Upgrading Windows 10 Pro to 20H2 corrupts data partition

Copper Contributor

Hello,

 

Upgrading Windows 10 Pro on a Dell Latitude E5570 to version 20H2 results in data partition D becoming inaccessible after upgrade rebooted, showing as RAW partition. Rolling back the upgrade (on a clone disk) didn't help.

 

Examining the 312GB D partition and the preceding 500MB recovery partition which existed prior to the upgrade - shows random data with no NTFS meta/descriptors/file/indexes, while in both partitions the first and last sectors are identical (encrypted NTFS?).

 

Here are a few upgrade setupact.log highlights:

 

2020-12-23 10:38:29, Info CONX ConX::Compatibility::CSystemAbstraction::GetVolumeEncryptionState: Volume C: is unencrypted.
2020-12-23 10:38:29, Info CONX ConX::Compatibility::CSystemAbstraction::GetVolumeEncryptionState: Volume D: is unencrypted.
2020-12-23 10:38:29, Info CONX CBitlockerNoTargetSupportChecker: checked BitlockerNoTargetSupport, found NoIssue.
2020-12-23 10:38:54, Info SP CNewSystem::PreInitialize: Velocity feature state for BitLocker auto-unlock is enabled 2020-12-23 10:38:54, Info SP Client requested to keep BitLocker active, but the device does not support it. Will suspend BitLocker instead.
2020-12-23 10:40:34, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
2020-12-23 10:40:34, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
2020-12-23 11:14:20, Info [SetupPlatform.exe] --Install on target OS step 1: collect info like partition list, loading reagent.xml, source winre.wim and partition 2020-12-23 11:14:21, Info [SetupPlatform.exe] Enumerate and log all fixed partitions: 2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info-- 2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{45f767b0-3249-44f1-851e-c40934eaec83}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition1 2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 1, offset: 1048576, free space: 44683264, total space: 100663296 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:0, Mbr:0, Active:0, Boot:0, BitlockerEnabled:0 2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B} 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info-- 2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition5 2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 5, offset: 189096001536, free space: 6272868352, total space: 335543267328 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:1, Mbr:0, Active:0, Boot:0, BitlockerEnabled:0
(here partition 5 looks valid, NTFS, BitLocker disabled)

2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7} 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info-- 2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{228a9826-abc4-4ab0-bc5a-ff28e52bd50a}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition4 2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 4, offset: 188530819072, free space: 86437888, total space: 564129792 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:1, Mbr:0, Active:0, Boot:0, BitlockerEnabled:0 2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC} 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 2020-12-23 11:14:21, Info [SetupPlatform.exe] --Partition info-- 2020-12-23 11:14:21, Info [SetupPlatform.exe] VolumeName: \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition3 2020-12-23 11:14:21, Info [SetupPlatform.exe] Partition number: 3, offset: 122683392, free space: 29369483264, total space: 188407099392 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskNumber:0, DiskSignature:0, NTFS:1, Mbr:0, Active:0, Boot:1, BitlockerEnabled:0 2020-12-23 11:14:21, Info [SetupPlatform.exe] GPT partition GUID:: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7} 2020-12-23 11:14:21, Info [SetupPlatform.exe] DiskId: {D4218EAB-B7E9-444B-A336-409EE83F8847} 2020-12-23 11:14:21, Info [SetupPlatform.exe] Get downlevel ReAgent config 2020-12-23 11:14:21, Info [SetupPlatform.exe] Downlevel config file path: C:\Recovery\ReAgentOld.xml 2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking for downlevel WinRE installation. 2020-12-23 11:14:21, Info [SetupPlatform.exe] First round search 2020-12-23 11:14:21, Info [SetupPlatform.exe] Get ReAgent config 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetReAgentConfig Config file path: C:\WINDOWS\system32\Recovery\ReAgent.xml 2020-12-23 11:14:21, Info [SetupPlatform.exe] CheckRegKey test hook (SystemSetupInProgress) present or enabled 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetReAgentConfig System setup is in progress. 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(IsAutoRepairOn) failed: 0xd 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(IsServer) failed: 0xd 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.Dir): 0xd 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.DiskSignature): 0xd 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.Offset): 0xd 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(DownlevelWinreLocation.DiskId): 0xd 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(IsWimBoot) failed: 0xd 2020-12-23 11:14:21, Warning [SetupPlatform.exe] failed to get child attribute by tag: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] GetChildAttributeByTag(NarratorScheduled) failed: 0xd 2020-12-23 11:14:21, Info [SetupPlatform.exe] Update enhanced config info is enabled. 2020-12-23 11:14:21, Warning [SetupPlatform.exe] Failed to get recovery entries: 0xc0000225 2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetWinReGuid returning 0X490 2020-12-23 11:14:21, Info [SetupPlatform.exe] ReAgentConfig::ReadBcdAndUpdateEnhancedConfigInfo WinRE disabled, WinRE Guid could not be determined (0x490) 2020-12-23 11:14:21, Info [SetupPlatform.exe] FindWinReSourceImageAndPartition using winre.wim from C:\WINDOWS\System32\Recovery 2020-12-23 11:14:21, Info [SetupPlatform.exe] --Install on target OS step 2: detect and fix if there is any issue for winre settings 2020-12-23 11:14:21, Info [SetupPlatform.exe] DetectAndFixWinReIssues nothing to do because winre is not enabled. 2020-12-23 11:14:21, Info [SetupPlatform.exe] --Install on target OS step 3: check if we can keep winre.wim in the same partition if it is staged. 2020-12-23 11:14:21, Info [SetupPlatform.exe] --Install on target OS step 4: check if we can put winre.wim in other partitions or create one if needed. 2020-12-23 11:14:21, Info [SetupPlatform.exe] CanPutWinREOnOtherPartitions WinRE is not staged. Searching for a suitable partition for WinRE. 2020-12-23 11:14:21, Info [SetupPlatform.exe] Entering FindTargetPartition 2020-12-23 11:14:21, Info [SetupPlatform.exe] RegLoadKey $OFFLINE$SYSTEM failed. Error: 0x3. 2020-12-23 11:14:21, Info [SetupPlatform.exe] Start looping through each partition and initialize os partition, recovery partition and system partition for MBR 2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 1048576, partition number: 1 2020-12-23 11:14:21, Info [SetupPlatform.exe] skip GPT Partition which type is not PARTITION_MSFT_RECOVERY_GUID 2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 189096001536, partition number: 5 2020-12-23 11:14:21, Info [SetupPlatform.exe] skip GPT Partition which type is not PARTITION_MSFT_RECOVERY_GUID 2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 188530819072, partition number: 4 2020-12-23 11:14:21, Info [SetupPlatform.exe] MeetPartitionRequirements Partition details: {Offset: 188530819072, Free space: 86437888, Total space: 564129792} 2020-12-23 11:14:21, Info [SetupPlatform.exe] MeetPartitionRequirements WinRE WIM size: 467832158 2020-12-23 11:14:21, Info [SetupPlatform.exe] MeetPartitionRequirements Required free space: 522358110 2020-12-23 11:14:21, Warning [SetupPlatform.exe] MeetPartitionRequirements Not enough free space req = 522358110 avail = 86437888 offset = 188530819072 2020-12-23 11:14:21, Info [SetupPlatform.exe] skip partition because it does not meet WinRE requirements 2020-12-23 11:14:21, Info [SetupPlatform.exe] Checking partition at offset 122683392, partition number: 3 2020-12-23 11:14:21, Info [SetupPlatform.exe] find OS partition 2020-12-23 11:14:21, Info [SetupPlatform.exe] Complete looping through each partition 2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #1: try existing WinRE partition 2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #2: try first recovery partition 2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #3: try system partition for MBR 2020-12-23 11:14:21, Info [SetupPlatform.exe] ----Search target partition option #4: try new recovery partition if allowed 2020-12-23 11:14:21, Info [SetupPlatform.exe] Attempting to create a new partition for WinRE 2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetNewPartitionWithCoInit Will shrink the OS volume with : 575835486 2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetNewPartitionWithCoInit Will create partition with size: 574786910 2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetVolumeGUIDPath returning \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\ 2020-12-23 11:14:21, Info [SetupPlatform.exe] winreGetNewPartition root: C:\WINDOWS OS volume GUID: \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\ 2020-12-23 11:14:30, Info [SetupPlatform.exe] winrePInitVDSService returning TRUE 2020-12-23 11:14:30, Info [SetupPlatform.exe] winreEnumerate returning TRUE 2020-12-23 11:14:30, Info [SetupPlatform.exe] winreEnumerate returning TRUE 2020-12-23 11:14:30, Info [SetupPlatform.exe] winreProcessPack returning TRUE 2020-12-23 11:14:30, Info [SetupPlatform.exe] winreEnumerate returning TRUE 2020-12-23 11:14:30, Info [SetupPlatform.exe] winreProcessProvider returning TRUE 2020-12-23 11:14:30, Info [SetupPlatform.exe] winreGetVolumeGUIDPath returning \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\ 2020-12-23 11:14:30, Info [SetupPlatform.exe] winreShrinkVolume Shrinking the OS volume with: 575835486 2020-12-23 11:14:46, Warning [SetupPlatform.exe] winreShrinkVolume Shrink operation reclaimed less bytes than we have requested. Reclaimend bytes: 22528c00, requested bytes: 22528d5e 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreShrinkVolume returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreGetVolumeGUIDPath returning \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}\ 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume Skipped 1b9f2659 flags = 0x898460 \\?\GLOBALROOT\Device\HarddiskVolume5 \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}\ 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume Mismatch: \\?\Volume{9d90c119-3119-4921-8cf3-aade20fb5d11}\ \\?\Volume{424ac9c0-0b4c-4c51-ba94-96c6c1408c0a}\ 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessVolume returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000000000000 0000000000004400 00000000 32767 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000000004400 00000000000fbc00 00000000 1 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000000100000 0000000006400000 00000000 4 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000006500000 0000000001000000 00000000 5 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000000007500000 0000002bbb9db000 e94ba37b 2 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002bc2edb000 0000000022625000 00000000 1 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002be5500000 0000000021a00000 00000000 3 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002c06f00000 0000000000100000 00000000 1 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000002c07000000 0000004e1ff00000 1b9f2659 2 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk Extent:0000007a26f00000 000000001c37de00 00000000 1 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreCreatePartition Will create partition at offset: 187953950720 with size: 574786560 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreCreatePartition create partition successfully, actual offset is: 0x2BC2F00000 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreCreatePartition returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessDisk returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessPack returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreProcessProvider returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreEnumerate returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreGetNewPartition returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] winreGetNewPartitionWithCoInit returning TRUE 2020-12-23 11:14:46, Info [SetupPlatform.exe] New WinRE partition created 2020-12-23 11:14:46, Info [SetupPlatform.exe] Found target partition: use the new WinRE partition, offset: 187954102272 2020-12-23 11:14:46, Info [SetupPlatform.exe] Exit FindTargetPartition returns with status code: 0x0 2020-12-23 11:14:46, Info [SetupPlatform.exe] --Install on target OS step 5: set WinRE settings and restore system to a good state when hitting any errors 2020-12-23 11:14:46, Info [SetupPlatform.exe] Enter SetWinRESettings 2020-12-23 11:14:46, Info [SetupPlatform.exe] RegLoadKey $OFFLINE$SYSTEM failed. Error: 0x3. 2020-12-23 11:14:46, Info [SetupPlatform.exe] Copying WinRE from C:\WINDOWS\System32\Recovery to staging location on \\?\GLOBALROOT\device\harddisk0\partition6 2020-12-23 11:14:47, Info [SetupPlatform.exe] Copied WinRE to staging location 2020-12-23 11:14:47, Info [SetupPlatform.exe] Creating BCD entry 2020-12-23 11:14:47, Info [SetupPlatform.exe] WinRE created BCD entry: : {EF81C3A8-4552-11EB-81BE-875CAD832DA7} 2020-12-23 11:14:47, Info [SetupPlatform.exe] Moving Winre and boot.sdi from staging location to target 2020-12-23 11:14:47, Info [SetupPlatform.exe] Moved Winre and boot.sdi from staging location to target 2020-12-23 11:14:47, Info [SetupPlatform.exe] Updating reagent.xml 2020-12-23 11:14:47, Info [SetupPlatform.exe] Set WinRE location path to: \Recovery\WindowsRE 2020-12-23 11:14:47, Info [SetupPlatform.exe] Set recovery guid 2020-12-23 11:14:47, Info [SetupPlatform.exe] Set scheduled operation: WinReNoOperation 2020-12-23 11:14:47, Info [SetupPlatform.exe] Set OS build version: 19041.1.amd64fre.vb_release.191206-1406 2020-12-23 11:14:47, Info [SetupPlatform.exe] Set Wimboot state: 0 2020-12-23 11:14:47, Info [SetupPlatform.exe] Set install state to: enabled 2020-12-23 11:14:47, Info [SetupPlatform.exe] Setting the recovery sequence for the target OS. 2020-12-23 11:14:47, Info [SetupPlatform.exe] Creating backup of reagent.xml 2020-12-23 11:14:47, Info [SetupPlatform.exe] Created backup of reagent.xml 2020-12-23 11:14:47, Info [SetupPlatform.exe] Creating backup of customization file 2020-12-23 11:14:47, Warning [SetupPlatform.exe] Recovery file not found at C:\WINDOWS\system32\Recovery\ReCustomization.xml 2020-12-23 11:14:47, Warning [SetupPlatform.exe] winreBackupRecoveryFile (C:\WINDOWS\system32\Recovery\ReCustomization.xml, ReCustomization.xml) failed, Err: 2 2020-12-23 11:14:47, Info [SetupPlatform.exe] Created backup of customization file 2020-12-23 11:14:47, Info [SetupPlatform.exe] Storing disk info in NVRAM 2020-12-23 11:14:47, Info [SetupPlatform.exe] NVRAM update not necessary 2020-12-23 11:14:47, Info [SetupPlatform.exe] Stored disk info in NVRAM 2020-12-23 11:14:47, Info [SetupPlatform.exe] SetWinRESettings return with error code 0x0 2020-12-23 11:14:47, Info [SetupPlatform.exe] WinReInstallOnTargetOSInternal WinRE installation completed successfully. 2020-12-23 11:14:47, Info [SetupPlatform.exe] Downlevel WinRE config file path: C:\Recovery\ReAgentOld.xml 2020-12-23 11:14:47, Info [SetupPlatform.exe] Exit WinReSetupInstall return value: 1, last error: 0x0 2020-12-23 11:14:47, Info SP CSetupRecoveryPartition::DoExecute: New recovery image successfully installed. 2020-12-23 11:14:47, Info SP Installing WinRE created an extra recovery partition at offset 187954102272, size 575668224 2020-12-23 11:14:47, Info SP SETUPPLATFORMEXE: Sending progress message: Phase: First Boot, Operation: Install recovery environment, Percentage: 31% 2020-12-23 11:14:47, Info SP SETUPPLATFORMCOMM: Progress message received: Phase: First Boot, Operation: Install recovery environment, Percentage: 31% 2020-12-23 11:14:47, Info SP Operation completed successfully: Setup the recovery partition
2020-12-23 11:16:05, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No) 2020-12-23 11:16:05, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
(file system: 1, NTFS?)
(At 2020-12-23 11:17:32 there seems to be a reboot, next log line at 11:18:22, maybe related to KB4592438 if "chkdsk /f" was executed during boot) 2020-12-23 11:18:24, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No) 2020-12-23 11:18:24, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 8, bus type: 8, hotplug media: No, hotplug device: No)
(now file system: 8)

2020-12-23 11:19:15, Warning MIG Failed to add D:\Users\Me\Documents to search indexer: Win32Exception: CSearchManager unavailable: The volume does not contain a recognized file system. Please make sure that all required file system drivers are loaded and that the volume is not corrupted. [0x000003ED] void __cdecl Mig::COnlineWinNTPlatform::AddPathToSearchIndexer(class UnBCL::String *)

(this is the first indicating for D becoming inaccessible)

2020-12-23 11:23:59, Info [0x0805a8] MIG Added drive root mapping for 'C:\' (type: 1, file system: 1, bus type: 8, hotplug media: No, hotplug device: No)
2020-12-23 11:23:59, Info [0x0805a8] MIG Added drive root mapping for 'D:\' (type: 1, file system: 0, bus type: 8, hotplug media: No, hotplug device: No)

(now file system: 0)

2020-12-23 11:24:24, Info SP Found non-rollback boot entry {EF81C3A7-4552-11EB-81BE-875CAD832DA7}
2020-12-23 11:24:24, Info SP SPDisableRollback: Rollback boot entry is now hidden
2020-12-23 11:24:24, Info SP Copying rollback directory C:\$WINDOWS.~BT\Sources\Rollback to C:\WINDOWS\Panther\Rollback
2020-12-23 11:24:27, Info SP Rollback disabled successfully
2020-12-23 11:24:27, Info SP Adding new WinRE BitLocker hash 931328865315DAD6FD8A13FB2014BF9B07947EE2D3CA9C43E5F46260A1837312
2020-12-23 11:24:27, Warning SP CSetupPlatformPrivate::Execute: Failed to add new WinRE hash: 0x80310001

(BitLocker?)

 

Post upgrade partitions:

 

 Partition Start End Size in sectors
1 P EFI System 2048 206847 204800 [EFI system partition]
2 P MS Reserved 206848 239615 32768 [Microsoft reserved partition]
3 P MS Data 239616 367097559 366857944 [Basic data partition]
4 P Windows Recovery Env 367097856 368222207 1124352
5 P Windows Recovery Env 368224256 369326079 1101824
6 P MS Data 369328128 1024686079 655357952 [Basic data partition]

Partitions 5 and 6 don't have any NTFS descriptors/metadata, while first and last sectors are identical.

 

Thank you in advance.

10 Replies

New information, looks like this might have something to do with the Crucial MX300 SSD.

 

The first entries in Windows Logs -> System after the upgrade show (relevant entries only):

 

  • The operating system started at system time ‎2020‎-‎12‎-‎23T11:14:03.
  • 11:14:05|EnhancedStorage-EhStorTcgDrv|The following informational event has occurred (0x0, 0x5, 0x0, 0x0). D0Entry
  • 11:14:05|EnhancedStorage-EhStorTcgDrv|A TCG Command has returned an error. Desc: AuthenticateSession Param1: 0x1 Param2: 0x60000001C Param3: 0x900000006 Param4: 0x0 Status: 0x12
  • 11:14:05|EnhancedStorage-EhStorTcgDrv|A TCG Silo has returned the capabilities value of 0x7.
  • 11:14:06|EnhancedStorage-EhStorTcgDrv|The following informational event has occurred (0x0, 0x0, 0x0, 0x0). DeviceStart
  • 11:14:08|Ntfs|Volume D: (\Device\HarddiskVolume5) is healthy. No action is needed.
  • 11:14:49|Ntfs|The file system structure on volume D: has now been repaired.
  • 11:14:49|Ntfs|Volume D: (\Device\HarddiskVolume5) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.
  • 11:14:53|Ntfs|A corruption was discovered in the file system structure on volume D:. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000000024. The name of the file is "<unable to determine file name>".

It seems that due to the 20H2 upgrade, the SSD changed it's internal security protocol/mode to TCG OPAL, causing all partition data to be undecrypted or alternatively decrypted wrongly.

 

I've attached a file with the complete log entries.

 

Any ideas?

@Piotr1955 thank you!

 

Turns out these TCG errors have also appeared in the System logs of the previous Windows version (C:\Windows.old\Windows\System32\winevt\Logs), after every power cycle/reboot. So they might be related to this incident, but not the direct cause/indication since data partition D was healthy and accessible before the upgrade.

 

After further investigation of installation and System logs, I think I found the exact moment of the incident (logs attached in a zip):

 

  • 11:14:04 - first upgrade reboot.
  • 11:14:05 - Applications and Services Logs -> Microsoft -> Windows -> NTFS -> WHC shows "NTFS global corruption action state is now 0."
  • 11:14:08 - System log shows "Volume D: (\Device\HarddiskVolume5) is healthy. No action is needed."
  • 11:14:21 - setupact.log shows the current partition table, with D as NTFS, Bitlocker disabled.
  • 11:14:46 - upgrade is shrinking the OS partition C and creating a new recovery partition.
  • 11:14:46 - Applications and Services Logs -> Microsoft -> Windows -> Partition -> Diagnostic shows the new partition table with 6 partitions.
  • 11:14:49 - Applications and Services Logs -> Microsoft -> Windows -> NTFS -> WHC shows "NTFS global corruption action state is now 1."
  • 11:14:49 - System log shows "Volume D: (\Device\HarddiskVolume5) requires an Online Scan. An Online Scan will automatically run as part of the next scheduled maintenance task. Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell."
  • 11:14:49 - Application log shows "Chkdsk was executed in verify mode on a volume snapshot. Checking file system on \Device\HarddiskVolume5"
  • 11:14:53 - System log shows "A corruption was discovered in the file system structure on volume D:. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000000024. The name of the file is "<unable to determine file name>"."
  • 11:15:02 - Applications and Services Logs -> Microsoft -> Windows -> NTFS -> WHC shows "NTFS global corruption action state is now 3."

After this, the original recovery partition (#4) and data partition (#5) are both RAW (data looks totally encrypted, on both partitions - first and last sector are identical indicating NTFS, drive has Opal active, but not locked), the new recovery partition pushed them in the partition table (making them #5 and #6).

 

My guess is that this change in partitions has caused Windows to take some action involving the drive's TCG Opal system, maybe taking ownership/activating it, or when initializing the new partition table - drop ownership/deactivating it and stop providing necessary decryption credentials.

 

To conclude, partition D is healthy and accessible, and 2 seconds after the partitions change - it turns RAW and the NTFS service is erroring and trying to recover/chkdsk.

 

Please advise, I must understand what happened in this upgrade bug, and possibly recover the data. Note I have not yet rolled back the upgrade since I don't want to cause more damage and reach a totally unrecoverable situation. If the issue is finally investigated and cause is found, then there might be an indication rolling back will help.

 

Thank you!

This bug has just hit me today, I am at a loss on how to recover the data on two drives.

@Marc_Couture when you view the partitions data directly (using Active Disk Editor etc), is it totally random? if so it might indicate an encryption issue. Are the first and last sectors identical? if so it might indicate the decrypted data is NTFS.

I have this information in the event log (in polish)

Zrzut ekranu 2021-01-27 075012.jpg

@superware 

@superwareI wiped the drives and recopied all my data from the original drives.  Honestly, I've lost all confidence in Microsoft for data security, I'll soon be looking for a Linux based solution for backups.