Forum Discussion

Copper Contributor

Dec 28, 2020

Upgrading Windows 10 Pro to 20H2 corrupts data partition

Hello,

Upgrading Windows 10 Pro on a Dell Latitude E5570 to version 20H2 results in data partition D becoming inaccessible after upgrade rebooted, showing as RAW partition. Rolling back the upgrade (on a clone disk) didn't help.

Examining the 312GB D partition and the preceding 500MB recovery partition which existed prior to the upgrade - shows random data with no NTFS meta/descriptors/file/indexes, while in both partitions the first and last sectors are identical (encrypted NTFS?).

Here are a few upgrade setupact.log highlights:

2020-12-23 10:38:29, Info CONX ConX::Compatibility::CSystemAbstraction::GetVolumeEncryptionState: Volume C: is unencrypted.
2020-12-23 10:38:29, Info CONX ConX::Compatibility::CSystemAbstraction::GetVolumeEncryptionState: Volume D: is unencrypted.
2020-12-23 10:38:29, Info CONX CBitlockerNoTargetSupportChecker: checked BitlockerNoTargetSupport, found NoIssue.

2020-12-23 10:38:54, Info SP CNewSystem::PreInitialize: Velocity feature state for BitLocker auto-unlock is enabled
2020-12-23 10:38:54, Info SP Client requested to keep BitLocker active, but the device does not support it. Will suspend BitLocker instead.

2020-12-23 10:40:34, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
2020-12-23 10:40:34, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)

2020-12-23 11:14:20, Info [SetupPlatform.exe] --Install on target OS step 1: collect info like partition list, loading reagent.xml, source winre.wim and partition
2020-12-23 11:14:21, Info [SetupPlatform.exe] Enumerate and log all fixed partitions:
2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info--
2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{45f767b0-3249-44f1-851e-c40934eaec83}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition1
2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 1, offset: 1048576, free space: 44683264, total space: 100663296
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:0, Mbr:0, Active:0, Boot:0, BitlockerEnabled:0
2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info--
2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition5
2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 5, offset: 189096001536, free space: 6272868352, total space: 335543267328
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:1, Mbr:0, Active:0, Boot:0, BitlockerEnabled:0

(here partition 5 looks valid, NTFS, BitLocker disabled)

2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info--
2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{228a9826-abc4-4ab0-bc5a-ff28e52bd50a}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition4
2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 4, offset: 188530819072, free space: 86437888, total space: 564129792
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:1, Mbr:0, Active:0, Boot:0, BitlockerEnabled:0
2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info--
2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition3
2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 3, offset: 122683392, free space: 29369483264, total space: 188407099392
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:1, Mbr:0, Active:0, Boot:1, BitlockerEnabled:0
2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 
2020-12-23 11:14:21, Info [SetupPlatform.exe] Get downlevel ReAgent config
2020-12-23 11:14:21, Info [SetupPlatform.exe] Downlevel config file path: C:\Recovery\ReAgentOld.xml
2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking for downlevel WinRE installation.
2020-12-23 11:14:21, Info [SetupPlatform.exe] First round search
2020-12-23 11:14:21, Info [SetupPlatform.exe] Get ReAgent config
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetReAgentConfig Config file path: C:\WINDOWS\system32\Recovery\ReAgent.xml
2020-12-23 11:14:21, Info [SetupPlatform.exe] CheckRegKey test hook (SystemSetupInProgress) present or enabled
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetReAgentConfig System setup is in progress.
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(IsAutoRepairOn) failed: 0xd
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(IsServer) failed: 0xd
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.Dir): 0xd
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.DiskSignature): 0xd
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.Offset): 0xd
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.DiskId): 0xd
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(IsWimBoot) failed: 0xd
2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(NarratorScheduled) failed: 0xd
2020-12-23 11:14:21, Info [SetupPlatform.exe] Update enhanced config info is enabled.
2020-12-23 11:14:21, Warning [SetupPlatform.exe] Failed to get recovery entries: 0xc0000225
2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetWinReGuid returning 0X490
2020-12-23 11:14:21, Info [SetupPlatform.exe] ReAgentConfig::ReadBcdAndUpdateEnhancedConfigInfo WinRE disabled, WinRE Guid could not be determined (0x490) 
2020-12-23 11:14:21, Info [SetupPlatform.exe] FindWinReSourceImageAndPartition using winre.wim from C:\WINDOWS\System32\Recovery
2020-12-23 11:14:21, Info [SetupPlatform.exe] --Install on target OS step 2: detect and fix if there is any issue for winre settings
2020-12-23 11:14:21, Info [SetupPlatform.exe] DetectAndFixWinReIssues nothing to do because winre is not enabled.
2020-12-23 11:14:21, Info [SetupPlatform.exe] --Install on target OS step 3: check if we can keep winre.wim in the same partition if it is staged.
2020-12-23 11:14:21, Info [SetupPlatform.exe] --Install on target OS step 4: check if we can put winre.wim in other partitions or create one if needed.
2020-12-23 11:14:21, Info [SetupPlatform.exe] CanPutWinREOnOtherPartitions WinRE is not staged. Searching for a suitable partition for WinRE.
2020-12-23 11:14:21, Info [SetupPlatform.exe] Entering FindTargetPartition
2020-12-23 11:14:21, Info [SetupPlatform.exe] RegLoadKey $OFFLINE$SYSTEM failed. Error: 0x3.
2020-12-23 11:14:21, Info [SetupPlatform.exe] Start looping through each partition and initialize os partition, recovery partition and system partition for MBR
2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 1048576, partition number: 1
2020-12-23 11:14:21, Info [SetupPlatform.exe] skip GPT Partition which type is not PARTITION_MSFT_RECOVERY_GUID
2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 189096001536, partition number: 5
2020-12-23 11:14:21, Info [SetupPlatform.exe] skip GPT Partition which type is not PARTITION_MSFT_RECOVERY_GUID
2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 188530819072, partition number: 4
2020-12-23 11:14:21, Info [SetupPlatform.exe] MeetPartitionRequirements Partition details: {Offset: 188530819072, Free space: 86437888, Total space: 564129792}
2020-12-23 11:14:21, Info [SetupPlatform.exe] MeetPartitionRequirements WinRE WIM size: 467832158
2020-12-23 11:14:21, Info [SetupPlatform.exe] MeetPartitionRequirements Required free space: 522358110
2020-12-23 11:14:21, Warning [SetupPlatform.exe] MeetPartitionRequirements Not enough free space req = 522358110 avail = 86437888 offset = 188530819072 
2020-12-23 11:14:21, Info [SetupPlatform.exe] skip partition because it does not meet WinRE requirements
2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 122683392, partition number: 3
2020-12-23 11:14:21, Info [SetupPlatform.exe] find OS partition
2020-12-23 11:14:21, Info [SetupPlatform.exe] Complete looping through each partition
2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #1: try existing WinRE partition
2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #2: try first recovery partition
2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #3: try system partition for MBR
2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #4: try new recovery partition if allowed
2020-12-23 11:14:21, Info [SetupPlatform.exe] Attempting to create a new partition for WinRE
2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetNewPartitionWithCoInit Will shrink the OS volume with : 575835486 
2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetNewPartitionWithCoInit Will create partition with size: 574786910 
2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetVolumeGUIDPath returning \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\
2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetNewPartition root: C:\WINDOWS OS volume GUID: \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\
2020-12-23 11:14:30, Info [SetupPlatform.exe] winrePInitVDSService returning TRUE
2020-12-23 11:14:30, Info [SetupPlatform.exe] winreEnumerate returning TRUE
2020-12-23 11:14:30, Info [SetupPlatform.exe] winreEnumerate returning TRUE
2020-12-23 11:14:30, Info [SetupPlatform.exe] winreProcessPack returning TRUE
2020-12-23 11:14:30, Info [SetupPlatform.exe] winreEnumerate returning TRUE
2020-12-23 11:14:30, Info [SetupPlatform.exe] winreProcessProvider returning TRUE
2020-12-23 11:14:30, Info [SetupPlatform.exe] winreGetVolumeGUIDPath returning \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\
2020-12-23 11:14:30, Info [SetupPlatform.exe] winreShrinkVolume Shrinking the OS volume with: 575835486 
2020-12-23 11:14:46, Warning [SetupPlatform.exe] winreShrinkVolume Shrink operation reclaimed less bytes than we have requested. Reclaimend bytes: 22528c00, requested bytes: 22528d5e
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreShrinkVolume returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreGetVolumeGUIDPath returning \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}\
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume Skipped 1b9f2659 flags = 0x898460 \\?\GLOBALROOT\Device\HarddiskVolume5 \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}\
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume Mismatch: \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}\ \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000000000000 0000000000004400 00000000 32767
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000000004400 00000000000fbc00 00000000 1
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000000100000 0000000006400000 00000000 4
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000006500000 0000000001000000 00000000 5
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000007500000 0000002bbb9db000 e94ba37b 2
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002bc2edb000 0000000022625000 00000000 1
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002be5500000 0000000021a00000 00000000 3
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002c06f00000 0000000000100000 00000000 1
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002c07000000 0000004e1ff00000 1b9f2659 2
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000007a26f00000 000000001c37de00 00000000 1
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreCreatePartition Will create partition at offset: 187953950720 with size: 574786560 
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreCreatePartition create partition successfully, actual offset is: 0x2BC2F00000
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreCreatePartition returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessPack returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessProvider returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreGetNewPartition returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] winreGetNewPartitionWithCoInit returning TRUE
2020-12-23 11:14:46, Info [SetupPlatform.exe] New WinRE partition created
2020-12-23 11:14:46, Info [SetupPlatform.exe] Found target partition: use the new WinRE partition, offset: 187954102272
2020-12-23 11:14:46, Info [SetupPlatform.exe] Exit FindTargetPartition returns with status code: 0x0
2020-12-23 11:14:46, Info [SetupPlatform.exe] --Install on target OS step 5: set WinRE settings and restore system to a good state when hitting any errors
2020-12-23 11:14:46, Info [SetupPlatform.exe] Enter SetWinRESettings
2020-12-23 11:14:46, Info [SetupPlatform.exe] RegLoadKey $OFFLINE$SYSTEM failed. Error: 0x3.
2020-12-23 11:14:46, Info [SetupPlatform.exe] Copying WinRE from C:\WINDOWS\System32\Recovery to staging location on \\?\GLOBALROOT\device\harddisk0\partition6
2020-12-23 11:14:47, Info [SetupPlatform.exe] Copied WinRE to staging location
2020-12-23 11:14:47, Info [SetupPlatform.exe] Creating BCD entry
2020-12-23 11:14:47, Info [SetupPlatform.exe] WinRE created BCD entry: : {EF81C3A8-4552-11EB-81BE-875CAD832DA7} 
2020-12-23 11:14:47, Info [SetupPlatform.exe] Moving Winre and boot.sdi from staging location to target
2020-12-23 11:14:47, Info [SetupPlatform.exe] Moved Winre and boot.sdi from staging location to target
2020-12-23 11:14:47, Info [SetupPlatform.exe] Updating reagent.xml
2020-12-23 11:14:47, Info [SetupPlatform.exe] Set WinRE location path to: \Recovery\WindowsRE
2020-12-23 11:14:47, Info [SetupPlatform.exe] Set recovery guid
2020-12-23 11:14:47, Info [SetupPlatform.exe] Set scheduled operation: WinReNoOperation
2020-12-23 11:14:47, Info [SetupPlatform.exe] Set OS build version: 19041.1.amd64fre.vb_release.191206-1406
2020-12-23 11:14:47, Info [SetupPlatform.exe] Set Wimboot state: 0
2020-12-23 11:14:47, Info [SetupPlatform.exe] Set install state to: enabled
2020-12-23 11:14:47, Info [SetupPlatform.exe] Setting the recovery sequence for the target OS.
2020-12-23 11:14:47, Info [SetupPlatform.exe] Creating backup of reagent.xml
2020-12-23 11:14:47, Info [SetupPlatform.exe] Created backup of reagent.xml
2020-12-23 11:14:47, Info [SetupPlatform.exe] Creating backup of customization file
2020-12-23 11:14:47, Warning [SetupPlatform.exe] Recovery file not found at C:\WINDOWS\system32\Recovery\ReCustomization.xml
2020-12-23 11:14:47, Warning [SetupPlatform.exe] winreBackupRecoveryFile (C:\WINDOWS\system32\Recovery\ReCustomization.xml, ReCustomization.xml) failed, Err: 2
2020-12-23 11:14:47, Info [SetupPlatform.exe] Created backup of customization file
2020-12-23 11:14:47, Info [SetupPlatform.exe] Storing disk info in NVRAM
2020-12-23 11:14:47, Info [SetupPlatform.exe] NVRAM update not necessary
2020-12-23 11:14:47, Info [SetupPlatform.exe] Stored disk info in NVRAM
2020-12-23 11:14:47, Info [SetupPlatform.exe] SetWinRESettings return with error code 0x0
2020-12-23 11:14:47, Info [SetupPlatform.exe] WinReInstallOnTargetOSInternal WinRE installation completed successfully.
2020-12-23 11:14:47, Info [SetupPlatform.exe] Downlevel WinRE config file path: C:\Recovery\ReAgentOld.xml
2020-12-23 11:14:47, Info [SetupPlatform.exe] Exit WinReSetupInstall return value: 1, last error: 0x0
2020-12-23 11:14:47, Info SP CSetupRecoveryPartition::DoExecute: New recovery image successfully installed. 
2020-12-23 11:14:47, Info SP Installing WinRE created an extra recovery partition at offset 187954102272, size 575668224
2020-12-23 11:14:47, Info SP SETUPPLATFORMEXE: Sending progress message: Phase: First Boot, Operation: Install recovery environment, Percentage: 31%
2020-12-23 11:14:47, Info SP SETUPPLATFORMCOMM: Progress message received: Phase: First Boot, Operation: Install recovery environment, Percentage: 31%
2020-12-23 11:14:47, Info SP Operation completed successfully: Setup the recovery partition

2020-12-23 11:16:05, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
2020-12-23 11:16:05, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)

(file system: 1, NTFS?)
(At 2020-12-23 11:17:32 there seems to be a reboot, next log line at 11:18:22, maybe related to KB4592438 if "chkdsk /f" was executed during boot)

2020-12-23 11:18:24, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
2020-12-23 11:18:24, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 8, bus type: 8, hotplug media: No, hotplug device: No)

(now file system: 8)

2020-12-23 11:19:15, Warning MIG Failed to add D:\Users\Me\Documents to search indexer: Win32Exception: CSearchManager unavailable: The volume does not contain a recognized file system. Please make sure that all required file system drivers are loaded and that the volume is not corrupted. [0x000003ED] void __cdecl Mig::COnlineWinNTPlatform::AddPathToSearchIndexer(class UnBCL::String *)

(this is the first indicating for D becoming inaccessible)

2020-12-23 11:23:59, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
2020-12-23 11:23:59, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 0, bus type: 8, hotplug media: No, hotplug device: No)

(now file system: 0)

2020-12-23 11:24:24, Info SP Found non-rollback boot entry {EF81C3A7-4552-11EB-81BE-875CAD832DA7}
2020-12-23 11:24:24, Info SP SPDisableRollback: Rollback boot entry is now hidden
2020-12-23 11:24:24, Info SP Copying rollback directory C:\$WINDOWS.~BT\Sources\Rollback to C:\WINDOWS\Panther\Rollback
2020-12-23 11:24:27, Info SP Rollback disabled successfully
2020-12-23 11:24:27, Info SP Adding new WinRE BitLocker hash 931328865315DAD6FD8A13FB2014BF9B07947EE2D3CA9C43E5F46260A1837312
2020-12-23 11:24:27, Warning SP CSetupPlatformPrivate::Execute: Failed to add new WinRE hash: 0x80310001

(BitLocker?)

Post upgrade partitions:

 Partition Start End Size in sectors
1 P EFI System 2048 206847 204800 [EFI system partition]
2 P MS Reserved 206848 239615 32768 [Microsoft reserved partition]
3 P MS Data 239616 367097559 366857944 [Basic data partition]
4 P Windows Recovery Env 367097856 368222207 1124352
5 P Windows Recovery Env 368224256 369326079 1101824
6 P MS Data 369328128 1024686079 655357952 [Basic data partition]

Partitions 5 and 6 don't have any NTFS descriptors/metadata, while first and last sectors are identical.

Thank you in advance.

10 Replies

superware
Copper Contributor
Dec 29, 2020
New information, looks like this might have something to do with the Crucial MX300 SSD.

The first entries in Windows Logs -> System after the upgrade show (relevant entries only):

The operating system started at system time ‎2020‎-‎12‎-‎23T11:14:03.
11:14:05|EnhancedStorage-EhStorTcgDrv|The following informational event has occurred (0x0, 0x5, 0x0, 0x0). D0Entry
11:14:05|EnhancedStorage-EhStorTcgDrv|A TCG Command has returned an error. Desc: AuthenticateSession Param1: 0x1 Param2: 0x60000001C Param3: 0x900000006 Param4: 0x0 Status: 0x12
11:14:05|EnhancedStorage-EhStorTcgDrv|A TCG Silo has returned the capabilities value of 0x7.
11:14:06|EnhancedStorage-EhStorTcgDrv|The following informational event has occurred (0x0, 0x0, 0x0, 0x0). DeviceStart
11:14:08|Ntfs|Volume 😧 (\Device\HarddiskVolume5) is healthy. No action is needed.
11:14:49|Ntfs|The file system structure on volume 😧 has now been repaired.
11:14:49|Ntfs|Volume 😧 (\Device\HarddiskVolume5) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.
11:14:53|Ntfs|A corruption was discovered in the file system structure on volume D:. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000000024. The name of the file is "<unable to determine file name>".
It seems that due to the 20H2 upgrade, the SSD changed it's internal security protocol/mode to TCG OPAL, causing all partition data to be undecrypted or alternatively decrypted wrongly.

I've attached a file with the complete log entries.

Any ideas?
WindowsSystemLogs.zip3 KB
- Piotr1955
  Copper Contributor
  Jan 15, 2021
  Checking!
  - superware
    Copper Contributor
    Jan 16, 2021
    Piotr1955 thank you!
    
    Turns out these TCG errors have also appeared in the System logs of the previous Windows version (C:\Windows.old\Windows\System32\winevt\Logs), after every power cycle/reboot. So they might be related to this incident, but not the direct cause/indication since data partition D was healthy and accessible before the upgrade.
    
    After further investigation of installation and System logs, I think I found the exact moment of the incident (logs attached in a zip):
    
    11:14:04 - first upgrade reboot.
    11:14:05 - Applications and Services Logs -> Microsoft -> Windows -> NTFS -> WHC shows "NTFS global corruption action state is now 0."
    11:14:08 - System log shows "Volume 😧 (\Device\HarddiskVolume5) is healthy. No action is needed."
    11:14:21 - setupact.log shows the current partition table, with D as NTFS, Bitlocker disabled.
    11:14:46 - upgrade is shrinking the OS partition C and creating a new recovery partition.
    11:14:46 - Applications and Services Logs -> Microsoft -> Windows -> Partition -> Diagnostic shows the new partition table with 6 partitions.
    11:14:49 - Applications and Services Logs -> Microsoft -> Windows -> NTFS -> WHC shows "NTFS global corruption action state is now 1."
    11:14:49 - System log shows "Volume 😧 (\Device\HarddiskVolume5) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell."
    11:14:49 - Application log shows "Chkdsk was executed in verify mode on a volume snapshot. Checking file system on \Device\HarddiskVolume5"
    11:14:53 - System log shows "A corruption was discovered in the file system structure on volume D:. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000000024. The name of the file is "<unable to determine file name>"."
    11:15:02 - Applications and Services Logs -> Microsoft -> Windows -> NTFS -> WHC shows "NTFS global corruption action state is now 3."
    After this, the original recovery partition (#4) and data partition (#5) are both RAW (data looks totally encrypted, on both partitions - first and last sector are identical indicating NTFS, drive has Opal active, but not locked), the new recovery partition pushed them in the partition table (making them #5 and #6).
    
    My guess is that this change in partitions has caused Windows to take some action involving the drive's TCG Opal system, maybe taking ownership/activating it, or when initializing the new partition table - drop ownership/deactivating it and stop providing necessary decryption credentials.
    
    To conclude, partition D is healthy and accessible, and 2 seconds after the partitions change - it turns RAW and the NTFS service is erroring and trying to recover/chkdsk.
    
    Please advise, I must understand what happened in this upgrade bug, and possibly recover the data. Note I have not yet rolled back the upgrade since I don't want to cause more damage and reach a totally unrecoverable situation. If the issue is finally investigated and cause is found, then there might be an indication rolling back will help.
    
    Thank you!
    logs.zip175 KB