M.2 recovery and Data Extractor problem or ...?

emir_has

Member
Hi

I got one Samsung-Lenovo M.2 NVMe 1TB drive. Client said that laptop stopped to recognize it and that data are corrupted.
I have connected it through M2 to USB convertor and connected on PC 3000 and DE. DE detected the drive and detected Bitlocker encrpytion. Also DE has read MFT and tree of dirs and files are ok. But when I start to read/copy data to another drive all files are corrupted except few Word and Excel files.
Even all read clusters are green but files are corrupted. I have manage to read other directories but only one particular directory (cca 40GB) with files corrupted even all read clusters are green.

Can someone help me whith this? Is this problem with DE or with the drive? I have tried to read data with R-Studio but R-Studio doesnt see partition and with raw recovery files are also corupted!?

P.S. In DE I have tried MFT map, Partition map, raw recovery but only from that one particular folder files are corupted!

Thank you!
 

Jared

Administrator
Staff member
Perhaps the SSD is only partly encrypted with Bitlocker. Try scanning in R-Studio or another program without putting in the Bitlocker password and see if it starts finding raw files at a certain point. Maybe they had recently turned BitLocker on and it was in the process of encrypting and got interrupted??? Just a thought.
 

lcoughey

Moderator
I just dealt with an NVMe SSD that would read clean data for a minute or two, then flip to reading garbage until the SSD is repowered. The only way I was able to recover the data was by using the NVMe port on PC3K portable, set the read timeout down 50ms and have it repower on a read error. I then had to baby sit it, as it would completely stop imaging every 3-5 minutes and would require me to manually repower the SSD and restart the process where it left off.
 

emir_has

Member
Thanks for answers friends. That's good tought Jared I will try your way.
Unfortunately I still don't have PC3K portable so I cannot try your option lcoughey. But thanks anyway!
 

emir_has

Member
Hi

I just want to report what have I made. I tried to scan the disk with R-Studio without entering Bitlocker key and R-Studio find some raw files mostly pictures and some docs but not what I wanted.
So I have entered bitlocker recovery key in DE and mounted the disk from DE to Win (for second) time and R-Studio successfully read entire disk with structure and I have made copy 90% of data from wanted directory (Was some logical bug in reading MFT don't know?). Some files still didn't copied even they are read. All in all I am satisfied with recovery as client do too. :D

Thanks for help guys, wish you all best!

P.S. At the end client admit that he forcibly shut down computer while still was booting so maybe Windows made some mistake working with Bitlocker don't know just guessing!?
 
Top