1

I have been given a Windows laptop to recover data from as a favour. It is non-domain joined and running Windows 11 Home (so not bitlocker or file encyrption.)

After a Windows update the system won’t boot, and the user is going to reset it. I have been asked to copy the contents of their My Documents folder to a USB.

I can boot into a Windows PE environemnt using Hirens Boot CD, on a USB. I have tried copying the files across and get a permissions error. I have tried to take ownership of the files from the command prompt, but am failing.

Is there a simpler way using Hirens or another tool?

5 Spice ups
2

Unless it is 24H2 out of the box this IS encrypted, though given your later comment, you can actually see the drive.

What files are you getting an error on specifically, C: drive or documents folders - where you’re copying from may help identify why it’s failing.

3

You can try manually changing the permissions from a command line:

takeown /F "C:\Users\<username>\Documents" /R /D Y
icacls "C:\Users\<username>\Documents" /grant administrators:F /T

Another option could be to make a Linux boot CD (or USB stick) and try that instead of Windows PE. Linux will usually ignore Windows permissions.

1 Spice up
4

I suggest making a clone of the disk first, they trying to copy the files. Try a variance of linux on a bootable USB to see if you can copy those files off.

1 Spice up
5

Remove the drive and use a drive reader. Find the user and copy the entire profile to a safe place.

6

Specifically it was files on the users’ desktop, which is located inside their OneDrive folder.

I also span up Ubtuntu and could copy other folders, but I couldn’t even see the OneDrive folder in Ubuntu.

7

The takeown worked, but the icals didn’t. It appears that it wasn’t included in this version of Windows PE.

8

Wouldn’t that mean the files are backed up in their OneDrive so what you are doing isn’t needed?

1 Spice up
9

I’m not sure why you’re fighting this then, data is likely already in the cloud - have them login to onedrive.com and check. If it’s there, ignore OneDrive specific folders. That’s why OneDrive exists.

1 Spice up
10

Then I would go with a Linux boot/recovery tool. There a number of them out there. But like others have said; if the data you want is in OneDrive, then it should be easy to get it back.

11

you can make it by using a Linux Live USB

1 Spice up