We help IT Professionals succeed at work.

Deleted partitions by accident - complicated by encryption

I have a 1Tb disk running Windows 10. The system partition was encrypted by veracrypt but I later wanted to switch to bitlocker instead.  What I didn't realise on enabling bitlocker was that the partition was still encrypted by veracrypt.  So now the system partition has  encryption from bitlocker and the whole thing is also encrypted by Veracrypt.  So when you boot up, you have to put in the veracrypt password.  Then, since TPM was causing issues with bitlocker (not the problem I'm trying to solve here), you then had to put in the bitlocker recovery key, each time. Windows would then boot as normal, until you next rebooted when that 2-step process had to be repeated.

In an attempt to try update the bios, I wanted to install W10 temporarily on an external disk.  Unfortunately, in my haste, I deleted all but the recovery partition on the PC's hard disk during windows 10 install.  I didn't actually install anything - I realised what I had done and cancelled the whole process.

So, my issue is to recover these deleted partitions.  

I've tried testdisk, but after the 2hr search I get this:

 
92fbfd67-7fb8-4f5f-bb70-2ae647f4b2e6.jpg
I declined to do the more in-depth test

I next tried Acronis Recovery Expert from within Acronis Disk Director.  This, has found dozens of partitions formatted Ext4, which I guess is because of veracrypt.  The first few are of size 913.4Gb, then the next few are 913.3Gb and so on until 913.1Gb.  I'm going to leave it run over night, but this does not look promising.  

A backup from November shows the partition looking like this

Capture.JPG


So my question is - given the complications of veracrypt and bitlocker, what would be the best steps for recovering these partitions?
Comment
Watch Question

Principal Software Engineer
Commented:
It is unlikely that recovery tools will be able to operate on the drive due to the double encryption.  The drive would have to be unencrypted for them to work -- the markers they are looking for aren't there.

In this situation I'd restore the drive from the most recent full backup.
Distinguished Expert 2019

Commented:

The encryption does not matter. If a partition recovery tool is able to restore the old structure, all data will be there. I have not used many, but what performed better than testdisk, was "getdataback simple", see   https://www.runtime.org/data-recovery-software.htm - it cost 80 US$.

David FavorFractional CTO
Distinguished Expert 2019

Commented:
As McKnife mentions, any good partition recovery tool will work.

The free option, is to just do a reinstall + restore a backup.

Author

Commented:
Hard to know who was really right here since all things considered, I judged restoring the backup to be the best option at that point. It's just that the backup wasn't quite as recent as I would have liked. But I also had separate and up-to-date file backup in the cloud, so I'm nearly out of the woods.  Thanks so much to everyone who took the time to help.
Distinguished Expert 2019

Commented:

The partitioning info is not encrypted, so you would have been able to restore it if only the tool was able to see it (and test disk has not done anything wrong, before). Backup always wins :-)