Help recover data! [Information contained in unallocated area]

Question

Data recovery

It was deep night. I think this is where you should start.

I have (/was) Windows 8. I decided to install Hackintosh, since it was not very convenient to develop on a virtual machine. There is such an image that rolls onto an unallocated memory area and makes its own loader to select the OS at system startup.

Rolled up, rebooted. Mac OS won't boot, reboot, boot with the -v switch to see what the problem is. Everything loaded normally, then it wrote that it could not mount the disk, where Windows is installed, because. she is in hibernation, launches CHKDSK at the same time and thinks for a very long time.

Windows does not boot from the new loader either, it asks for a recovery disk. I think, to hell with that poppy, I will sit on a virtual machine. I insert a recovery disk to restore Windows and the loader.

I insert a disk, try to restore, I get a message:

The drive where Windows is installed is locked. Unlock the drive and try again.

I read on the Internet that programs that break up a hard drive can block a disk in this way. I really launched one of these, but it never started, swearing at compatibility problems.

I go to the command line.
I think we should try to restore the Windows loader.

BootRec.exe /fixmbr
BootRec.exe /FixBoot.

After the last one, I got Element not found.

OK. I decided to make the disk with the poppy inactive to boot the OS from it.

diskpart
select disk 0
select partition 3 (with poppy)
inactive

But this seemed to me not enough. I think I'll make sure that the disk is not bootable at all. And I write:

clean

As I understand it, this command applies not only to the logical drive, but to the entire hard drive.

And now we read.

This will show you how to use the clean command on a selected disk to delete all of it's MBR or GPTpartitions, volumes, and any hidden sector information on MBR disks is overwritten. The data on the HDD is not written over using the clean command like it does with the clean all command below. With the clean command, the data on the HDD is only marked as being deleted instead and is only written over when new data is written/saved to the same location on the HDD next.

It turns out that the information remained and it is located in an already unallocated memory area marked for deletion.

Also wrote:

bootsect /nt60 all

It didn't help either.

What is the result?

• If you choose to install Windows, then you see 600 GB of unallocated space

• Wmic logicaldisks get caption,size,freespace
  

  does not see logical drives

• diskpart
  select disk 0
  list partition

  
  It doesn't see disks either.
• If you boot from a live-cd with Linux, the disks are also not visible.
• If I try to restore Windows, I get the same:
  

  The drive where Windows is installed is locked. Unlock the drive and try again.

You can't format anything, there are recent projects, photos.

What to do? How to return data? Can I somehow return the logical drives? Is it possible to at least copy all the information somehow? Maybe write somewhere else? Should I take my laptop to a data recovery service?

UPD1. Thanks to the advice , ur3ckr booted from a Linux live-cd and repaired the partitions using the testdisk utility. Further on the unallocated space (where the poppy used to be) installed Windows. The data is all there. But I would like to fully understand and restore the old version of Windows (now I have, it turns out, 2 disks with Windows and 2 with data), all the same there are programs and the rest. But when I try to restore I get the same:

The drive where Windows is installed is locked. Unlock the drive and try again.

At the same time, you can go to it (in the second Windows), copy the data, the disk as a disk. What kind of blocking are you talking about? And how can you heal?

UPD2. There are a lot of angry reviews on the Internet about such a disk lock. It sometimes occurs after installing updates. And yes, in fact, before all these events, Windows decided to install a whole bunch of updates. Couldn't unlock the drive. I saved the data, I reinstall Windows. All plus in karma. Thank you!

Answer 1

Perhaps testdisk will help to return the partitions. Helped out a few times.

Answer 2

You can copy, for example, using R-STUDIO .
Hasn't let me down so far.
Scans, finds "former" partitions, and files on them. Restores very successfully. I use 4. [with something] version, now there is a newer one.

Answer 3

GetDataBack. In the settings, set quick scan, deleted files, $mft only. With this config, it searches in a few minutes.

Answer 4

Some time ago, I also encountered the problem of data recovery, many files were recovered only through this program .