HDD GURU FORUMS

I created an image of a 512 GB NVME SSD using HDDsuperclone. When I scan the image using DMDE i can see files but it looks as if the drive was from a new windows install. All the dates are from 2019 when the computer was purchased. My family member stated the computer was working fine then was doing some update and when it rebooted it crashed. I asked if they did a restore or reimage and they stated no.

Is there a setting in DMDE that will find the missing files? Any suggestions greatly appreciated.

Can you mount the image file with OSFMount?

https://www.osforensics.com/tools/mount-disk-images.html

If so, mount it, take note of the drive letter, then drop into a CMD prompt and type ...

Code:

dir X:\*.* /s > C:\dirlist.txt

... where X is the drive letter.

This should list all the files in all the folders and save the list to a text file. You can then open the text file in NotePad, etc.

DMDE can also create a file list.

https://dmde.com/manual/datarecovery.html

7Zip is another free tool that can extract files from file system images.

Are you looking at the recovery partition rather than the data partition

Lardman wrote:Are you looking at the recovery partition rather than the data partition

attached are Rstudio images of what i see. There are users profiles missing that i am trying to find.

From my experience this is a drive that has an Optane cache on it as well typically 32gb Optane cache/ 512gb SSD.

Either the Optane cache is bad/empty, or your computer cannot recognize Optane devices.

You can try and image it from the computer it came from and see if it recognizes the Optane cache.

You will need that Optane cache for recovery