From: Luis Moreira <luis.moreira1575@googlemail.com>
To: Microcontroller discussion list - Public. <piclist@mit.edu>
Sender: "piclist-bounces@mit.edu" <piclist-bounces@mit.edu>
Date: Wed, 22 Jul 2020 06:02:57 -0700
Subject: Re: [OT]: recover files from Hard drive
Thread-Topic: [OT]: recover files from Hard drive
Thread-Index: AdZgKlkwDZADOHkOT1WNfEb690+iOA==
Message-ID:
 <CAH5-xwaBSADmF6uyr5st9hgtOpSRrC7k020vjiRqj7z9GnJLwQ@mail.gmail.com>
References:
 <CAH5-xwZxkWAzjbPA1Nrg7FtYUGstAkJFo2ce_2h_tRkOsL8OEA@mail.gmail.com>
	<CADOftecd3F3bXLGX6rUdKMqS4idtN3G5XMvd+RMrd3V86UHtSA@mail.gmail.com>
	<CAH5-xwb2WLYyKjD6-0KTpCY36Yz+N_u6imXhEyNZgDfG3gYhCA@mail.gmail.com>
	<CAB115wEKhJ5r8adr8_ETx7=mmmuMhYKCyh231M+mkd-6SWBEpg@mail.gmail.com>
	<CAH5-xwbjNSOE1PmiHJA1RFE_CgjJecfJ1Yd-gCwBiyPGMYzb4A@mail.gmail.com>
	<CAB115wGiwRDBq6iKQjJvWK3D31VhuXcqfxRLNCgu6oNfwK45Vw@mail.gmail.com>
	<CAN7ULzTt_Hs_OcHbAc2cFjEqU=-71bk5eR=ftaDE1APdq+PozA@mail.gmail.com>
	<CAH5-xwZ73DmPaUokTTv7kn2tRy9p34G0+N5RTJTqmbQhAbZDtg@mail.gmail.com>
	<CAN7ULzTLVcB_6h9WS_4pomF9NfRr0Ndm1JAv5nt7m0UNsw4Ktg@mail.gmail.com>
In-Reply-To:
 <CAN7ULzTLVcB_6h9WS_4pomF9NfRr0Ndm1JAv5nt7m0UNsw4Ktg@mail.gmail.com>
Reply-To: Microcontroller discussion list - Public. <piclist@mit.edu>
Accept-Language: en-US
X-MS-Exchange-Organization-SenderIdResult: Pass
X-MS-Exchange-Organization-PRD: mit.edu
X-MS-TNEF-Correlator:
received-spf: Pass (protection.outlook.com: domain of googlemail.com
	designates 209.85.216.48 as permitted sender)
	receiver=protection.outlook.com; client-ip=209.85.216.48;
	helo=mail-pj1-f48.google.com;
dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed;	d=googlemail.com;
 s=20161025;
	h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
 	bh=oFEN9hOfnKTA63Lo9L2hdDK+UXxX0zniM22/ovmnJFk=;
	b=VhwH3o0wBZD7RBU/mqrogYzl2tVDUzGdmJlDB75qxLw2RmQ1KPyp+277CKEKdtwaqh
	fxYY1n1WF5ClkVLX35oWOaPJnk6FVp57rmLOJ/63azVV/COWozE0BhPaoyr0aE1D1SiX
	46FljpfGdtZYKEwyb5DYROegCRh86tRL8w7XhZq1sgnhMLUHgjMU8HUfKXd+g79eQXMq
	8vxiXGmGbgZM9zdfehiDjwRDajN2NaFKtU2MJM55j+fGKhxbMPl8LCQpcFw2EQLtSGF0
	W2YdJyzYE7WlZ68LFBwX/p2eeAOASc7WdPSD/rPe4/GPsjRfxIy0zpYCIYlDd1EOK7sk	4/0Q==
authentication-results: spf=pass (sender IP is 209.85.216.48)
	smtp.mailfrom=googlemail.com; mit.edu;	dkim=pass (signature was verified)
	header.d=googlemail.com;mit.edu; dmarc=pass action=none
	header.from=googlemail.com;
errors-to: piclist-bounces@mit.edu
list-id: "Microcontroller discussion list - Public." <piclist.mit.edu>
list-post: <mailto:piclist@mit.edu>
x-beenthere: piclist@mit.edu
x-mailman-version: 2.1.6
x-received: by 2002:a17:90a:2a4d:: with SMTP id
	d13mr9598635pjg.195.1595422989088; 	Wed, 22 Jul 2020 06:03:09 -0700 (PDT)
x-topics: [OT]
x-content-filtered-by: Mailman/MimeDel 2.1.6
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Hi Clint,
it was a HP web rebuild from my side, but now that I had to hand it over to
the "IT Expert" who knows.

I'm just waiting to find out if he could recover some of the data. I'm not
very hopeful. He just told me yesterday that two scans with two different
tools yielded  nothing...

Thank you.
Best Regards
                     Luis

<https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_c=
ampaign=3Dsig-email&utm_content=3Dwebmail>
Virus-free.
www.avast.com
<https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_c=
ampaign=3Dsig-email&utm_content=3Dwebmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Wed, 22 Jul 2020 at 13:27, Clint Jay <cjaysharp@gmail.com> wrote:

> Hi Luis, we use a *lot* of HP laptops here, if your machine was encrypted
> then it's doubtful you'll be able to recover anything. Bitlocker would ha=
ve
> required you to enter a PIN shortly after powering the machine up, if tha=
t
> was the case then it's probably irretrievable.
>
> If the drive was 'wiped' in the BIOS then the data will likely be
> irretrievable as the SSD used in HP machines are self encrypting, the wip=
e
> removes the keys used for encryption, rendering it unrecoverable.
>
> If it was just a HP Web rebuild (did it ask to be connected to the
> Internet?) then the standard tools like Recuva might be able to find data=
..
>
> If it was a corporate rebuild, I.E. it connected to your organisation's
> build servers then I'm afraid I have no idea how it was rebuilt (unless y=
ou
> work for the same organisation as I do)
>
> On Wed, 22 Jul 2020 at 13:07, Luis Moreira <
> luis.moreira1575@googlemail.com>
> wrote:
>
> > Hi Clint,
> > this is a company supplied laptop, not sure on what kind of encryption
> they
> > use.
> > I used the windows recover function on the HP sure start utility, not
> sure
> > what that uses.
> >
> > Best Regards
> >                    Luis
> >
> > <
> >
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> > >
> > Virus-free.
> > www.avast.com
> > <
> >
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> > >
> > <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
> >
> > On Tue, 21 Jul 2020 at 23:31, Clint Jay <cjaysharp@gmail.com> wrote:
> >
> > > Was the laptop encrypted with Bitlocker? How was windows reinstalled?
> Was
> > > the secure wipe in the BIOS used?
> > >
> > >
> > >
> > > On Tue, 21 Jul 2020, 21:49 David VanHorn, <microbrix@gmail.com> wrote=
:
> > >
> > > > yes
> > > >
> > > >
> > > > On Tue, Jul 21, 2020 at 2:35 PM Luis Moreira <
> > > > luis.moreira1575@googlemail.com> wrote:
> > > >
> > > > > Hi David,
> > > > > Do you think this would work on a working formated disk?
> > > > > Thank you.
> > > > > Best Regards
> > > > >            Luis
> > > > >
> > > > > On Tue, 21 Jul 2020, 21:30 David VanHorn, <microbrix@gmail.com>
> > wrote:
> > > > >
> > > > > > Recuva may help. I've had good luck with it in the past.
> > > > > >
> > > > > >
> > > > > > On Tue, Jul 21, 2020 at 2:24 PM Luis Moreira <
> > > > > > luis.moreira1575@googlemail.com> wrote:
> > > > > >
> > > > > > > A bit more info on this issue, this is a HP laptop with that
> sure
> > > > start
> > > > > > > thing and a ssd. I think the drive never had an issue, it all
> > > started
> > > > > > with
> > > > > > > an issue with the wireless card. I restarted the laptop as
> > normally
> > > > > this
> > > > > > > always gets it working fine, and that's when it got stuck on
> the
> > > > > > > splash screen for HP Sure start. I left it for about 3 hours
> > trying
> > > > to
> > > > > > > restart but after that I stopped it and restarted it again.
> That
> > > got
> > > > it
> > > > > > > stuck on the repairing the pc splash screen which I left it o=
n
> > for
> > > > > > another
> > > > > > > 4 hours and still nothing so I got into the startup menu and
> got
> > > into
> > > > > the
> > > > > > > recover option, which really meant restore windows 10.
> > > > > > > And that's it, I have now a newly formated drive with the
> laptop
> > > > ready
> > > > > > for
> > > > > > > initial setup and may files gone!
> > > > > > >
> > > > > > > I just want to gauge how likely it is that I can get my files
> > back
> > > > and
> > > > > if
> > > > > > > there's any tools I can suggest to the IT guy.
> > > > > > >
> > > > > > > Thank you.
> > > > > > > Best Regards
> > > > > > >             Luis
> > > > > > >
> > > > > > > On Tue, 21 Jul 2020, 19:41 Denny Esterline, <
> > desterline@gmail.com>
> > > > > > wrote:
> > > > > > >
> > > > > > > > Recent discussion on Hack-a-day about data recovery.
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> https://hackaday.com/2020/07/14/tales-from-the-sysadmin-impending-hard-dr=
ive-doom/
> > > > > > > >
> > > > > > > >
> > > > > > > > The comment section might contain some nuggets worth diggin=
g
> > for.
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > On Tue, Jul 21, 2020 at 11:06 AM Luis Moreira <
> > > > > > > > luis.moreira1575@googlemail.com> wrote:
> > > > > > > >
> > > > > > > > > Hi All,
> > > > > > > > > Looking for some info and experiences you may have had in
> the
> > > > past.
> > > > > > > > >
> > > > > > > > > My company issued Laptop, just failed on Startup yesterda=
y
> > and
> > > > I've
> > > > > > > lost
> > > > > > > > > quite a bit of valuable data and files. I know what you a=
re
> > > going
> > > > > to
> > > > > > > say,
> > > > > > > > > no Backup? No I'm afraid not, as my IT department will no=
t
> > > supply
> > > > > it,
> > > > > > > > since
> > > > > > > > > we are all suppose to work on the network not on our C:
> > drive!
> > > > > > Anyway,
> > > > > > > I
> > > > > > > > > should have had setup some manual backup strategy.
> > > > > > > > > So here we are. I couldn't recover the laptop after start=
up
> > so
> > > I
> > > > > done
> > > > > > > > > recovery, but what that actually meant was a clean instal=
l
> of
> > > > > windows
> > > > > > > 10,
> > > > > > > > > so all my files are gone
> > > > > > > > > Looking at the time it took, it can't have formated fully
> the
> > > > > drive,
> > > > > > > but
> > > > > > > > > the IT department after several scans can not find any
> data.
> > > > > > > > >
> > > > > > > > > What I'm looking for, is some advice, software/service th=
at
> > you
> > > > > have
> > > > > > > > > experience with, that could help me get at least some of =
my
> > > > > > data/files
> > > > > > > > > back.
> > > > > > > > >
> > > > > > > > > Thank you.
> > > > > > > > > Best regards
> > > > > > > > >             Luis
> > > > > > > > > --
> > > > > > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list
> > > archive
> > > > > > > > > View/change your membership options at
> > > > > > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > > > > > >
> > > > > > > > --
> > > > > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list
> > archive
> > > > > > > > View/change your membership options at
> > > > > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > > > > >
> > > > > > > --
> > > > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list
> archive
> > > > > > > View/change your membership options at
> > > > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > > > >
> > > > > > --
> > > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archiv=
e
> > > > > > View/change your membership options at
> > > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > > >
> > > > > --
> > > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > > > > View/change your membership options at
> > > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > > >
> > > > --
> > > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > > > View/change your membership options at
> > > > http://mailman.mit.edu/mailman/listinfo/piclist
> > > >
> > > --
> > > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > > View/change your membership options at
> > > http://mailman.mit.edu/mailman/listinfo/piclist
> > >
> >
> > <
> >
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> > >
> > Virus-free.
> > www.avast.com
> > <
> >
> https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_=
campaign=3Dsig-email&utm_content=3Dwebmail
> > >
> > <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
> > --
> > http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> > View/change your membership options at
> > http://mailman.mit.edu/mailman/listinfo/piclist
> >
>
>
> --
> Clint. M0UAW IO83
>
> *No trees were harmed in the sending of this mail. However, a large numbe=
r
> of electrons were greatly inconvenienced.*
> --
> http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
> View/change your membership options at
> http://mailman.mit.edu/mailman/listinfo/piclist
>

<https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_c=
ampaign=3Dsig-email&utm_content=3Dwebmail>
Virus-free.
www.avast.com
<https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_c=
ampaign=3Dsig-email&utm_content=3Dwebmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
--=20
http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist
.