Dell Precision laptop - changing BIOS to enable boot from USB

ann_droid

Good choice.

Ventoy might even trump my offerings...
https://www.pendrivelinux.com/yumi-multiboot-usb-creator/
https://github.com/mbusb/multibootusb/releases/tag/v9.2.0

MothballsWallet

Okay, so I tried this Knoppix-based environment and ... it didn't see the SSD and I couldn't mount it.

I've contacted Runtime Software and they told me that this Knoppix-based rescue tool was experimental (I did ask about NTFS-3G being included as the apt command didn't work but didn't get an answer to that).

They've recommended going with a WinPE one instead, which I'll try soon - I was going to use that, but their link to WinBuilder on theoven.org wasn't working the last time I tried to access it, possibly because a new version was being published.

[Deleted User]

Just going back a step, you said you are trying to recover a deleted file from what I assume is a Windows installation, did you try the following first of all:



I'm guessing you didn't have file history enabled like I have but it also work with restore points that are created monthly and when any major software upgrades / installs are done.

Depending on how old the file was, it might be captured in restore points - did you try right click the parent folder, select properties and previous versions?

Hopefully you've now implemented a backup process with file version history, much less painful that messing about trying to undelete files.

ann_droid

If W10 will boot from a USB stick or DVD try a recovery thataway.

https://www.raymond.cc/blog/manually-reset-or-clear-dirty-bit-in-windows-without-chkdsk/

ELSE...


The above is a few years out of date, but the kernel is still sound.
C:\> XCOPY C:\Users\* X : \  /e /i/ h/       still works.     


I doubt the excellent Piriform RECUVA is relevant.

May I suggest LinuxMint.

MothballsWallet

[Deleted User] said:

Just going back a step, you said you are trying to recover a deleted file from what I assume is a Windows installation, did you try the following first of all:



I'm guessing you didn't have file history enabled like I have but it also work with restore points that are created monthly and when any major software upgrades / installs are done.

Depending on how old the file was, it might be captured in restore points - did you try right click the parent folder, select properties and previous versions?

Hopefully you've now implemented a backup process with file version history, much less painful that messing about trying to undelete files.

Unfortunately that's not available - if I hadn't mentioned before, this is a work laptop and it's locked down by the IT department, and it has a shared folder where I could put files that to be backed up by the network backup system, but to put things in it required admin access. Even creating a restore point manually requires admin access.

I think the issue is the secure boot path option in the UEFI BIOS setup - I tried using the Linux environment on USB flash drive again but going via the UEFI menu options, and I saw the same problem.

There's a Secure Boot option in the BIOS that is available in Windows 8 (this laptop runs 7, but it could still be available) - this is set to "always, except internal HDD" by default according to the manual.

What I've read online is that Linux isn't fully compatible with this feature (possibly it will be in the future), and the Knoppix distro used as the base for this recovery system is from 2017 (as is the other software packaged in it), so I'll be checking that setting and changing it temporarily to see if that makes the HDD visible to Linux.

I'm thinking this is the issue because the HDD is always visible in Windows, it's just when I go into this Linux tool that it isn't.

Chino

MothballsWallet said:

if I hadn't mentioned before, this is a work laptop and it's locked down by the IT department

So why not ask your company's IT department if they can recover the deleted file for you? They're the ones paid to faff around with PCs, not you.

[Deleted User]

MothballsWallet said:

[Deleted User] said:

Just going back a step, you said you are trying to recover a deleted file from what I assume is a Windows installation, did you try the following first of all:



I'm guessing you didn't have file history enabled like I have but it also work with restore points that are created monthly and when any major software upgrades / installs are done.

Depending on how old the file was, it might be captured in restore points - did you try right click the parent folder, select properties and previous versions?

Hopefully you've now implemented a backup process with file version history, much less painful that messing about trying to undelete files.

Unfortunately that's not available - if I hadn't mentioned before, this is a work laptop and it's locked down by the IT department, and it has a shared folder where I could put files that to be backed up by the network backup system, but to put things in it required admin access. Even creating a restore point manually requires admin access.

I think the issue is the secure boot path option in the UEFI BIOS setup - I tried using the Linux environment on USB flash drive again but going via the UEFI menu options, and I saw the same problem.

There's a Secure Boot option in the BIOS that is available in Windows 8 (this laptop runs 7, but it could still be available) - this is set to "always, except internal HDD" by default according to the manual.

What I've read online is that Linux isn't fully compatible with this feature (possibly it will be in the future), and the Knoppix distro used as the base for this recovery system is from 2017 (as is the other software packaged in it), so I'll be checking that setting and changing it temporarily to see if that makes the HDD visible to Linux.

I'm thinking this is the issue because the HDD is always visible in Windows, it's just when I go into this Linux tool that it isn't.

Secure Boot doesn't prevent a drive being visible, it just stores a signature of all the key boot files in the firmware and checks them at boot time to ensure nothing malicious has been inserted into the boot loader.

Now you've said it is a work laptop, I wonder if the drive it Bitlocker protected? I would hope so, if you are storing company data on a portable device it really should be encrypted in case of theft or loss. If it is encrypted then Linux has no chance of accessing it.

Given that it is now 3 weeks since you deleted the file and I assume you've been working on the laptop during that time, I would expect the ghost of the deleted file could well have gone by now. Undeleting isn't 100% reliable and the longer you leave it the greater the chance it has been over-written for good.

ann_droid

Errr
Linux can be installed as a LEGACY or a SECURE BOOT.



As you can see my "A:" drive (yes W10 can/does use A as a drive) has OpenSuse installed for Legacy or Secure boot options.

So booting a live version should be possible from an option in the BIOS.

MothballsWallet

Hi everyone, sorry I've been away for a while. I've managed to secure a new job, so I'm leaving this one tomorrow (thankfully).

@Chino - we don't have an IT department (we had 1 IT guy, but his contract wasn't renewed about a year ago during the pandemic) and the only person with that access is the most senior manager. He locks everything down and keeps control of it (I can understand why from a business point of view).

The good news is, I've been able to find a slightly later backup that should have the same file version from what I was looking for, so I don't need to get this file back, and I'm leaving behind all my notes on the project it's from anyway.

victor2

Enjoy your a new job.

TRIM enabled SSDs actually wipe files out when they are deleted (assuming they are deleted from the trash), so nothing will recover it. SSDs are great, but you should have a backup!