How to get files back from crashed Windows 11 or Windows 10 PC computer - Method 1: Ubuntu Live USB

[@roderickwho1983]

Good job, Frank. Very clear explanations and instructions. Thanks.

[@frankwestphal8532]

Thank you!

[@johneaglin7541]

Awesome video! Just subscribed. Watched a couple of your other videos and appreciate your instructions that don't require turning to questionable commercial third party solutions! Now I'm going to watch the video on how to create a Windows 10 install media to do a clean install! Keep the videos coming!

[@frankwestphal8532]

Thank you! I appreciate it. I have a big list of videos that I will be slowly getting done. The least amount of variables used, while still accomplishing the objective(s), is what I always shoot for in my own systems (personal or professional), and in my videos.

[@mathias1967]

Thank you for the help! Great resource.

[@DinocrocutaGigantea]

You saved my files. I have done this when I was a kid but I couldn't remember, it was a windows xp at that time lol

[@frankwestphal8532]

Thank you for watching, and I'm so glad it helped! I've had to do this two times myself in the past.

[@Catnippp]

Thank you for this!! I could recover my files on a laptop that gave only a BSOD

[@frankwestphal8532]

Thank you for watching. And yes, that is a perfect scenario to use this method of file recovery!

[@NopeYesNope]

love u man! owe u a beer next time i get a chance!

[@frankwestphal8532]

Haha, thanks!

[@ncadventuretv4620]

Already boot up sir Frank but my storage says encrypted and its asking for a password I can't open the drive?

[@frankwestphal8532]

Hi and thank you for watching. If you were running windows on it, prior to trying to access the disk through an Ubuntu live USB, then the disk was most likely encrypted with windows bitlocker (but it also could have been a third party encryption application). In either case, a decryption key would been created when the disk was first encrypted. This is probably not what you want to hear, but unless you can find that decryption key somewhere (maybe it's on a USB drive, or maybe printed off on a piece of paper), you probably won't be able to get access to the disk ever again. However, the decryption key is probably stored on your TPM chip (that's usually how the disk gets decrypted with windows bitlocker while the computer is booting up). So, what I would try, if you can't find the decryption key, is to create a windows installation USB using the windows media creation tool. On the installation media USB, there are also a couple advanced recovery options that you could try to use to get your computer to boot windows again (without reinstalling windows). You only need to have it boot once, to turn off bitlocker disk encryption, or to just copy your files off the disk at that time. Here's are links to the windows media creation tools. Windows 10: www.microsoft.com/en-us/software-download/windows10%20 Windows 11: www.microsoft.com/software-download/windows11 I hope you can find the decryption key, but if not you might still be able to boot up your computer one last time to get your files back. I hope this helps!

[@alibomaye8]

Hello, is it possible to acces my data with Ubuntu boot usb knowing that the data is encrypted with bitlocker. I do have the key of bitlocker. Thank you

[@frankwestphal8532]

Hello, and this is a great question. I have not ever done this, but it can be done. But it will require installing an application onto the running Ubuntu live OS. I believe these are the steps, but there's another way that might be easier, and I describe it after these steps for installing/using the Ubuntu Dislocker application: Install the Dislocker package from the Ubuntu software repository: "sudo apt install dislocker" Create directories: "sudo mkdir /media/bitlocker" "sudo mkdir /media/mount" Use Dislocker: "sudo dislocker -r -V /dev/sdb1 -u[PASSWORD] -- /media/bitlocker" "sudo mount -r -o loop /media/bitlocker/dislocker-file /media/mount" Another option is to remove the disk from your windows computer, and use a USB to SATA adapter to mount the disk on another windows computer. When you do that, you'll be asked for the bitlocker password or USB key and you'll be able to access the disk. You can buy USB to SATA adapters for about $20, and they are super handy to have around. I'm actually going to make the follow up to this video (Method 2), showing that way as well. NOTE about the USB to SATA adapters: Get one with external power, becasue the ones without external power can only read 2.5" disks. They need external power to read 3.5" disks. This one looks pretty good, but you'll find a bunch of them. www.amazon.com/Mueuton-Adapter-Drive-Reader-Power/dp/B0CYY7L4FS/ref=sr_1_1_sspa?crid=1NKC1H15NP5MM&dib=eyJ2IjoiMSJ9.sZH9lXJcmWnDgpd2ol2DU9HZsZ9vXZBdRwwNJB5k84WikalPMJzgHcTdN9NBzM_WbaiuPp4dfBzz4ZwQxUmYXqr0VXRTc0ikJyNw9YKhuwH2wnlzyZkmmSHSHH8O7zZrK-KG9QbPsRQW4zqxcBTFazRDyRWJbh9xkrs-i9U7VN5y-_5igbJStcNkURsK2tUzA2_28APBV11_E4wS4Ji93D5-jn4kGAPvYM1Ee6ZFLd4.Y70W9xAhmiytNmoYRs67Jf-3HQuXbx_HL9Rooc4nlVU&dib_tag=se&keywords=usb%2Bto%2Bsata%2Badapter%2Bwith%2Bpower&qid=1729179928&sprefix=usb%2Bto%2Bsata%2B%2Caps%2C132&sr=8-1-spons&sp_csd=d2lkZ2V0TmFtZT1zcF9hdGY&th=1

[@robertstebbins4533]

Thanks!

[@frankwestphal8532]

Thank you!

[@tonygillam-t3r]

Frank, Good videos , question can I do a image of the hard drive , using windws11 21h2, insider version ?? Intel DQ4510H WITH UEFI CHECKED not sure can you help please

[@tonygillam-t3r]

Could I do a CLONE??

[@frankwestphal8532]

@@tonygillam-t3r Thank you! And the answer to your question is yes, as long as you already have that Win11 21h2 version running. So, there are a couple ways to do this, and the way you chose should depend on you intend to use a clone (which is also referred to as a system image). If you want a clone that can only be used on the same set of hardware (which includes but is not limited to, your DQ451 motherboard hardware), then the Win 7 Backup and Restore native app is what I use. But this is really good only for backing up and restoring file level backups and system images to the same exact set of hardware. I did a video on that if you want to see if that's a route you want o go: kzbin.info/www/bejne/fWSUqJ1orM6cbZY If you want to create an image that can be deployed to other sets of hardware you want to use some sort of disk cloning or system imaging 3rd party software. A couple I've used in the past are Acronis True Image, which was absolutely awesome but it was paid software, and Paragon Backup and Recovery, which was good and free. There are many out there now that I'm sure are good. But to be honest, I don't even do system images anymore, unless it were to be for large scale business deployment. I just keep all my data in google drive and if I want a new OS, I get a copy of all my software licenses, I install the new OS, manually configure it quickly, and then sync all my data back to the disk via google drive. I did a google drive video too if you want to check that out: kzbin.info/www/bejne/moCQlYKbgMhrn7s I hope this all helps!

[@TrueFailes]

Hello Frank! First of all thank you for your clear instructions. I've been following your steps, but unfortunately the C-Drive didn't appear (compare to minute 09:00). Is there any advice you can provide for making the C-Drive visible? Kind regards

[@frankwestphal8532]

Hi, and thank you for watching. I have not encountered this, so I'll do my best to provide some options. I did a little research, and the first thing I would do here, is boot into the BIOS of the computer that won’t successfully boot up windows and verify that you can see the physical system disk there (which would be your C: drive in windows but it won't be called that in BIOS... it'll just be the name of the manufacturer and model number). If you cannot see it in your BIOS, there is a hardware issue with the either the drive itself, or the computer. If you CAN see it, then somewhere in your BIOS (probably under the disk or drive options) there should be options for the way the drive is used by the system. If it is not set to AHCI, then set it to that, and try booting into Ubuntu live again. You should then see it. But… the drive probably already is set to AHCI in the BIOS. If that is the case I don’t have much more to offer for guidance, but here is a good link to a discussion about exactly this issue. askubuntu.com/questions/1079272/hard-drive-does-not-display-in-ubuntu-usb-live-session HOWEVER... if none of this works, you can still get your files back as long as the drive is working properly. I’m going to do another video on this soon (this was method 1 because there is another way), but I’ll describe the basic steps for you now. It requires removing the drive from the computer, then using an external USB to SATA adapter to mount the drive on a different computer, and view/copy the data off of it. I have one of these USB to SATA adapters and I have used it MANY times through the years for this exact purpose. They are very handy to have around. 1. Get one of these USB to SATA adapters (they’re about 20 bucks) on Amazon. If you go to Amazon and search amazon for “UGREEN SATA to USB 3.0 Adapter Cable for 3.5 2.5 Inch” you will find this UGREEN one, and it looks good. An important note about these adapters is that you want one with optional external power. The reason for this is that if does not have the option for external power, it will ONLY be able to read a 2.5” drive. The 3.5” drives require more power to run, than the USB port can provide. So, if you go this route, get one with external power to be sure you will be able to read your drive (as long as the drive itself is not broken). 2. Remove the drive from the computer that won’t boot. 3. Plug the drive in to that USB to SATA adapter, and plug the adapter’s USB port into a functional computer. 4. Open windows file explorer on the functional computer and you should see the drive and be able to start looking for the files/folders you need, and copying them off to the functional computer. Once you have your files/data, you can install a perfectly clean OS on the computer that would not boot, using that same drive, copy your data back to it, and everything will be running like new again. And a side note... once you get your data back, I highly recommend setting up Google Drive file sync application. Basically, once you have Google Drive file sync app running, you no longer have any risk of losing data, or having to do these various steps to recover data, ever again. I did a comprehensive video on Google Drive, here: kzbin.info/www/bejne/moCQlYKbgMhrn7s I hope this helps!

[@TrueFailes]

@@frankwestphal8532 Hello Frank! Thank you so much for your quick response and kind advice. I consider the information you've provided as extremely valuable. Greatly appreciated! I'll definitely give it a try as the drive doesn't appear in my BIOS anymore. Hence I'll go for the adapter-solution's you've been suggesting. I'll keep you updated! Not to forget: just subscribed to your channel. Of course I'll tell my friends and fellow students about your good work here on KZbin!

[@frankwestphal8532]

@TrueFailes Yes, please let us know how it turns out. These kinds of discussions create nice little pockets of information that others can use as well. And speaking of information archives, I thought of one other possibly reason this could be happening, and I suspect others will encounter it too so I want to get it documented (but you also can’t go wrong with a SATA to USB adapter… those are just good to have around and allow you to easily access and reformat disks in the future as well): Windows 10 can operate in legacy BIOS or UEFI boot modes. Windows 11 can ONLY operate in UEFI boot mode. Legacy BIOS boot mode partitions the system disk in MBR partitioning scheme, and UEFI boot mode partitions the system disk in GPT partitioning scheme. What could be happening is that your system disk is partitioned in legacy MBR, and your BIOS is set to UEFI boot mode. If that is the case, I don’t think your BIOS will be able to see the disk, unless you switch your BIOS to legacy boot mode. AND, if the Ubuntu live disk was created with the settings “GPT” and “UEFI” in Rufus, then that could explain why the Ubuntu live OS also cannot see the MBR partitioned system disk. The inverse of this could be true as well: (BIOS is in UEFI boot mode and system disk is partitioned in GPT, but the BIOS was switched back to legacy boot mode, so even the BIOS can’t see the GPT partitioned disk, and if Ubuntu live was created using “MBR” and “BIOS” settings, then Ubuntu live won’t be able to see the GPT partitioned system disk either). Now, I’m speculating on the boot mode of your computer, and subsequent partitioning scheme of your system disk, because I don’t have your system in my hands. But the likely solution to this, is to switch your BIOS boot mode to the opposite of whatever it is now, and then see if you can see that system disk in your BIOS. If you can, then re-create the Ubuntu live USB disk, with the corresponding boot mode and partitioning scheme settings that are optional in Rufus application, while creating the Ubuntu bootable USB disk. Basically, (when creating the Ubuntu live USB disk) you want the rufus boot mode and partitioning scheme settings to match whatever your computer and system disk are set to. And because windows 10 can operate in legacy BIOS boot mode OR UEFI boot mode, it can be a little tricky to match the settings correctly. With windows 11 for example, (because it can ONLY operate in UEFI boot mode), the rufus USB creation tool optional settings would ALWAYS be “GPT” and “UEFI”. But it could go either way for windows 10, depending on it how was originally installed, and therefore might require a couple attempts at creating the Ubuntu live bootable USB with either “GPT” and “UEFI” selected, OR “MBR” and “BIOS” selected. I know that was a lot but this was a great question, and this discussion will hopefully help others in the future. And thank you for subscribing!

[@TrueFailes]

​@@frankwestphal8532Hello Frank, it has been a while. I was following the instructions you've provided. Unfortunately it didn't work out. The SSD was locked by a Bitlocker eventually. Interestingly was the fact that I didn't enable the Bitlocker. Therfore, I got no key to unlock my SSD. After a lot of research it turned out Dell ships their devices with Bitlocker enabled. At least in my area. My SSD remains locked for the time being. However, I was able to recover about 80 percent of the data, which is quite a lot. My critical stuff was always stored externally, but still the situation is quite unfortunate. I've learned a lot due to the ideas you've been providing and the intense research sessions. After this incident I configured my own cloud storage and switched to Manjaro Linux. This distribution fits me well since I am a CS student focusing on programming. I hope I could contribute at least a bit to the community. To everyone reading this: please make sure to check system settings right from the start. Kind regards!

[@ichigo5494]

Hi Frank! I had a quick question. So I have a MacBook Air (13inch early 2015) and I want to use it to learn coding. It only has 4 GB of ram and 256gb storage. It has been very slow for the past couple of years with lots of unnecessary files/programs so I was thinking of clean installing the macOS and only putting the important files on it. But I wanted to make it more efficient. I was thinking of replacing the hard drive with an ssd (with an M2 adapter since the ssd isn’t compatible with this model). But I’m not sure if this would help. Or what steps I should take to make my computer efficient. I don’t really know too much about computers so I’m kind of lost haha. Any advice would be greatly appreciated!!

[@frankwestphal8532]

Hi, and thank you for this question. You are definitely on the right track in how you're thinking here. Nice work. A clean install of the OSx operating system will help for sure, and the SSD will too. They are likely both contributing to the slowness a lot, and most likely so is the 4GB of RAM. The mechanical hard drive definitely is. SSDs are MUCH faster than mechanical hard drives. If you can, while you're inside the computer, upgrade the RAM to 8GB, and you'll be good to go. It'll be night and day between current performance, and after those upgrades. IMPORTANT NOTE: Make sure to watch some videos, or look at diagrams, of exactly what the inside of your specific model of Macbook Air looks like to make sure that any upgrades you buy, you will be able to install. I have not done hardware upgrades on macbooks before, and becasue the Air model is so thin, some components may be permanently installed. So just be aware that some components may be soldered to other components or the motherboard. It (should) be straight forward, but there might some curveballs on a computer that thin. But even if you do encounter that, there's a good chance the upgrades can still be done, if you research the alternative ways of doing upgrades on that model.

[@ichigo5494]

@@frankwestphal8532 Thank you for the swift reply! So I looked at my model and apparently the RAM is soldered to the motherboard. I looked for some tutorials to increase the ram and they all look extremely difficult since they melt it or something like that. For the SSD I found the Crucial P2 1TB NVMe and found an M2 adapter to connect it to the computer. I’m between Crucial and Western digital SN550. But I’ve heard Crucial is better. What do you think? Also this is a bit off topic but I wanted to ask what type of degree or program you studied in? Or what type of job you are in? I’m interested in working with computers and have heard that software engineering jobs and coding (especially self taught) is declining with advances in AI. Not really sure how IT falls into all of this. I was thinking of doing some sort of bootcamp or if there was a program I could do which would help me get straight into a job? Thank you!!

[@BlueWing2909]

Ubuntu doesn't see the internal SSD with windows11 on it at all, although the partitions are visible with a windows bootable USB. The internal SSD may be of M2 type on a 10th gen I5 proc.😕

[@frankwestphal8532]

Hi, and thank you for watching. Try re-creating the Ubuntu bootable USB disk with the settings in rufus set to: Partition Scheme = GPT Target System = UEFI Ubuntu live should then see the windows 11 system disk. @TrueFailes and I have been having a discussion about this because they encountered a similar issue, and I think I know what's going on now (if you scroll down you can see our entire thread). Below is a copy/paste from what I just wrote in that discussion, and should help provide context if you're interested. Windows 10 can operate in legacy BIOS or UEFI boot modes. Windows 11 can ONLY operate in UEFI boot mode. Legacy BIOS boot mode partitions the system disk in MBR partitioning scheme, and UEFI boot mode partitions the system disk in GPT partitioning scheme. What could be happening is that your system disk is partitioned in legacy MBR, and your BIOS is set to UEFI boot mode. If that is the case, I don’t think your BIOS will be able to see the disk, unless you switch your BIOS to legacy boot mode. AND, if the Ubuntu live disk was created with the settings “GPT” and “UEFI” in Rufus, then that could explain why the Ubuntu live OS also cannot see the MBR partitioned system disk. The inverse of this could be true as well: (BIOS is in UEFI boot mode and system disk is partitioned in GPT, but the BIOS was switched back to legacy boot mode, so even the BIOS can’t see the GPT partitioned disk, and if Ubuntu live was created using “MBR” and “BIOS” settings, then Ubuntu live won’t be able to see the GPT partitioned system disk either). Now, I’m speculating on the boot mode of your computer, and subsequent partitioning scheme of your system disk, because I don’t have your system in my hands. But the likely solution to this, is to switch your BIOS boot mode to the opposite of whatever it is now, and then see if you can see that system disk in your BIOS. If you can, then re-create the Ubuntu live USB disk, with the corresponding boot mode and partitioning scheme settings that are optional in Rufus application, while creating the Ubuntu bootable USB disk. Basically, (when creating the Ubuntu live USB disk) you want the rufus boot mode and partitioning scheme settings to match whatever your computer and system disk are set to. And because windows 10 can operate in legacy BIOS boot mode OR UEFI boot mode, it can be a little tricky to match the settings correctly. With windows 11 for example, (because it can ONLY operate in UEFI boot mode), the rufus USB creation tool optional settings would ALWAYS be “GPT” and “UEFI”. But it could go either way for windows 10, depending on it how was originally installed, and therefore might require a couple attempts at creating the Ubuntu live bootable USB with either “GPT” and “UEFI” selected, OR “MBR” and “BIOS” selected.

[@slal06]

I can’t see the SDA 1 partition. Can you kindly help?

[@frankwestphal8532]

Hi. Thank you for watching. A couple things here that might help: Can you see the disk itself in Ubuntu File Explorer? It should be in in "Files > Other Locations". If it is not showing up there, it may be formatted in a format that Ubuntu cannot read. I did a little digging and I would read through these links, and possibly try using the "ldmtool" to show the partitions on your system disk: askubuntu.com/questions/1439499/cannot-see-my-internal-hard-disk manpages.ubuntu.com/manpages/trusty/man1/ldmtool.1.html If that doesn't work, there is always the option of using a "USB to SATA adapter" to mount the disk on a different windows computer. They cost about 20 bucks on amazon, and they are SUPER handy to have around for situations like this. Quick note on the adapters... make sure that if you get one, it has the external power option. A USB port only has enough power to run a 2.5" disk, so if the USB to SATA adapter does not have external power, it will not be able to run a 3.5" disk. I hope this helps!

[@Gabsbuzz]

Thank you for this video, Frank. I've followed your steps just to find out that my drive is actually encrypted. Would you have a solution for that at all? Many thanks.

[@frankwestphal8532]

Hi, and thank you for watching. This is a GREAT question and a tricky scenario. If you have the encryption key, then technically you CAN decrypt the drive. More on that below... If you don't have the decryption key I probably wouldn't pursue it any further because that would be, at the very least very hard, or impossible altogether. I have never decrypted a drive without the encryption key, but with access to extremely high speed computers it is possible to try every potential encryption key for some encryption algorithms (older ones because they have less possible outcomes). If you have absolutely essential data on the drive for some reason, there are services that will attempt to decrypt it, but they are expensive and you would have to physically send them the drive. If you DO have the encryption key, then the first step would be to determine how it was encrypted to begin with (and maybe you know it already... examples; Microsoft Bitlocker, or a handful of other IT deployed endpoint security software). If, for example, a previous IT department encrypted the drive, ask them about this because they would most likely still have the decryption key and might easily be able to decrypt it for you. Whatever application encrypted it would be able to decrypt it easily with the key. It technically doesn't even need to be the same application that encrypted the drive to decrypt it, if you have the decryption key, but it is usually easier that way because the manufacturer of the encryption application probably has an easy to use decryption tool available on their website. If the drive was independently encrypted (you encrypted it or some other person did) but you have the key, there would still be a decent learning curve required to run a decryption application, with the correct decryption key, on the drive, while running Ubuntu live. I have not done this but it probably can be done. But if you have the key, and know what application was used to encrypt the drive, this is what I would do because even though it's not super easy (none of these options are) it'll be the fastest way to access it: Get a USB to SATA adapter off Amazon or anywhere else (these are pretty common and cost about 20 bucks), then pull the drive out of the computer, and plug in it to that USB to SATA adapter on a functional windows computer. Look for a decryption tool online directly from the software manufacture that made the encryption application which was used to encrypt the drive in the first place. Download their decryption tool, plug in the decryption key, target the encrypted drive that is connected to the functional windows computer via the USB to SATA adapter, and decrypt it. NOTE: If it is a 3.5 inch drive the USB to SATA adapter needs to be one that has external power, because a USB port does not supply enough power to power a 3.5 inch drive, but it DOES supply enough power to run a 2.5 inch drive. And one last thing... I've mentioned the decryption key many times, but I want to clarify exactly what an encryption key looks like... it's literally just a long series of numbers, usually in a text file. The series of numbers IS the key. For example, this IS a bitlocker encryption/decryption key: 28XX21-6XXXX9-603152-44XXX2-657921-689XX6-2XXXX2-074613 (I've X'd out some of the numbers for security, but this series of all these numbers IS a bitlocker decryption key) Encryption algorithms are just complex math. A decryption application will ask you to point it to a text file with the key, or just ask for the key (series of numbers) directly. I know that's a lot, but I want to be thorough in answering questions, and I hope this helps!

[@Gabsbuzz]

@frankwestphal8532 Wow, now that's what I call a thorough reply! Thank you so much for this, Frank, the laptop in question is a new Lenovo Yoga that I've had for only a month so I'm assuming the company encrypts their drives as a standard? I've messaged them (since it's under warranty) and I'm going to wait and see if they actually provide the encryption key before I attempt any other possible remedies. I will keep your reply at hand for its rich informational value and in case I come across this issue again. Thank you muchly!

[@lc6378]

Is it possible to save the file saved in 'Desktop'? 🙏

[@frankwestphal8532]

Yes, and 07:48 I show how to get any files from anywhere on your windows C: drive.

[@lc6378]

I see, thanks for your help♥️

[@Yucuuf]

u still up ?

[@frankwestphal8532]

Hi. I usually get to reply to comments in about a day or 2. Let me know if you have a question.

[@Yucuuf]

@@frankwestphal8532 i have nothing to ask to be honest , but i was wondering like the last video uploaded is one year ago ig I'd like to see you uploading about what you love again :-)

[@mr.25565]

Thank you for the information ❤

[@frankwestphal8532]

You're welcome, and thank you for watching!