DavidXanatos / DiskCryptor

A fork of the DiskCryptor full disk encryption tool
https://www.diskcryptor.org/
459 stars 98 forks source link

bluescreen #104

Closed hardbelit closed 3 months ago

hardbelit commented 3 months ago

running without any problems for 4 years , after a simple restart, I got bluescreen:

20240623_162945

2

1

is there any hope to can recover the files and what i keep in this hard ?

any good suggestion is welcome

hardbelit commented 3 months ago

I don't know if it would be advisable for the hard to decipher the E :\ partition

image

DavidXanatos commented 3 months ago

Whats the exact problem, is the issue only that Partition E: shows RAW? To me this looks like a filesystem issue as long as the partition shows as mounted in DC UI all is close to being fine,

I would recommend you make urgently a header backup of that partition!!!!!!

Now depending how important and how unbackuped the data are there are 2 approaches:

1: You risk more damage and "chkdsk E: /F" might work, probably, no guarantees.

2a: You use some sector by sector imaging tool which would image the partition on a filter level after the DC driver so that you get a plaintext backup of the E: volume. Then you mount that volume and try "chkdsk E: /F"

2b: You use some sector by sector imaging tool when the volume is not mounted, you mount the image or restore it to an empty HDD then you mount it in DC and try "chkdsk E: /F"

Alternatively you could try some file recovery tool which reads the MFT and recovers files one by one, as this is a read only process, you dot need to image the entire disk.

WinHex (https://www.x-ways.net/winhex/index-d.html) is a tool I can recommend for disk editing, file recovery, and backing up.

You can also try a hybrid approach you recover the most precious files using a tool like WinHex and then try "chkdsk E: /F" on the volume to recover the rest which you are willing to loose if that goes bad.

hardbelit commented 3 months ago

after restart , i add the pwd and windows show the : stop code ntfs file system. this enter in restart , and try to recovery , but didnt recovery,

diagnosing fail

hardbelit commented 3 months ago

the hard Adata Legent 710 is nvme was is with windows 10 on a second computer

DavidXanatos commented 3 months ago

Well same thing you need to recover the files and you can try to recover the volume itself, windows repair never works as it lacks the DC driver mounting it on a different system, or running from a live windows is already the right approach.

hardbelit commented 3 months ago

so after i backup the Headers , i will try to decrypt., maybe i see the files

hardbelit commented 3 months ago

what you can recommend for point : 2a:

DavidXanatos commented 3 months ago

I would try chkdsk e: /F on the encrypted volume

DavidXanatos commented 3 months ago

2a: WinHex can do disk images

hardbelit commented 3 months ago

chkdsk E: /F sfc /scannow /offbootdir=E:\ /offwindir=E:\windows

image

image

image

I will try to see if work, on boot.

thank you

DavidXanatos commented 3 months ago

I'm glad I could help :)

hardbelit commented 3 months ago

Thank you a lot