What should you do if you delete one or more files from a laptop? What happens if you accidentally format the internal hard drive, or if an experimental OS ruins your Windows partition? How do you restore the system to full operation and get your files back? We’ll try to find out in this paper.
It’s All Different
Today’s notebooks are not like your typical laptop of five or ten years ago. We used to enjoy all-modular construction with easily accessible (and replaceable) parts, allowing the user to swap batteries, replace hard drives or increase RAM capacity without a sweat. This is not the case anymore. Mainstream manufacturers restrict access to internal hardware, while ultrabook manufacturers often make the battery and the hard drive buried deep inside the device.
Storage devices have come a long way, too. While many laptops are still using traditional hard drives in the 2.5” form factor, many new devices are equipped with SSHD or SSD drives, while ultra-thin models often come with SSD drives plugged into an M.2 port. You won’t be able to tell it’s a hard drive (or, actually, an SSD drive) by its looks unless you know what M.2 drives actually look like.
What makes things even worse from the data recovery standpoint is BitLocker encryption that is standard and activated by default on many midrange and higher laptops. If your partition was encrypted with BitLocker and you’ve overwritten parts of its data with an experimental OS, you may not be able to recover your files. Ubuntu is certainly nice to play with, and it’s also the number one reason for losing data stored on your main OS partitions, so be careful when you install it on your main working computer.
In case of severe problems such as formatted hard drives or unbootable Windows, we used to recommend taking the disk out and connecting it to another (working) PC or laptop, possibly through a USB port in a portable drive enclosure. Since there’s nearly no way for an ordinary user to take an M.2 drive out and connect it to another computer, and since many laptops are now sold without offering any user serviceable parts, we’ll have to explain how to boot from an external USB drive and run a data recovery tool to fix your unbootable disk.
Deleted files are the easiest to fix if your laptop is equipped with a hard drive. However, simply launching a Web browser, downloading a data recovery tool and installing it on your (only) hard drive is not the best course of action. It’s not even a good course of action. In fact, it’s pretty much the worst you can do, because even opening a Web page creates temporary files that are very likely to overwrite data you’re about to recover. Starting a download can also overwrite your deleted files, and installing a data recovery tool on the same disk you’re about to recover files from is worst ever.
What if you have a separate partition? Can you install a data recovery tool there? On traditional magnetic hard drives it’s not recommended unless the files you want to recover are stored on a partition that is specifically NOT a system volume and is NOT used to store temporary files created by your Web browser. In other words, you should only try that if your laptop uses a magnetic hard drive that has several partitions, and your files are not stored on the primary system partition.
If your laptop is equipped with an SSD drive (or eMMC storage), do not save anything onto that drive. Solid-state storage devices use remapping techniques that constantly reassign logical addresses to different physical blocks regardless of the volumes and partitions created on the drive. They do this for performance optimization and wear leveling. If you deleted files from an SSD or eMMC drive, just don’t write anything onto that physical device.
The correct course of action would be using a DIFFERENT COMPUTER to download a data recovery tool (e.g. File Recovery Software or NTFS Recovery Software) and installing the tool onto a USB flash drive. Download a portable version if available; if not, just install it onto a USB stick and hope it’ll work on the other system.
After installing a data recovery tool on a USB stick, insert that stick into the laptop and launch the data recovery tool from the flash drive. You may be prompted to enter your registration details once again; enter your product key to activate the tool. You’re all set and can start recovering files.
Attempting Windows Repair
If you experimented with an alternative OS that broke the partition table or otherwise made the system non-bootable, you can try repairing your system with Startup Repair (Windows Vista) or Automatic Repair (Windows 7, 8 and 8.1). Since these systems have different recovery mechanisms, let me just link to a Windows Vista article and go directly to fixing Windows 8/8.1 startup.
If your laptop is running Windows 8 or 8.1, most likely the manufacturer left a dedicated recovery partition somewhere on the disk. It’s usually located at the end of the disk, so it’s not easy to overwrite. Try booting into that recovery partition by following instructions provided by your laptop’s manufacturer. (If that doesn’t work, you’ll need to create a bootable USB drive and load a Windows 8/8.1 setup from that device. How to create one is out of scope of this article, but plenty of instructions are available online).
Booting into the Windows 8 setup (by either using your system’s recovery partition or a bootable USB stick), select “Repair your computer” in the bottom part of the window (you can use Alt+R if the mouse doesn’t work). Click “Troubleshoot”, then “Advanced options”. From there, select “Automatic Repair”. Windows will try to repair any problems preventing your laptop from booting normally. If that doesn’t work, you’ll need to take the disk out, attach it to a another (working) computer and use a data recovery tool on it.
To fix corrupted partitions, you’ll need RS Partition Recovery
RS Partition Recovery is designed to fix problems with your computer’s hard disk after accidental formatting, repartitioning, or experimenting with Ubuntu. In particular, the tool will scan the partition and recover all files and folders stored on the affected device. Thanks to its easy to use interface, the tool can be used by anyone including complete novices.
While RS Partition Recovery is equipped with Quick Recovery for repairing minor damage, what you’ll most probably use is the Deep Scan mode. In this mode, RS Partition Recovery will read and thoroughly analyze the entire content of the device looking for available partitions, file systems and system structures in low level. This allows RS Partition Recovery to perform the complete recovery of all information located on badly damaged storage devices. In this mode, RS Partition Recovery will literally rebuild the original partition structure from the scratch.
However, the tool will only work as intended on unencrypted hard drives. If your laptop used full disk encryption (BitLocker), you will need to unlock the encrypted partitions first.
Taking the Drive Out
Several times in this article we mentioned taking the drive out. Will this void your laptop’s warranty (if any of it is still left)? This depends on many things including manufacturer’s policies and device model. Nearly all laptops made 3-5 years ago allow users swapping certain hardware such as replacing batteries, changing hard drives or adding more memory (RAM) without disassembling the entire laptop. For taking the hard drive out, you would simply need to locate the location of the HDD cover and use a Philips screwdriver to undo one or two screws. After that, you’d be able to simply pull the disk (or undo a couple more screws at worst).
Today’s laptops are sometimes trickier than that. Apple in particular manufactures disposable computers that are not designed to be repairable or user upgradeable. Apple is not alone. Microsoft Surface 3 Pro is another example of a device with no removable (or replaceable) parts. Many ultrabooks and slim laptops also feature glued-in batteries and non-removable hard drives. If you own one of those devices, you may not be able to take the drive out, and you may have to bring the entire laptop to a data recovery lab. This is the unfortunate drawback of living in the disposable world.
BitLocker Encrypted Partitions
Most business laptops, ultrabooks and many Windows tablets running a full version of Windows 8 or 8.1 are equipped with a security feature that will automatically encrypt the content of your primary (system) partition without you even knowing. If your disk is encrypted with BitLocker, you will need to unlock the partition before you can recover any data. If you are trying to recover deleted files, your laptop boots from its original system, you were able to log in as an administrator and are running a data recovery tool on that laptop, you may not even notice that the partition is encrypted since the encryption happens transparently in background.
If you had to take the disk out and inserted it into a different computer, you will need to unlock it with a BitLocker Recovery Key in order to gain access to information stored on that volume. If you don’t have access to your BitLocker Recovery Key, a data recovery tool will be unable to recover any information from the encrypted partition.
Fortunately, Windows will only encrypt your system partition if your administrative account is a Microsoft Account (as opposed to being a local Windows account). As a result, you should be able to visit the Web page https://onedrive.live.com/recoverykey and log in with your Microsoft Account credentials. You will be shown your BitLocker Recovery Key. If you don’t remember your password (e.g. you used a fingerprint login or a PIN code all the time), you can use https://account.live.com/resetpassword.aspx and follow the instructions to reset your password.
Broken BitLocker Partitions
The above procedure only works for healthy BitLocker partitions that were not formatted or corrupted by another OS. Unfortunately, it won’t work if the beginning of your BitLocker-encrypted partition was overwritten by a different OS. If your encrypted partition is broken, you will have to fix the encryption first, and only then you’ll be able to recover data.
If you experimented with an alternative OS (Ubuntu is the worst offender here), and that OS has overwritten the beginning of the partition, you will need to fix the partition table first (e.g. with Partition Recovery Software), and then repair the encrypted partition. All that must happen BEFORE you begin recovering actual files and folders (by the way, you can use the same tool, Partition Recovery Software, to recover files and folders after fixing the partition table and repairing encrypted volumes).
In order to repair a corrupted BitLocker partition you’ll need to use Microsoft BitLocker Repair Tool (download from https://support.microsoft.com/en-us/kb/928201). Note that you absolutely must have the correct BitLocker Recovery Key (see previous chapter) in order to be able to recover the encrypted volume.
After downloading the tool, read the following Microsoft TechNet article: “How to use the BitLocker Repair Tool to help recover data from an encrypted volume”
Basically, you’ll need to run the recovery tool on the partition in the command line, e.g.
repair-bde e: d: -rp xxxx-xxxxx-xxxxxx-xxxxx -f -lf c:\log.txt
Where “xxxxx” is your Recovery Key. If the beginning of the partition is encrypted with a different key (as per new Windows installation) or not encrypted at all, you may need to strip that part of the image before passing it to the repair tool. This is a complex procedure, so if you found yourself in a situation like this, you may want to bring your disk to a data recovery lab.
As you can see, data recovery on laptop computers is not always easy and not always possible. It certainly different from recovering data from desktop computers. However, if you use the right tool, and if you use them properly, you may be able to recover information without disassembling the laptop and taking the disk out.