cgsecurity.org

Hi,
So I've spent the past two-three weeks now struggling to recover my SSD. Most of that time with TestDisk and scouring these forums and the internet at large.
Backstory: One day, my pc froze. I had no choice but to shut it down from the button. When I turned it back on, it booted to a windows blue screen with the error message: Unmountable boot volume.

I tried different things like chkdsk etc, eventually leading me to test disk since other things failed. I took screenshots all along the way btw of each different kind of error message of which there were several.

The first time launching test disk, I was pleased to see my partition after analyzing the disk! I tried to copy my files but it only copied around 60-700 (I cant remember exactly but this was out of like a hundred thousand or more). I wasn't sure what to do next so for some reason, I decided to try photorec to see if I could retrieve the files that way. Good news...yes, for the past several weeks, I've been slowly recovering files through photorec...but for some reason, it goes only 3% a day. But it is recovering them...but it is almost a complete waste of time given that the files are completely unorganized and unnamed. Most of the files (like programs) aren't even needed so I can't easily see what I want to delete or not. Suffice to say...I'm going through with this recovery since it has been the only consistent way to retrieve files.

I tried launching testdisk AGAIN while this has been happening and did another analyze and copy, of which I was able to recover 30,000 the next time and then it failed. I have no clue why sometimes it can recover more or less. It seems that all the files are intact but there is something wrong along the way.

I want to post log files but I don't know where they are stored.

TestDisk only showed me the partition the first two times. Now when I try to analyze, it shows there

It's important to note that after the crash and initial restart, I discovered the drive and been identified as RAW. It is the C drive and has Windows 11 installed on it as the OS (I have 7 other drives as well, only 5 others are connected to the pc at the moment. So 6 total with the damaged drive.). Now I had put a blank 4tb ssd to install windows again to so that I could attempt recovery of the original drive with the aim of making it back to normal without the need to reinstall EVERYTHING over again.

So right now, if I startup testdisk and create a log file, it shows:
<--->
Select a media and choose 'Proceed' using arrow keys:
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - CT4000MX500SSD1
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - SanDisk SDSSDH32000G
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CT2000MX500SSD1
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CT2000MX500SSD1
Disk \\.\PhysicalDrive4 - 2000 GB / 1863 GiB - CT2000MX500SSD1
Disk \\.\PhysicalDrive5 - 15 GB / 14 GiB - KDI-MSFT Windows 10
>Drive I: - 1999 GB / 1861 GiB - WDC WDS2 00T2B0B
<--->
Drive I is the drive in question. It is an M.2 (the others are all 2.5/SATA). I select proceed.
<--->
Drive I: - 1999 GB / 1861 GiB - WDC WDS2 00T2B0B
Please select the partition table type, press Enter when done.
[Intel ] Intel/PC partition
[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
[Humax ] Humax partition table
[Mac ] Apple partition map (legacy)
>[None ] Non partitioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.
<--->

The first couple times, it had correctly selected EFI GPT as the "default" option to proceed with. Now it shows "None" for some reason. I select EFI GPT and press enter. And then I choose Analyse and hit enter.

The first two times, it showed partitions here. Now it doesn't show anything.

<--->
Drive I: - 1999 GB / 1861 GiB - CHS 3904690153 1 1
Current partition structure:
Partition Start End Size in sectors
Trying alternate GPT
<--->

I select quick search and hit enter.
I can't remember if the first times I did this that I got read errors or not...I thought I didn't but suffice to say, I am getting read errors as the search commences. There are many so it's impossible to even screenshot them all or whatever...not sure but Im guess it's irrelevant anyway.
When it's done with this, it presents "boot sector...ntfs_boot_sector: can't read boot sector. Status: Bad." for both booth sector and backup boot sector. "Sectors are identical." If I choose rebuild BS I think it just loops around.

…

So this is where I am right now. I also mistaken put the M.2 in an enclosure to be reading this as I tried to plug it into a Linux based pc but I realized then it would be better to just install windows again on a new SSD and do this all on the original pc. I would stop the photorec recovery now to put the M.2 back on the motherboard but it's moving slowly at 21% and I don't want to risk pressing "quit" and then coming back to find there is no way to recover the files at all, even in this really poor way I'm doing it at the moment.
I'd appreciate any advice or tips and if it is actually safe to quit photorec, unplug the m.2 enclosure and put it back on the motherboard as I think that would speed a lot of this up?

Please let me know and also how I can find and post the logs and whatever other info I need to share! Thank you so much!

tari

tariqari wrote: 25 Apr 2023, 02:56 Hi,
So I've spent the past two-three weeks now struggling to recover my SSD. Most of that time with TestDisk and scouring these forums and the internet at large.
Backstory: One day, my pc froze. I had no choice but to shut it down from the button. When I turned it back on, it booted to a windows blue screen with the error message: Unmountable boot volume.

I tried different things like chkdsk etc, eventually leading me to test disk since other things failed.

Did you mean "test the disk" or are you referring to the Testdisk software? The statement "other things failed" opens questions instead of answering them.

I took screenshots all along the way btw of each different kind of error message of which there were several.

If you take screenshots, talk about them and don't provide them by uploading them to this forum how useful is that?

The first time launching test disk,

Testdisk!

I was pleased to see my partition after analyzing the disk! I tried to copy my files but it only copied around 60-700 (I cant remember exactly but this was out of like a hundred thousand or more). I wasn't sure what to do next so for some reason, I decided to try photorec to see if I could retrieve the files that way. Good news...yes, for the past several weeks, I've been slowly recovering files through photorec...but for some reason, it goes only 3% a day.

That speed appears low and an can be caused by unreadable sectors. When in doubt, duplicate your drive using ddrescue as described in the manual.

But it is recovering them...but it is almost a complete waste of time given that the files are completely unorganized and unnamed.

Read the manual. Photorec is the last line of defense to be used when everything else fails or you can't afford to buy a commercial recovery software that will try to evaluate the remains of metadata like folder structure and file names.

Most of the files (like programs) aren't even needed so I can't easily see what I want to delete or not. Suffice to say...I'm going through with this recovery since it has been the only consistent way to retrieve files.

I tried launching testdisk AGAIN

while this has been happening and did another analyze and copy, of which I was able to recover 30,000 the next time and then it failed. I have no clue why sometimes it can recover more or less.

You are most likely dealing with a defective disk or any unstable setup.

It seems that all the files are intact but there is something wrong along the way.

I don't understand what you mean.

I want to post log files but I don't know where they are stored.

The logfile named testdisk.log is stored in the Testdisk folder.

TestDisk only showed me the partition the first two times. Now when I try to analyze, it shows there

???

It's important to note that after the crash and initial restart, I discovered the drive and been identified as RAW. It is the C drive and has Windows 11 installed on it as the OS (I have 7 other drives as well, only 5 others are connected to the pc at the moment. So 6 total with the damaged drive.). Now I had put a blank 4tb ssd to install windows again to so that I could attempt recovery of the original drive with the aim of making it back to normal without the need to reinstall EVERYTHING over again.

Use the repair installation mode of your operating system installation media for repairs. In case of the need to recover user data, do that recovery first or duplicate the defective drive.

So right now, if I startup testdisk and create a log file, it shows:
<--->
Select a media and choose 'Proceed' using arrow keys:
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - CT4000MX500SSD1
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - SanDisk SDSSDH32000G
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CT2000MX500SSD1
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CT2000MX500SSD1
Disk \\.\PhysicalDrive4 - 2000 GB / 1863 GiB - CT2000MX500SSD1
Disk \\.\PhysicalDrive5 - 15 GB / 14 GiB - KDI-MSFT Windows 10
>Drive I: - 1999 GB / 1861 GiB - WDC WDS2 00T2B0B
<--->
Drive I is the drive in question. It is an M.2 (the others are all 2.5/SATA). I select proceed.
<--->
Drive I: - 1999 GB / 1861 GiB - WDC WDS2 00T2B0B
Please select the partition table type, press Enter when done.
[Intel ] Intel/PC partition
[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
[Humax ] Humax partition table
[Mac ] Apple partition map (legacy)
>[None ] Non partitioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.
<--->

The first couple times, it had correctly selected EFI GPT as the "default" option to proceed with. Now it shows "None" for some reason. I select EFI GPT and press enter. And then I choose Analyse and hit enter.

The first two times, it showed partitions here. Now it doesn't show anything.


<--->
Drive I: - 1999 GB / 1861 GiB - CHS 3904690153 1 1
Current partition structure:
Partition Start End Size in sectors
Trying alternate GPT
<--->

I am confused. I guess should select the disk instead of what you call "drive". A disk is partitioned into partitions that are as well called volumes. Disks usually contain a partition table, single partitions or a partition/volume like your I-Drive does not.

I select quick search and hit enter.
I can't remember if the first times I did this that I got read errors or not...I thought I didn't but suffice to say, I am getting read errors as the search commences. There are many so it's impossible to even screenshot them all or whatever...not sure but Im guess it's irrelevant anyway.
When it's done with this, it presents "boot sector...ntfs_boot_sector: can't read boot sector. Status: Bad." for both booth sector and backup boot sector. "Sectors are identical." If I choose rebuild BS I think it just loops around.

…

So this is where I am right now. I also mistaken put the M.2 in an enclosure to be reading this as I tried to plug it into a Linux based pc but I realized then it would be better to just install windows again on a new SSD and do this all on the original pc.

No. For recovery and duplication putting a M.2 device into an external exclosure is perfectly OK. A direct mainboard connection may be necessary to read out SMART-like diagnostics. I can't tell for sure as I am lacking the experience here.

I would stop the photorec recovery now to put the M.2 back on the motherboard but it's moving slowly at 21% and I don't want to risk pressing "quit" and then coming back to find there is no way to recover the files at all, even in this really poor way I'm doing it at the moment.
I'd appreciate any advice or tips and if it is actually safe to quit photorec, unplug the m.2 enclosure and put it back on the motherboard as I think that would speed a lot of this up?

Photorec keeps track of the recovery process in a file labeled photorec.ses. If this file exists Photorec will ask you if it should continue with an old recovery instead of starting a new one.

Hints:
Do not be lazy. Even after missing that cgsecurity.org contains lots of information quickly cross-reading the forum could have already given you some answers.

Read the manual, read
https://www.cgsecurity.org/wiki/TestDisk
Read
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

When doing data recovery use a seggregated environment if possible.
There is no use in having all the other disks connected. Furthermore it blows up the logfile with unnecessary and private information.

That applies especially for your intended Windows reinstallation.

Is it typical for you to be hostile, disrespectful and rude to new members?

Instead of telling me to read a manual, maybe you should first learn some manners and basic social skills. I’ll choose a different program and methods to solve my issues.