From: Clint Jay <cjaysharp@gmail.com>
To: Microcontroller discussion list - Public. <piclist@mit.edu>
Sender: "piclist-bounces@mit.edu" <piclist-bounces@mit.edu>
Date: Wed, 22 Jul 2020 05:19:29 -0700
Subject: Re: [OT]: recover files from Hard drive
Thread-Topic: [OT]: recover files from Hard drive
Thread-Index: AdZgJAW8g6rIq3D6Su2ovaYO+s3SGw==
Message-ID:
 <CAN7ULzTLVcB_6h9WS_4pomF9NfRr0Ndm1JAv5nt7m0UNsw4Ktg@mail.gmail.com>
References:
 <CAH5-xwZxkWAzjbPA1Nrg7FtYUGstAkJFo2ce_2h_tRkOsL8OEA@mail.gmail.com>
	<CADOftecd3F3bXLGX6rUdKMqS4idtN3G5XMvd+RMrd3V86UHtSA@mail.gmail.com>
	<CAH5-xwb2WLYyKjD6-0KTpCY36Yz+N_u6imXhEyNZgDfG3gYhCA@mail.gmail.com>
	<CAB115wEKhJ5r8adr8_ETx7=mmmuMhYKCyh231M+mkd-6SWBEpg@mail.gmail.com>
	<CAH5-xwbjNSOE1PmiHJA1RFE_CgjJecfJ1Yd-gCwBiyPGMYzb4A@mail.gmail.com>
	<CAB115wGiwRDBq6iKQjJvWK3D31VhuXcqfxRLNCgu6oNfwK45Vw@mail.gmail.com>
	<CAN7ULzTt_Hs_OcHbAc2cFjEqU=-71bk5eR=ftaDE1APdq+PozA@mail.gmail.com>
	<CAH5-xwZ73DmPaUokTTv7kn2tRy9p34G0+N5RTJTqmbQhAbZDtg@mail.gmail.com>
In-Reply-To:
 <CAH5-xwZ73DmPaUokTTv7kn2tRy9p34G0+N5RTJTqmbQhAbZDtg@mail.gmail.com>
Reply-To: Microcontroller discussion list - Public. <piclist@mit.edu>
Accept-Language: en-US
X-MS-Exchange-Organization-SenderIdResult: Pass
X-MS-Exchange-Organization-PRD: mit.edu
X-MS-TNEF-Correlator:
received-spf: Pass (protection.outlook.com: domain of gmail.com designates
	209.85.210.53 as permitted sender) receiver=protection.outlook.com;
	client-ip=209.85.210.53; helo=mail-ot1-f53.google.com;
dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com;
 s=20161025;
	h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
 	bh=wv9pcrBdNkyk/E/6bblO5RnAY7zrS9hEPLAYgKnyn9k=;
	b=q0ZivIQJF3MzBeSfQMcR7Bjib4nxELsyJx0DJzvyHpvy69nFNiwUKiT43x+sc1irgO
	yzTj73tsBMqm0bs+6SMbJgXnbR7Ni81VSNdoF7lEoRpnGQv6Ul+c2CpGy/u62zroxLTK
	cbmdhuydGhMrnSDV01PElC7Nc955K18qU9UUu/zLRRo5MHlcGG226hcX04depND1Vdf3
	h1WXAlCTO4EH3sQY0c0Pdy1JiLYkgBZoJngL62eiPnvrCFKOMfXY2K0rkMbgwN7V6rgQ
	niHzX2lIp9PIq8DibhkECssX3wfDxlkiPKhay0FuKZec0PmDgTqon1EZ7wSmfqK7GMN5	ykRQ==
authentication-results: spf=pass (sender IP is 209.85.210.53)
	smtp.mailfrom=gmail.com; mit.edu; dkim=pass (signature was verified)
	header.d=gmail.com; mit.edu;	dmarc=pass action=none header.from=gmail.com; 
errors-to: piclist-bounces@mit.edu
list-id: "Microcontroller discussion list - Public." <piclist.mit.edu>
list-post: <mailto:piclist@mit.edu>
x-beenthere: piclist@mit.edu
x-mailman-version: 2.1.6
x-received: by 2002:a9d:2c62:: with SMTP id
 f89mr27767960otb.148.1595420380926;	Wed, 22 Jul 2020 05:19:40 -0700 (PDT)
x-topics: [OT]
x-content-filtered-by: Mailman/MimeDel 2.1.6
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Hi Luis, we use a *lot* of HP laptops here, if your machine was encrypted
then it's doubtful you'll be able to recover anything. Bitlocker would have
required you to enter a PIN shortly after powering the machine up, if that
was the case then it's probably irretrievable.

If the drive was 'wiped' in the BIOS then the data will likely be
irretrievable as the SSD used in HP machines are self encrypting, the wipe
removes the keys used for encryption, rendering it unrecoverable.

If it was just a HP Web rebuild (did it ask to be connected to the
Internet?) then the standard tools like Recuva might be able to find data.

If it was a corporate rebuild, I.E. it connected to your organisation's
build servers then I'm afraid I have no idea how it was rebuilt (unless you
work for the same organisation as I do)

On Wed, 22 Jul 2020 at 13:07, Luis Moreira <luis.moreira1575@googlemail.com=
>
wrote:

> Hi Clint,
> this is a company supplied laptop, not sure on what kind of encryption th=
ey
> use.
> I used the windows recover function on the HP sure start utility, not sur=
e
> what that uses.
>
> Best Regards
>                    Luis
>
> <
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> >
> Virus-free.
> www.avast.com
> <
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> >
> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>
> On Tue, 21 Jul 2020 at 23:31, Clint Jay <cjaysharp@gmail.com> wrote:
>
> > Was the laptop encrypted with Bitlocker? How was windows reinstalled? W=
as
> > the secure wipe in the BIOS used?
> >
> >
> >
> > On Tue, 21 Jul 2020, 21:49 David VanHorn, <microbrix@gmail.com> wrote:
> >
> > > yes
> > >
> > >
> > > On Tue, Jul 21, 2020 at 2:35 PM Luis Moreira <
> > > luis.moreira1575@googlemail.com> wrote:
> > >
> > > > Hi David,
> > > > Do you think this would work on a working formated disk?
> > > > Thank you.
> > > > Best Regards
> > > >            Luis
> > > >
> > > > On Tue, 21 Jul 2020, 21:30 David VanHorn, <microbrix@gmail.com>
> wrote:
> > > >
> > > > > Recuva may help. I've had good luck with it in the past.
> > > > >
> > > > >
> > > > > On Tue, Jul 21, 2020 at 2:24 PM Luis Moreira <
> > > > > luis.moreira1575@googlemail.com> wrote:
> > > > >
> > > > > > A bit more info on this issue, this is a HP laptop with that su=
re
> > > start
> > > > > > thing and a ssd. I think the drive never had an issue, it all
> > started
> > > > > with
> > > > > > an issue with the wireless card. I restarted the laptop as
> normally
> > > > this
> > > > > > always gets it working fine, and that's when it got stuck on th=
e
> > > > > > splash screen for HP Sure start. I left it for about 3 hours
> trying
> > > to
> > > > > > restart but after that I stopped it and restarted it again. Tha=
t
> > got
> > > it
> > > > > > stuck on the repairing the pc splash screen which I left it on
> for
> > > > > another
> > > > > > 4 hours and still nothing so I got into the startup menu and go=
t
> > into
> > > > the
> > > > > > recover option, which really meant restore windows 10.
> > > > > > And that's it, I have now a newly formated drive with the lapto=
p
> > > ready
> > > > > for
> > > > > > initial setup and may files gone!
> > > > > >
> > > > > > I just want to gauge how likely it is that I can get my files
> back
> > > and
> > > > if
> > > > > > there's any tools I can suggest to the IT guy.
> > > > > >
> > > > > > Thank you.
> > > > > > Best Regards
> > > > > >             Luis
> > > > > >
> > > > > > On Tue, 21 Jul 2020, 19:41 Denny Esterline, <
> desterline@gmail.com>
> > > > > wrote:
> > > > > >
> > > > > > > Recent discussion on Hack-a-day about data recovery.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> https://hackaday.com/2020/07/14/tales-from-the-sysadmin-impending-hard-dr=
ive-doom/
> > > > > > >
> > > > > > >
> > > > > > > The comment section might contain some nuggets worth digging
> for.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > On Tue, Jul 21, 2020 at 11:06 AM Luis Moreira <
> > > > > > > luis.moreira1575@googlemail.com> wrote:
> > > > > > >
> > > > > > > > Hi All,
> > > > > > > > Looking for some info and experiences you may have had in t=
he
> > > past.
> > > > > > > >
> > > > > > > > My company issued Laptop, just failed on Startup yesterday
> and
> > > I've
> > > > > > lost
> > > > > > > > quite a bit of valuable data and files. I know what you are
> > going
> > > > to
> > > > > > say,
> > > > > > > > no Backup? No I'm afraid not, as my IT department will not
> > supply
> > > > it,
> > > > > > > since
> > > > > > > > we are all suppose to work on the network not on our C:
> drive!
> > > > > Anyway,
> > > > > > I
> > > > > > > > should have had setup some manual backup strategy.
> > > > > > > > So here we are. I couldn't recover the laptop after startup
> so
> > I
> > > > done
> > > > > > > > recovery, but what that actually meant was a clean install =
of
> > > > windows
> > > > > > 10,
> > > > > > > > so all my files are gone
> > > > > > > > Looking at the time it took, it can't have formated fully t=
he
> > > > drive,
> > > > > > but
> > > > > > > > the IT department after several scans can not find any data=
..
> > > > > > > >
> > > > > > > > What I'm looking for, is some advice, software/service that
> you
> > > > have
> > > > > > > > experience with, that could help me get at least some of my
> > > > > data/files
> > > > > > > > back.
> > > > > > > >
> > > > > > > > Thank you.
> > > > > > > > Best regards
> > > > > > > >             Luis
> > > > > > > > --
> > > > > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list
> > archive
> > > > > > > > View/change your membership options at
> > > > > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > > > > >
> > > > > > > --
> > > > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list
> archive
> > > > > > > View/change your membership options at
> > > > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > > > >
> > > > > > --
> > > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archiv=
e
> > > > > > View/change your membership options at
> > > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > > >
> > > > > --
> > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > > > > View/change your membership options at
> > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > >
> > > > --
> > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > > > View/change your membership options at
> > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > >
> > > --
> > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > > View/change your membership options at
> > > http://mailman.mit.edu/mailman/listinfo/piclist
> > >
> > --
> > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > View/change your membership options at
> > http://mailman.mit.edu/mailman/listinfo/piclist
> >
>
> <
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> >
> Virus-free.
> www.avast.com
> <
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> >
> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
> --
> http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> View/change your membership options at
> http://mailman.mit.edu/mailman/listinfo/piclist
>


--=20
Clint. M0UAW IO83

*No trees were harmed in the sending of this mail. However, a large number
of electrons were greatly inconvenienced.*
--=20
http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist
.