Users folder empty after upgrade from 1703 to 2004

[timeshifter]

Upgraded a computer from 1703 to 2004. Post upgrade I couldn't sign in to the user's profile. Rather than chase all that nonsense I went ahead and put in a new SSD and did a clean install. Now I'm going to Fab's to restore the data. BUT ITS NOT THERE.

The folder f:\users\ has nothing in it. I've checked for hidden files too. It's totally empty.

When I first tried to run the upgrade I was told that HP Drive Encryption needed to be uninstalled. I did that, don't think he had been using it. System seemed OK after that uninstall. If it had nuked the users folder at that time I'd have known.

Also, the day I started on this I had activated OneDrive to backup his Desktop, Documents and Pictures. There's a good chance everything he has is there, but not 100% sure about that yet.

I looked around on the drive thinking it may have moved the folder somewhere during the upgrade and can't find it.

Any ideas?

 

[Sky-Knight]

That's the 1809 bug, if you're using OneDrive redirection during upgrade AND folder redirection it obliterates all your files. Microsoft fixed it, but only in 1809. So if you leap from 1703 to current... you're still in the middle of it. Note, I assume you're doing some sort of redirection since users isn't on C.

You have to backup the user's junk before the upgrade... drive encryption is just another evil wrench in the mix. At this point, you're going to have to pray Onedrive has his stuff.

 

[Porthos]

I couldn't sign in to the user's profile

It created a TEMP profile. Hope you have the drive still. If it is the TEMP profile issue, the files are there. Fabs probly grabbed the temp empty profile.

 

[cyabro]

Nothing in the windows.old folder?

 

[timeshifter]

Note, I assume you're doing some sort of redirection since users isn't on C.

Nothing unique, I mentioned F: because I’ve got the old drive hooked up to the new SSD install and using Fabs.

It created a TEMP profile. Hope you have the drive still. If it is the TEMP profile issue, the files are there. Fabs probly grabbed the temp empty profile.

Yes, still have the drive. I yanked it after the upgrade and put in a new SSD. I browsed the drive but couldn’t find any TEMP profile, but I may have not been looking in the right places.

Nothing in the windows.old folder?

Didn’t see a folder like that.

 

[Porthos]

I may have not been looking in the right places.

C:\Users

 

[timeshifter]

C:\Users

Is completely empty. No folders, no hidden files, no nothing.

 

[Porthos]

Upgraded a computer from 1703 to 2004.

Since you were going to put in an SSD, I would just have pulled the old drive after imaging it to the SSD before upgrading to 2004.

 

[timeshifter]

Since you were going to put in an SSD

This was one of the rare times where I wasn't going to install an SSD, it was supposed to be a simple update. The SSD and clean install came into play when the update went south.

 

[Porthos]

it was supposed to be a simple update.

Famous last words. Guess you did not image it either. I always image or Fabs if there are not any special programs on it before all feature updates.

 

[Sky-Knight]

This was one of the rare times where I wasn't going to install an SSD, it was supposed to be a simple update. The SSD and clean install came into play when the update went south.

There is nothing simple about dragging an operating system forward in time three years. The fact that it was still on 1703 is a substantial red flag.

 

[Howie Johnson]

Dang. That's a tough break. I guess undelete \ data recovery is the next step.

 

[britechguy]

There is nothing simple about dragging an operating system forward in time three years. The fact that it was still on 1703 is a substantial red flag.

From the technician's perspective, it should be a simple matter to update from any old version of Windows 10 to a much later one. The machine I'm typing from came with 1507 "out of the box" and was directly updated to 1803 without even the slightest hitch. But it was a NOS unit at the time. Feature updates, for all practical intents and purposes, replace Windows 10 itself entirely. They don't really update it in the old sense of that word.

I agree, though, that any "in active use" machine that is that far back as far as Windows 10 versions go is a big, honkin', screamin' red flag. Either something was intentionally manipulated to prevent updates or Windows Update became broken and no one ever bothered to repair it. Either way, you're dealing with quicksand as far as the suspected stability of said system.

 

[Sky-Knight]

@britechguy Exactly, the OS update is trivial certainly but there are countless hidden variables involved in that process when the machine comes from production. Three years behind? How? Why? You'll never get a good answer.

I'm not sure what exactly I'd do myself if I encounter such a unit... I'm very tempted to say that I'd backup the unit, and do a nuke and pave. I need to be able to trust the platform, and I cannot trust a unit that's run without security updates for that length of time. Not to mention what its owner might have done to it.

If nothing else this serves as a lesson... always image a system before you do ANYTHING to it.

 

[Porthos]

If nothing else this serves as a lesson... always image a system before you do ANYTHING to it.

Exactly. I at least do a run with Fabs if there is no special software to worry about.
If you have to raise your overall price to justify the extra time/effort then so be it.
I built my business model on that data is my #1 priority. Hardware can be replaced, data cant. Most clients appreciate that.
I learned a hard lesson many years ago, Never again.

 

[timeshifter]

Dang. That's a tough break. I guess undelete \ data recovery is the next step.

It's been a while since I've had any need to try recovery utilities. Last night I made a forensic copy of the original drive and am ready to give it a try. Searching Google is pretty fruitless for this, as most of the results don't really apply. One program looks interesting: Recuva https://www.ccleaner.com/recuva

May give that a shot.

I'll probably hook up the copied drive to my main machine and run that. Or I'm willing to try any other programs or techniques. Any suggestions?

 

[britechguy]

I have never had much luck with Recuva.

TestDisk from CGSecurity (and, if necessary, Photo Rec, which is part of the Test Disk suite) have been far more effective, in my experience.