Surface 3 Data Recovery

Jared

Administrator
Staff member
So yesterday I got in a Surface 3 which uses eMMC instead of an SSD for its memory. The device was functional, but data had been accidentally deleted. I tried a number of Linux live builds but most would hang on boot. Finally, I was able to image it using a bootable copy of Clonezilla. Here's the steps I followed to image the memory w/o having to boot up the tablet to Windows.

1. Using Lili USB creator software I set up a bootable USB thumb drive with Clonezilla.
2. With the tablet off, hold the Volume Up key and power the tablet on (this will enter UEFI) and then disable the secure boot option.
3. Turn the tablet back off by holding the power key for around 10 seconds.
4. Plug in the USB stick along with wireless keyboard/mouse dongle into USB hub, and plug hub into the tablet.
5. Hold the Volume Down button and power the tablet on (it should boot to Clonezilla)
6. Plug in destination USB drive to hub as well, and follow the Clonzilla instructions on screen.
7. Had customer log into their Microsoft account and get bitlocker key using this link (http://go.microsoft.com/fwlink/?LinkId=237614)

I was quite impressed that the tablet was able to power a WD My Passport drive as well as the thumb drive and keyboard dongle for the entire 45min it took to image the whole drive, all running on battery using a non-powered hub (I tried a powered one and it was acting up for some reason). Hopefully, this will help someone else trying to get an image of the memory from one of these.
 

Jared

Administrator
Staff member
Another interesting thing I discovered is that I can't do a drive to drive image of the internal memory. I can only image to a file, and only by partition. Seems that if I try to image starting at the MBR it returns an error about the eMMC memory not being a block device. Yet I can read to an image file. Even after I had the image when I ran R-Studio on the device to test it, I still couldn't image the whole drive to another drive. But I could to an image file.
 

LarrySabo

Member
Had customer log into their Microsoft account and get bitlocker key using this link (http://go.microsoft.com/fwlink/?LinkId=237614)
I had a call today about recovering data from a Surface Pro 3 that prompts for the user's bitlocker key, which the customer has never been asked for before. He said he contacted MS to see if they could provide his private key, and provided them with the Key ID provided by the Surface. They said if he didn't back it up at set-up, they couldn't help. All he gets is an option to 1) reset the device, 2) boot to a USB drive, or 3) boot to a command prompt. He needs his data recovered.

@jared, should the private key always be available using that link (assuming the Surface was set up using a MS account)?
 

Jared

Administrator
Staff member
Yes, it should be available. When the key is created on first login the bitlocker key is stored with Microsoft and linked with their account.
 

LarrySabo

Member
Thanks, Jared. That's what I figured and tried to contact the (prospective) customer to begin next steps, but he wasn't available and hasn't replied to the voice message I left.
 
Top