Windows 10 Reset on Hitachi Deskstar
Table Of Contents
show
In this Windows 10 reset file recovery case, our client came to us for our Windows 10 reset file recovery services. When their computer had failed to start up, they tried to repair their operating system. Startup failure can happen for a whole host of reasons, and not necessarily due to hard drive failure.
In this recovery case, the client’s drive seemed fairly healthy. It’s very rare for an operating system like Windows 10 to directly cause a hard drive crash. But something had gone wrong with their new Windows 10 upgrade that was stopping their O/S from starting up. To get their Windows 10 PC up and running again, the client used its “Reset this PC” option to restore the operating system into working order. While Windows started up fine after a reset, the client soon found that some of their critical data had gone missing from their hard drive.
Windows 10 Reset File Recovery Case Study: Hitachi Deskstar
Drive Brand: Hitachi Deskstar
Model Number: HDS721010KLA330
Drive Capacity: 1 TB
Operating System: Windows 10
Situation: Reset was run on Windows 10 O/S to fix startup errors, deleting user files
Type of Data Recovered: Contents of two important folders
Binary Read: 99.9%
Gillware Data Recovery Case Rating: 9
Since Windows 8 and 10 came out, PCs have had more user-friendly options for getting your computer back in shape if Startup Repair can’t help you. One such option is “Reset My PC”, which reinstalls your operating system. It’s not quite the same as a full O/S reinstall or factory reset. Resetting your PC gets rid of all of your installed apps and programs. But this option also gives you the choice to keep or discard all of your personal files and settings. Resetting your PC may be the only way to get a misbehaving computer to work again. But, as with any major change you make to your computer, you have to be careful about what happens to your files when you reset your PC.
What Happens When You Reset Your PC?
It’s easier to understand what happened to this client’s data if you know what resetting your PC does. So let’s walk through the process. Imagine your PC fails to start up one day. You’ve tried running Startup Repair with your recovery disk or USB drive to no avail, so you check out Windows’ advanced recovery options. You go to “Reset this PC” and find two more options.
The first option reads, “Keep my files: Removes apps and settings, but keeps your files.” The second option reads, “Remove everything: Removes all of your personal files, apps, and settings.” Choose either of these options and Windows will do some major housekeeping on your hard drive. Resetting your PC replaces all of your registry files and PC settings with squeaky-clean, fresh-from-the-factory files and settings.
It will preserve Windows default apps and programs. But it won’t let any apps you’ve installed yourself stick around. Those will be uninstalled, and any traces of them deleted from your registry. While it’s doing all this spring cleaning, Windows makes a little list of all the programs it’s uninstalled and puts it on your desktop, so you can track down and reinstall as many as you wish.
If you choose “Keep my files”, the only thing Windows 10’s rigorous renovations will preserve will be the contents of your user profiles and your user settings. These are stored in the “Users” directory on your C:\ drive. This directory is where Windows expects its users to store all of their personal data, so Windows ignores its contents while it sweeps everything else away.
Windows 10 Reset File Recovery
In this Windows 10 reset file recovery scenario, the client had some of their most critical files stored in two folders. One folder was in the root directory of their C:\ drive. The other was located in their “Program Files” directory. Due to their locations, they were not safe from Windows’ ravaging. Because they weren’t inside the Users directory, Windows didn’t know that they were user-created, or had user-critical data in them. Computers are not very discerning or discriminating: They follow very specific and pre-ordained paths, and woe betide anything that gets in their way.
When you reset your PC, anything Windows has to replace gets replaced. Everything Windows has to keep gets kept. (Although things can and do go wrong on occasion.) Anything that is neither preserved nor replaced gets deleted.
We here at Gillware are well-acquainted with what happens when you delete files from a Windows computer. This is a standard logical data recovery situation for us. Windows uses the NTFS filesystem, which records which parts of the hard drive are being used in the bitmap. The bitmap keeps a record of all of the clusters on the disk. When a cluster is in use, the bitmap flags it as used. When a file is deleted, the bitmap removes this mark from its record of the cluster containing it. And finally, when new data gets written to the hard drive, your computer consults the bitmap to see which sectors are in use and which are free. Until the clusters with your deleted file in them get overwritten with new data, your deleted file can still be recovered.
Logical Deleted File Recovery
The client’s hard drive in this Windows 10 reset file recovery case wasn’t actually completely healthy. During the forensic imaging process, our engineers encountered a handful of bad sectors on the platters. These sectors had likely gone bad due to natural wear. Over time, sections of the magnetic fields produced by the different sectors on the platters can weaken and break down. As a result, our engineers were only able to get a 99.9% read on the client’s hard drive.
Despite that, after logical analysis our technicians were able to recover all of the client’s critical files. Fortunately, the client had not heavily used their hard drive after trying to repair their operating system. Had they written too much data to the drive after resetting their PC, the results could have been very catastrophic.
When data is written to a drive after file deletion has occurred, it sees the “empty” space on the hard drive where your data lives as fair game. Partially overwriting deleted data results in file corruption, and the corruption can range from minor to severe depending on how heavily the drive is used and how much of its “empty” space gets re-purposed.
Fortunately, our logical analysts found only very minor file corruption, none of it affecting the client’s critical data. Our engineers rated this Windows 10 reset file recovery case a 9 on our ten-point scale.
