0

Windows 11, bitlocked C:\ Drive (I have the bitlocker key and can unencrypt drive). Onedrive installed, synced to my Docs folder but not signed in to OneDrive account (never signed in). Uninstalled one drive. C:\Users\myaccount\OneDrive\Docs folder Shift+deleted to free up space. C:\Users\myaccount\Docs is now empty!

I have a the bitlocker key, and I can still load into Windows, so I have the option to unecrypt the drive.

I own OnTrack EasyRecovery, so I can perform a recovery with this.

I attempted to recover the deleted files from the original OneDrive folder. OnTrack found them and prompted for the key, and it then proceeded to recover them (to my D:\ Drive). However, most of the files cannot be read (jpg's, PDF, zip's etc). Plain notepad text files and some smaller image files (icon's gif's mainly seem OK.

I restored within an hour of deletion and the disk has had nothing significant written to it in the meantime, so I should get something, but in 70GB of files, almost nothing.

Should I have attempted recovery on the C:\Users\myaccount\docs folder instead? Is this related to Bitlocker, is it related to One Drive encryption or something else. Should I unencrypt the drive and THEN run OnTrack.

I'm lost as to what the best way to do this is.

3
  • 1
    My guess would be that Bitlocker is aware of unused blocks - and would not decrypt what it deems unused space, and thus would land you with destruction of data.
    – vidarlo
    Commented Aug 11, 2023 at 15:59
  • As @vidarlo says, bitlocker is aware of NTFS structures. OnTrack would had needed to take that into account. The fact that small files are ok but larger ones are not make me think it only worked on files that were on several clusters. I would recommend asking the vendor. You will probably need either a better software or a professional doing this for you.
    – Ángel
    Commented Aug 12, 2023 at 13:58
  • And stop powering on the computer. SSD's don't only destroy data when it's overwritten; they are actively trimming data when the operating system is running. Recovery on a encrypted SSD with discard/trim is what I'd consider nightmare scenario.
    – vidarlo
    Commented Aug 12, 2023 at 16:12

1 Answer 1

0

Looks like SSD Trim was the culprit here. No chance of recovery for anything larger than a small text file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .