Anything related to computer forensics (new section!)
March 29th, 2026, 14:34
Hi Guys, I come from Germany and my English is not perferct. Sorry for first when it is wrong here.
I’m trying to recover data from a Kingston NVMe SSD (1TB).
Situation:
The drive originally had multiple partitions (several Windows installs + a large data partition ~500–600GB at the end of the SSD)
Partition table is now gone / overwritten
Currently detected as a single NTFS volume (~953GB) with only ~5GB of visible data (after broken Win Reset from Win10 or 11 recovery USB Stick: normal blue screen at the beginning. 2 possibilies: keep my files or remove all. I have clicked on "keep my files", but few minute after I think. OMG and Stop the process.
Observations:
Full disk scan (UFS Explorer, TestDisk) finds only:
current NTFS
RAW fragments (misidentified as 7z archives)
No valid old partitions detected
In hex editor:
disk is NOT empty (no large zeroed areas)
multiple NTFS boot signatures ("NTFS") can be found in the ASCii Test
but no consistent filesystem structure (likely missing MFT)
Encryption:
BitLocker was likely used on previous partitions
I have multiple recovery keys, but don’t know which belongs to which volume
Questions:
Is it still possible to reconstruct BitLocker volumes if only fragments of structures remain?
Can professionals identify BitLocker headers and match them with keys?
If TRIM was active, would the data appear as random but still “filled” in hex, or actually be zeroed?
Any recommended approach beyond standard software tools?
Drive is currently not being written to.
Thanks for any insight
March 29th, 2026, 19:34
Given the mess it may be a long arduous task to try to recover what you can
NTFS marks blocks as unused but does not write zeros to them
March 30th, 2026, 16:37
Partition table is now gone / overwritten
Why? How did this happen?
April 18th, 2026, 23:31
If you have a Microsoft account you may be able to get your recovery key from account.microsoft.com you can recover encrypted partitions to some extent
Powered by phpBB © phpBB Group.