Data missing from SSD

[mdownes]

Customer brought in a laptop which POSTs, but Windows won't start. The SSD (Crucial BX500) is accessible and the Crucial disk utility shows no problems. But, only the public profile is in c:\users\. - there's no sign of any user data anywhere else. Everything else looks normal from a files/folders point of view, although I took an image as a precaution.

To try locate his data (he should have a lot as he does video editing) I ran WinDirStat. This gives no clues, but it does report a total disk usage of only 74Gb. But in explorer, Disk properties show used space is 434Gb! That's quite a discrepancy.

Has anyone ever seen this situation before or have any ideas?

 

[lcoughey]

How did you image the ssd? You want to make sure you got a full sector-by-sector copy

 

[mattsnoddy]

Could be several things, from needing a CHKDSK to having been powered down while Bitlocker was in the middle of encrypting. Any chance there's another disk like an NVMe in the laptop and that's the no-boot culprit? Have you run a data recovery tool like GetDataBack against it to see what it reports?

GetDataBack — Data Recovery Software For Crashed Hard Drives

GetDataBack Data Recovery software. Recover data from inaccessible hard drives and USB sticks. Supports Windows NTFS, FAT, exFAT, Apple HFS+, APFS, and Linux EXT.

www.runtime.org

 

[NviGate Systems]

Don't run chkdsk unless you have a sector image. I've seen my share of drives suddenly show up as RAW, then you have more headaches.

 

[mdownes]

How did you image the ssd? You want to make sure you got a full sector-by-sector copy

Yes, I used macrium with the option for full sector-by-sector

 

[mdownes]

Could be several things, from needing a CHKDSK to having been powered down while Bitlocker was in the middle of encrypting. Any chance there's another disk like an NVMe in the laptop and that's the no-boot culprit? Have you run a data recovery tool like GetDataBack against it to see what it reports?

GetDataBack — Data Recovery Software For Crashed Hard Drives

GetDataBack Data Recovery software. Recover data from inaccessible hard drives and USB sticks. Supports Windows NTFS, FAT, exFAT, Apple HFS+, APFS, and Linux EXT.

www.runtime.org

I ran R-Studio, which is a similar thing. It didn't find anything useful though.

 

[mdownes]

Mystery partially solved. I fired up Ubuntu just to see if it saw files that Windows didn't. I found what looks like his profile under c:\found.000\dir0001.chk - right folders, right data size. In fairness to windows, I can't be sure it wasn't shown and I just didn't spot it. Now copying it all from there to a USB disk.

This suggests, to me at least, windows detected a disk issue at boot time, offered to run chkdsk, customer agreed, it moved his stuff into c:\found.000 and it then, of course, wouldn't boot. What I'm now wondering is - event though this SSD passes the manufacturer's tests, is this disk to be trusted? My gut says "no", buy my customer's wallet may say "yes".

 

[mattsnoddy]

What I'm now wondering is - event though this SSD passes the manufacturer's tests, is this disk to be trusted? My gut says "no", buy my customer's wallet may say "yes".

There's a small chance that it was another hardware issue (particularly the disk controller) or something happened with the OS where it was writing something to the disk and just screwed up majorly, but odds are the SSD is the culprit IMO. There's been other threads on here about SSD self-tests coming back as good, when the drive was clearly malfunctioning.

 

[lcoughey]

Mystery partially solved. I fired up Ubuntu just to see if it saw files that Windows didn't. I found what looks like his profile under c:\found.000\dir0001.chk - right folders, right data size. In fairness to windows, I can't be sure it wasn't shown and I just didn't spot it. Now copying it all from there to a USB disk.

This suggests, to me at least, windows detected a disk issue at boot time, offered to run chkdsk, customer agreed, it moved his stuff into c:\found.000 and it then, of course, wouldn't boot. What I'm now wondering is - event though this SSD passes the manufacturer's tests, is this disk to be trusted? My gut says "no", buy my customer's wallet may say "yes".

Exactly why chkdsk should never be run without a full sector-by-sector clone. I wish Microsoft would delete the program from existence.

 

[300DDR]

UFS explorer has a new feature to parse recognized file extensions from files in the Found folders. But, there are other options.