not have figured out how to recover data from this laptop.
I am not an everyday linux user, and was unfamilliar with some of the things mentioned above in this post.

I thought it might be helpful if I made a step by step of how I recovered data from this device. I assume Smith0's process was nearly identical, but I had to do a lot of googling on how to do some specific things, and hopefully this post will save someone else in my situation some time.

This is what worked for recovering data from a Microsoft Surface Laptop Gen 1 Model 1769

Required parts for recovery:
USB hub because you will probably need more that 1 usb port (preferably USB 3.0, otherwise this is going to take a long time for you)
External HDD/SSD (500GB or bigger recomended so you can create image and then copy files from the image onto the same drive.)
USB Flash Drive (for linux distro)
USB Keyboard (some/most linux distros won't recognise the keyboard on this laptop)

Choose a linux dirsto that you want to use to recover the data. I used rescuezilla as it already had everything I needed pre installed (other than dislocker)and I'm somewhat familiar with it.
Rescuezilla will also give you an option to load the distro to ram (very usefull if your USB hub is short on ports!). If you load it to ram, you can just unplug the flashdrive once you are done loading into the OS.

First you want to create a partition on the external drive you have plugged in and mount it (I formated my external SSD in gparted within rescuezilla. I formated it as NTFS so that once I am done, I can plug it into a windows machine and access files without hastle)

To mount external drive :
figure out what your external drive is called
Open terminal type
lsblk will list all the drives and their partitions, you should be able to identify the external drive based on disk size. In my case is said that the 500GB Drive was sdb and that the partition I made was sdb1, this means the drive i want to mount is /dev/sdb1

create directory to mount to
now mount the ntfs partition to /mnt/backup
in rescuezilla you can open testdisk by going to:
Click start button > Options > file recovery (undelete)

in testdisk, select the disk you need (file size should be about 128/119 GB for surface laptop 1st gen)

select the partition type you want to look for (strangely in this case it seems to be EFT even though it's windows, I assume it's because of bitlocker or something).
select advanced
you should see a list of partitions and one partition that has way more data than the rest. This is the one you want to make an image of. (mine was called 'ms data')

Select the partition with all the data and choose 'image creation'

browse to /mnt/backup (or where ever you mounted your external drive) then press 'C' to select that location to save the image.dd to.

Now you just wait for a bit for the image to finish.

When the image is finished, I suggest just attempting to mount the image to see if it has bitlocker enabled or not.

to mount the image:

first create a directory to mount to
Now mount the image
at this point it's either going to mount and you can just view the files, OR you will get a message about "unrecognized file system bitlocker" like I did and Smith0 did.
If you get the bitlocker message, you are going to have to log into your windows account and hopefully you will find your bitlocker key when you sign into your microsoft account and go to http://windows.microsoft.com/recoverykey

If you have your bitlocker recovery key, you can use dislocker to unencrypt the image in linux, then you will be able to copy all the data out of it. If you don't have your bitlocker recovery key, I am not sure how you could get into it.

Install dislocker
These next steps I got a lot of help with dislocker from this tutorial.
https://dfir-dave.blogspot.com/2016/09/ ... image.html

Mount the Image
Create a temp directory where you will mount the image.
Read the encrypted raw image using dislocker. NOTE: there is no space between -p and the bitlocker recovery key, that's not a typo. And yes, you do want to incluse the dashes in the recovery key.
Mount the dislocker file as read only to the /mnt/temp directory
At this point you can just open terminal and browse all the files that were locked behind bitlocker.
I just went in and coppied all the filed from the image onto the external drive.
Then once that copy finished, I took the drive out, plugged it into a windows machine and had full access to everything that was once lost.