Hi guys, I have a tricky case here. Client gives an inhouse tech support two laptops to backup data from the old laptop to a new one. One old laptop with an internal 1TB SSD with roughly 800Gb of user data running windows 11 and a new laptop with 1TB SSD fresh installed windows 11. The tech used an external SSD inclosure to clone the old drive to the new laptop but instead he cloned the new one to the old one by mistake, as he discribed it. Data is gone obviously and they brought it to me "immediatly" without making any attempts to recover the files. I created a byte to byte image of both SSDs on to my machine. I'm inspecting the images of the old SSD with the files now. Both the client and the tech say there was no encryption on the old laptop.but i found a 951Gb Bitlocker encrypted partition but the buffling part is i'm able to scan it with minimal content. I'm guessing it is from the new SSD. But no single file from the old SSD whatsoever. Anyone wants to have a look, i can provide more detail about the partitions or provide virtual access to the images. Client is willing to pay. Appriciate any feedback

If the client created a byte-by-byte clone of the new Win11 1TB SSD on the old 1TB SSD, then obviously every single byte in the UA has been overwritten. The only stuff that may be recoverable is whatever is in the over-provisioned space.

_________________
A backup a day keeps DR away.

Thank you for the reply brother. R-Studio does not show even a trace of the old files. Do you recommend anyone to have a look at the image file maybe? The client needs the file.

Could be bitlocker w/o encryption enabled and RS is picking up a BitLocker sig throwing you off.

Would suggest you review HEX instead of using software to determine if there is actual data. This will give you direction on if you need to bit locker decryption then scan, or if TRIM has been executed.

Yes, i believe thats the way to go too, unfortunatly i can't do that here. Would you like to have a look i can give you access to my machine. Like i said the client is willing to pay.

Try this for viewing hex:

https://mh-nexus.de/en/hxd/