cgsecurity.org

I finally managed to get testdisk to fully analyze my failed 2T SSD (2 days). The program didn't recover the main bulk of the MS Data partition, so I had to create a partition to the available size ~ 2T.

The SSD was from a Windows 11 system with the standard partition profiling.

After using photorec, It had found two significantly sized files with the .diskimage extension and several significantly large files with the .swf extension (among several other small files). I'm thinking these file contain the information I'm looking for, but they're just bulk data files from what I can see.

I'm thinking these could be compressed/secured W11 log-in files. Is there any way to access these files to retrieve the data. I know the system login information, but I can't find out any relevant details about these files.

asandige wrote: 01 May 2025, 14:03 I finally managed to get testdisk to fully analyze my failed 2T SSD (2 days). The program didn't recover the main bulk of the MS Data partition, so I had to create a partition to the

Creating a partition on the defective disk means destroying data.

available size ~ 2T.

The SSD was from a Windows 11 system with the standard partition profiling.

After using photorec, It had found two significantly sized files with the .diskimage extension and several significantly large files with the .swf extension (among several other small files). I'm thinking these file contain the information I'm looking for, but they're just bulk data files from what I can see.

I'm thinking these could be compressed/secured W11 log-in files. Is there any way to access these files to retrieve the data. I know the system login information, but I can't find out any relevant details about these files.

I have no idea. You did not provide a proper case description.

Unfortunately, I had no other options left that to create the partition; though I didn't initialize it. Testdisk couldn't recover any of that partition's details and nothing was able to see it.

I'm not sure what more I can say about it. I used Testdisk to allocate the partition to the max available space. I then ran photorec on the new partition and it was able to find some files, but they just appear to be data like f1688938218.diskimage which is roughly 9.4G, and f1088199450.diskimage at almost 18G. There are several .swf files, generally around 1 to 4 G in size. All totaled, the files from that partition are about 53G, which could potentially be a lot of data.

I know that Windows requires me to securely log into a drive to see the contents when it is inserted into another system. This implies that the data is perhaps located in one or more large files that are protected from examination without the sign-on details.

Is there anything else I can offer?

asandige wrote: 01 May 2025, 16:16 Unfortunately, I had no other options left that to create the partition; though I didn't initialize it.

Photorec doesn't require you to overwrite your data.

Testdisk couldn't recover any of that partition's details and nothing was able to see it.

I know that Windows requires me to securely log into a drive to see the contents when it is inserted into another system.

This might be a new feature I am not aware of.
The TestDisk package requires unencrypted data - obviously.

Windows can be pretty uptight about security. If you take a boot drive from one system and try to access it on a system with a different profile, you need to log in to the new drive to access it; at least this is what I've been running in to. So, at this point it looks pretty much impossible since windows won't recognize the file system.