OS partition missing after crash
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
Greetings!
Short version :
My PC crashed, and when I rebooted I got a blue screen and couldn't boot into Windows. I took out the SSD and accessed it from another PC, auto-mounted the partitions with VeraCrypt, but only three out of four showed up. The fourth partition, which contains the OS, can't be mounted, and I can't recover the volume headers from it either. Most of my data is on the other three partitions, which seem undamaged, but there are still some things I'd like to recover from the OS partition if I can.
Long version :
I have a laptop that has a single storage device, a 1 TB SSD. The drive is fully encrypted (all partitions; with VeraCrypt obviously), and has four main partitions (excluding system partitions) : one for the OS (Windows 10) and various programs (E), and three "data" partitions (F, G and H).
Two days ago, the laptop randomly crashed while I was using it. I of course tried booting it up after waiting for a minute or two, but I was then greeted by one of those dreaded blue screens : https://postimg.cc/phvL7YtM (Your PC/Device needs to be repaired. A required device isn't connected or can't be accessed...). I tried restarting a bunch of times, going into the recovery environment (does nothing), going into startup settings (also does nothing), and going into the BIOS but couldn't find anything to fix or help with the problem.
I looked into potential solutions, and setup a flashdrive as a bootable USB media; this allowed me to try various other things, like automatic repair (which failed because it couldn't find the OS, because the drive is encrypted and/or corrupted I assume), or opening a command prompt to run some bootrec commands (most of which failed, saying they couldn't find the OS, again).
I then went back into the BIOS to see if the VeraCrypt boot loader was in the right position (i.e. before Windows), as I couldn't remember whether it was or not last time I checked. And, uh oh, it wasn't there at all, there was only one entry.
I ended up buying a new SSD (...a bit impulsively), along with a NVME SSD enclosure so I could potentially transfer data to the new SSD using an older laptop I still have. Earlier today, I took out the (damaged?) SSD and put it in the enclosure and connected it to the other laptop; I installed VeraCrypt and used auto-mount, put in the password (which is the same for all partitions, as I encrypted them all simultaneously), waited for a few minutes, and some new partitions showed up. The three "data" partitions are all there, and seemingly intact, but the OS partition wasn't there. I then tried to manually select it and mount it, typed the password, waited, and... it didn't work, saying the device couldn't be mounted (same error message as when you type in a wrong password).
So, as far as I know, the data on the F, G and H partitions is undamaged, but the OS partition may be damaged or corrupted in some way. I then tried to restore the volume header from the backup embedded in the volume, which proved unsuccessful after I typed the password.
Most of my data is on the other three partitions, which seem undamaged, but there are still some things I'd like to recover from the OS partition if I can.
That's about it... thanks in advance for whatever help you may be able to offer!
C L -- Congratulations on retrieving your 3 data partitions, but it's the system partition that requires special handling and I didn't see the magic phrase even in your "long version" above. When you've chosen the correct device/partition to mount, and see the password/PIM dialog, click the button in the lower right corner marked "Mount Options..." and then make sure to check the box marked "Mount partition using system encryption without pre-boot authentication." Then click OK and enter the password and optional PIM in the previous dialog. Without that, the inevitable result attempting to mount a system partition is exactly what you described. Hopefully, neither the crash nor your subsequent recovery attempts have actually corrupted the encryption structures.
Well... I wish I could say I didn't feel like an idiot, but uhhh...
Thank you very much, Gary; this allowed me to get into the partition, and after a brief inspection it also appears to be mostly intact.
Do you have any advice on how I should proceed, now that I can access all four partitions, and they're seemingly undamaged? Would it be wise to, say, permanently decrypt the whole drive, put it back into the laptop, and see if it boots normally? If it does, I can use it for a day or two, to make sure everything is working properly, then maybe redo the encryption process? Or would that be a bad idea?
Do you have any idea what might have caused the issue in the first place? Some recent Windows update maybe?
Again, thanks for your help. I feel like this is definitely something I should've figured out on my own, but apparently it wasn't to be...
I'm glad you were at least able to unlock that system partition, C L. Unfortunately, restoring bootability to a UEFI system is out of my wheelhouse as I still use the MBR booting structure and a desktop computer. This is the point where I would make a full backup of all data from the unlocked partitions and then restore a recent backup of the system partition to the boot drive, and finally freshen it with recovered data to bring it up to date. Since you haven't mentioned any backups, I'll assume you don't have that path, but at least you have some recently purchased extra disk space (not really so impulsive). After you've backed up your current state, then you can experiment risk-free on the old drive to restore bootability. Searching this forum, you can probably find some sage advice that applies to your situation, and it does seem that your UEFI booting structure needs repair. That may be the full extent, or it may simply uncover additional issues. At least now you've ratcheted up your fallback position a bit by unlocking your system partition for external access.