Help, Please Help, lost Partitions.

[Lei]

Does bitlocker show you something like this:

 

[YahyaMegahed]

Does bitlocker show you something like this:

No,
Because the hard drive partitions aren't showing under Bitlocker encrypted partitions,
Only under disk management the hard disk shows up as a whole unallocated space and i have no access to it or its lost partitions whatsoever.

 

[SPDIF]

On a healthy HDD or SSD Bitlocker encrypted drive, partitions are visible. You just can't read anything as everything is encrypted by Bitlocker.

No idea what happened here, but if it is showing unallocated space, then the partition has been erased, with is a bad sign. I have never seen this happen in 35+ years with customers.
We don't know what happened exactly, it's difficult. Maybe TS had already played around with some program and erased the partition by mistake. I just can't believe it changed by itself to an unallocated space by switching the computer off and on. Do you use Bitlocker with an TPM? Did you reset the TPM in bios? Did you try to reinstall Windows and erased by mistake the partition? I think that is what happened, you had no rescue key for Bitlocker and did try to reinstall Windows by mistake.

 

[Lei]

Do you have the bitlocker recovery key?

 

[SPDIF]

I just did try it out and take a screenshot. I encrypted the drive with Bitlocker and then connected this drive to an external usb case. As you can see, partitions are visible.

When you want to see the files, you get this screen;

If you know the recovery key, you can make the files visible easy like this;

 

[YahyaMegahed]

On a healthy HDD or SSD Bitlocker encrypted drive, partitions are visible. You just can't read anything as everything is encrypted by Bitlocker.

No idea what happened here, but if it is showing unallocated space, then the partition has been erased, with is a bad sign. I have never seen this happen in 35+ years with customers.
We don't know what happened exactly, it's difficult. Maybe TS had already played around with some program and erased the partition by mistake. I just can't believe it changed by itself to an unallocated space by switching the computer off and on. Do you use Bitlocker with an TPM? Did you reset the TPM in bios? Did you try to reinstall Windows and erased by mistake the partition? I think that is what happened, you had no rescue key for Bitlocker and did try to reinstall Windows by mistake.

Most probably, partitions were deleted by mistake and most probably because of one of the applications i used despite the fact MB has integrated TPM module which i turned it on monthes ago and was working fine.

 

[SPDIF]

If you reset TPM in bios, Bitlocker will also ask you the Recovery key to decrypt at Boot time.
Did you store this recovery key on a safe place, and do you still have this key?

 

[YahyaMegahed]

If you reset TPM in bios, Bitlocker will also ask you the Recovery key to decrypt at Boot time.
Did you store this recovery key on a safe place, and do you still have this key?

I have the key safely saved " the way long key and password".

But reset TPM means disable it?

 

[SPDIF]

No not disabled, but you reset it's content's, and thus also the Master key from the TPM. Then windows can't find the key do decrypt your HDD in the TPM, and will ask you the recovery key.

But the most likely scenario as what happened here is that you deleted the partitions by mistake. Your data is still there on some places, encrypted by Bitlocker. But you first have to get back the old partition, without writing over a new partition. And that will be a REAL challenge...

Now you have an unallocated space like a new disk, so here some data has been written over already.

 

[YahyaMegahed]

No not disabled, but you reset it's content's, and thus also the Master key from the TPM. Then windows can't find the key do decrypt your HDD in the TPM, and will ask you the recovery key.

From the quick look at the BIOS,
It was either Enable or Disable,
But it may be located anywhere in BIOS,
I'll have to check that.

 

[SPDIF]

Only a program that search files on sector level can maybe find data back, but the problem is that these files are not accessible due to encryption by Bitlocker.

 

[YahyaMegahed]

But the most likely scenario as what happened here is that you deleted the partitions by mistake. Your data is still there on some places, encrypted by Bitlocker. But you first have to get back the old partition, without writing over a new partition. And that will be a REAL challenge...

Well, i guess that scenario is the closest to reality,
However how could i take on that REAL challenge?

Also that unallocated space would be a result from deleting the partitions so i guess there wouldn't be lost data, Hopefully.

 

[Lei]

Can you get your partition back?

How to Recover Deleted or Lost Partition in Windows 10

You can run lost partition recovery within 4 steps with EaseUS. Partition Recovery Wizard in EaseUS Partition Master can recover deleted or lost partition in Windows XP/Vista/7/8/8.1/10 and Windows Server 2003/2008/2012.

www.easeus.com

 

[YahyaMegahed]

Can you get your partition back?

How to Recover Deleted or Lost Partition in Windows 10

You can run lost partition recovery within 4 steps with EaseUS. Partition Recovery Wizard in EaseUS Partition Master can recover deleted or lost partition in Windows XP/Vista/7/8/8.1/10 and Windows Server 2003/2008/2012.

www.easeus.com

I tried this, the "Quick Scan" took 2 days and found nothing as the driver is encrypted.

 

[Lei]

Can you assign a drive letter to that unallocated space?

 

[YahyaMegahed]

Can you assign a drive letter to that unallocated space?

No,
The only available option is "New Volume",
And quite frankly i thought about it
(Create one partition with the whole available space then try to assign a letter or recover or whatsoever) but i got scared, felt it like a highly risky nuclear option.

 

[SPDIF]

That's what i said, don't make a new partition at any way. Then you can kiss the data goodbye, make an backup from that disk like i told before. Then you can try anything without losing something. Once you find a solution, you can do it REAL time on your HDD, and have maybe everything back. With a backup you can try anything you want, without the risk of losing data.

 

[YahyaMegahed]

That's what i said, don't make a new partition at any way. Then you can kiss the data goodbye, make an backup from that disk like i told before. Then you can try anything without losing something. Once you find a solution, you can do it REAL time on your HDD, and have maybe everything back. With a backup you can try anything you want, without the risk of losing data.

Is it possible to backup this disk? Using which software?
And to what disk?, i don't have another 4 TB HDD.

 

[Lei]

Let me grab a beer to ponder and render a verdict.

You need a program to clone your unallocated space sector by sector, then do experiments on the duplicate.

And to what disk?, i don't have another 4 TB HDD.

Even if you can't recover your data, you do must have a separate drive for backup at all times.
A risky second hand hdd, is better than having all your eggs in one basket.
Go get a chia farmer's drive.

 

[SPDIF]

Is it possible to backup this disk? Using which software?
And to what disk?, i don't have another 4 TB HDD.

Let me grab another second beer to ponder and render a verdict.

WD 5TB Elements Portable HDD, External Hard Drive, USB 3.0 for PC & Mac, Plug and Play Ready - WDBU6Y0050BBK-WESN​

-20% $103.99

That should do the trick!
Generally, a sector-by-sector clone makes no difference to a normal backup. But if your data is of vital importance, and you want to make sure that even if the hard drive has a bad sector, you can still recover data from the bad sector, then you can choose this clone mode.

 

[YahyaMegahed]

I think i may have found a way to recover these partitions even encrypted using a bootable "WinPE" version of "EaseUs Partition Master" and despite the very slow full scan it seems very promising,
As it's a bootable Version, i'm unable to take a screenshot but i'll keep you updated with the outcome.

 

[DrCR]

TLDR, admittedly, but I’ve sufficiently recovered partitions iirc more than once via testdisk e.g. via SystemRescueCD. That was MBR era though. Ymmv. Partition table backups is something I more commonly do now… when I’m responsible.

rsnapshot is your friend btw. Not sure best current-era option for WinOS — perhaps Malcrium Reflect or sibling product.

 

[YahyaMegahed]

Sorry for low quality, phone camera,

The program did find one partition "Software" in the allocated space and that was obsolete one but has the status "Lost" with good recoverability.

A second partition was found with no label and File System "Other" with a capacity equal to the lost Partitions but it has the status "Existing" but with no recoverability estimation.

When i select the first partition the program activate the "Recover" button at the right buttom and if double click the partition the program explores its files which are again few and obsolete.

The second partition however, has nothing to explore and when selected the "Recover" button is gryed out.

 

[SPDIF]

Clearly we have a BIG problem here. On one side EUS does see data is available on the partition from almost 4TB, but as i showed earlier a partition encrypted by Bitlocker is in-accessible. On the other side, Bitlocker can't unlock this drive anymore because the partition is lost and overwritten. Hence EUS can't see any files and can't rescue them because it is encrypted. Make a new partition does not help here, you only make it worse by overwrite it again...

I am baffled at moment... The Bitlocker encrypted partition has clearly been overwritten already... Never seen this before, you are locked behind walls and can't escape. There cold be a solution for this, but at the moment i really have no time left to break my head into this.

It's terribly busy in the store these days and I'm writing this in the night just before I go to bed. I can't promise anything, but I'll look into this further when I have more time. I have to wake up at 4 am this morning.

The goal here is to pinpoint the critical parameters of the damaged, overwritten, or deleted partition to display its contents and recover files. This approach can be viable when physical data recovery isn't possible. (e.g., when the partition boot sector is dead)

The approach is commonly used by dedicated partition recovery software; implementing it manually is cumbersome and challenging, even for seasoned users.
Sometimes, a partition can seem deleted due to a lost partition name, volume label, or drive letter. If you think that's the case, you can try restoring a lost partition via the Command Prompt. To do so, follow the steps below.


Important note: It's best to back up all from the HDD before attempting CMD commands to prevent further data loss.

1. Type "CMD" in the Windows Search Box
2. Right-click the "Command Prompt" app and select "Run as administrator"
3. Type in the following command: chkdsk X: /f/r/x (replace "X" with the drive letter of the corrupted partition) -> press "Enter"

If CMD commands don't work, you can use software packing professional data recovery capabilities, such as Acronis Disk Director, as i use in the shop here. But it's not FREE software...

 

[Jacky_BEL]

I would suggest TestDisk by Christophe Grenier for recovery of lost partitions.

I had success with this tool , but first read on how to use it , since it has a non-grafical user interface.

And be sure you know all the partitions you are looking for on your HDD , because it can find partition structures from before the last one that was in use.

Very powerful tool , but you need to get well acquainted with how to use it, so beware.