cgsecurity.org

Good Day.

I have searched the posts, and have not found exactly what I am trying to have answered, so my hope is that someone can help. I have a system that had a 256GB SSD with Windows 11 Home, with BitLocker. I backed up files, or so I thought, some didn't copy evidently. I booted off a Win11 Build Key and deleted the partitions, and then recreated partitions so that I could reinstall Windows 11. I then realized that I had a 512GB SSD, so I stopped, and installed the 512GB SSD, and installed Windows 11. So, I have the old 256GB SSD, and I have run TestDisk on it in a drive bay attached via USB. I know that with BitLocker that Test disk does not fix encryption, and I don't need that, as I have the BitLocker key for this drive backed up. I just need to be able to restore the partition that had the OS on it, and then when I try to connect, and it prompts for the key I can enter it. I don't need to make it bootable, I just need to be able to restore the partition for the OS, and then copy 2 files off.

After running TestDisk, I have the following:
Disk \\.\PhysicalDrive2 - 256 GB / 238 GiB - CHS 31130 255 63
Partition Start End Size in sectors
>P MS Data 2048 206847 204800 [NO NAME]
D MS Data 239616 500117503 499877888
D MS Data 496277505 498194432 1916928
D MS Data 498194432 500111359 1916928
D MS Data 498309120 500113407 1804288
D MS Data 499093504 500115455 1021952

I believe that the one I want is the second row with a Start of 239616.
When I down arrow to select it, I get the following:
NTFS found using backup sector, blocksize=4096, 255 GB / 238 GiB

First, I need to know does this sound correct, and if so, then how do I proceed.

In reading the documentation, there I did not see anything pertaining to Windows 11, only up to Windows 8.

Sincerely,

Mark

PENNME wrote: 19 May 2024, 03:56 Good Day.

I have searched the posts, and have not found exactly what I am trying to have answered, so my hope is that someone can help. I have a system that had a 256GB SSD with Windows 11 Home, with BitLocker. I backed up files, or so I thought, some didn't copy evidently. I booted off a Win11 Build Key and deleted the partitions, and then recreated partitions so that I could reinstall Windows 11. I then realized that I had a 512GB SSD, so I stopped, and installed the 512GB SSD, and installed Windows 11. So, I have the old 256GB SSD, and I have run TestDisk on it in a drive bay attached via USB. I know that with BitLocker that Test disk does not fix encryption, and I don't need that, as I have the BitLocker key for this drive backed up. I just need to be able to restore the partition that had the OS on it, and then when I try to connect, and it prompts for the key I can enter it. I don't need to make it bootable, I just need to be able to restore the partition for the OS, and then copy 2 files off.

After running TestDisk, I have the following:
Disk \\.\PhysicalDrive2 - 256 GB / 238 GiB - CHS 31130 255 63
Partition Start End Size in sectors
>P MS Data 2048 206847 204800 [NO NAME]
D MS Data 239616 500117503 499877888
D MS Data 496277505 498194432 1916928
D MS Data 498194432 500111359 1916928
D MS Data 498309120 500113407 1804288
D MS Data 499093504 500115455 1021952

I believe that the one I want is the second row with a Start of 239616.
When I down arrow to select it, I get the following:
NTFS found using backup sector, blocksize=4096, 255 GB / 238 GiB

First, I need to know does this sound correct, and if so, then how do I proceed.

In reading the documentation, there I did not see anything pertaining to Windows 11, only up to Windows 8.

That is a lame excuse for not having read the documentation.
The documentation is as much specific for an operating system as the documentation for Microsoft Office is!
The documentation is typically specific with regards to on-disk structures such as partition tables types and file systems.
There is no need for an additional documentation for Windows 11.

Obviously you neither have read the manual nor the online documentation, because you would have otherwise found chapter 9
"RECOVERING DELETED PARTITION USING TESTDISK" in the manual and the same content online as well:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

As for the search results of TestDisk, it does not find partitions that have been encrypted using Bitlocker.
What you got are most likely false positives from your new creation of partitions.

Unfortunately you did not describe how far you went when creating new partitions.