Can't see files on Win 8.1 boot disk when installed via USB.

[cbsnyder87]

Hello all,

Recently I had a client contact me because her desktop will not boot to Windows (BSOD error). Windows attempted self-repair did nothing, system restore does not work, and she can't access files. PC is still under warranty with HP, but they recommended her to pull her data off the drive before sending the PC in for repair because most likely they will loose all her data (because they're just going to wipe her drive and start over I'm guessing).

So long story short, I connected the drive (1TB WD) via USB to another PC and the drive works fine, however, there are no files shown on the drive whatsoever other than an empty Windows folder and a couple others with only unintelligible numbers and letters (I.e., a897d902709270a) for the folder name, with no data in them. My first hunch was that the data was encrypted (Win 8.1 Pro does this by default nowdays), so I thought I'd give Recuva a shot and see what happens.

Did a sector-by-sector copy to external HDD, then ran Recuva. 7 hours later there are tons of pictures and videos recovered.

Here's my main question: How is it that the files don't show when double-clicking the drive, but they are there (undeleted, I should mention, according to Recuva) and visible through Recuva?

If the data was encrypted then Recuva should not have been able to find anything, no? What then would be the point of encryption, lol?

Secondary Question: The total data recovered by Recuva is showing 1.8 TB...the drive is only 1TB to begin with, with only 200 GB used. After recovering the data to a folder I noticed many pictures duplicated thousands of times as well as videos.

What gives?

P.S. - All permissions are granted for using the drive on the security tab.

Thanks in advance!

 

[lcoughey]

My best guess is that the client started a clean restore of the system, but did not complete it.

 

[cbsnyder87]

My best guess is that the client started a clean restore of the system, but did not complete it.

I had considered that, but I was wondering why Recuva shows many of the files as undeleted? Or is it perhaps that a partial system recovery would have only had time to erase the OS directories and file structures, but not the files themselves?

 

[lcoughey]

1. Recuva is a very cheap data recovery program
2. A system recovery does not erase files. It just creates a new file system and overwrites data as new files are stored on the new volume

 

[FremontPC]

Hmm. What was the OS on the machine you slaved the drive to and if you bring up Disk Management, does it ID the drive/partition as Bitlocker Encrypted?

 

[cbsnyder87]

Hmm. What was the OS on the machine you slaved the drive to and if you bring up Disk Management, does it ID the drive/partition as Bitlocker Encrypted?

Good questions. OS = Win 8.1 Pro (also tried on Win 7 with same results). See screenshot for Disk Management results (no BitLocker).

 

[cbsnyder87]

1. Recuva is a very cheap data recovery program
2. A system recovery does not erase files. It just creates a new file system and overwrites data as new files are stored on the new volume

1) Which programs do you recommend?
2) You are correct, I misspoke. I guess my mind equates erase with overwrite, although in data recovery the terms have very important differences in their meaning.

 

[cbsnyder87]

Here's what you get when you open the drive....

 

[FremontPC]

My best guess is that the client started a clean restore of the system, but did not complete it.

As in someone tried a "Refresh", but shut the system down partway through?

 

[lcoughey]

As in someone tried a "Refresh", but shut the system down partway through?

Yup

 

[Markverhyden]

Looks like an interrupted recovery to me as well. Never used Recuva but it sounds like it did a block search based on filetypes. This type of search will usually yield way more data than what is really on the drive. Why it says "undeleted"? From what I remember there is no "deleted" bit set on file header/metadata. It's location is just removed from the allocation table. I'd guess that if Recuva cannot see file name in the FAT it thinks it got deleted.

If you want a great program for this type of work buy R-Studio's R-Tools.