I try not to reboot my PCs too often – frankly I thought I’d left the days of daily reboots behind with Windows 95 – but, faced with a display driver bug on my Surface Pro 3 (that seems to be triggered by the Azure Portal), a change of password that led to repeated authentication prompts (and OneDrive refusing to sync), together with some software updates pushed to my PC from SCCM, I had little choice this afternoon.
Unfortunately that “quick reboot to get things working again” turned into a disaster, with a Friday-afternoon support call, followed by a desperate attempt to recover the last few hours’ work.
Stuck in a BitLocker loop
Friday the 13th. Restart PC following updates and get this. Arghhh! pic.twitter.com/f1gizmxHg0
— Mark Wilson (@markwilsonit) May 13, 2016
After rebooting, I found that a Windows 10 update hadn’t properly applied. Each time I entered my BitLocker PIN, I was faced with a message that invited me to use the BitLocker key to recover my PC. Following key entry, Windows told me to restart the computer and we went round the loop again. Working with the risual Managed Services team, I tried various approaches, but a PC rebuild was looking very likely!
Work in progress
Whilst most of my data was synced to servers, anything after the password change (and broken sync) would potentially be lost on a PC rebuild. The items of most concern to me were some scripts I’d finally got working that afternoon; and any unsynced notes in OneNote.
Following a TechNet wiki article that seemed to describe my BitLocker issue (or at least something very like it), we disarmed BitLocker, which at least left me in a position to recover (from the WinRE Command Prompt) any data since the last successful OneDrive sync.
The last worry for me was my browser. I had lots of open tabs in Edge, as well as a few in Internet Explorer. The ones in Edge included the various posts I’d found that had helped me to complete my scripts – and I wanted to go back through them to blog about what I found…
Edge does recover sessions after a crash but, with a potential PC rebuild on the cards, I’m not sure I’ll ever get the chance so I tried tracking down the location of the recovery data. Brent Muir’s fascinating look at Windows 10 – Microsoft Edge Browser Forensics told me where to find the recovery files (in %userprofile%AppDataLocalPackagesMicrosoft.MicrosoftEdge_8wekyb3d8bbweACMicrosoftEdgeUserDefaultRecoveryActive) but they are binary. Gleb Derzkij’s answer to a Stack Overflow forum post looked useful but I couldn’t get it to work. What I could do though was open each of the (115!) .dat files in the Active Recovery folder using Notepad and see enough information in there to identify the URIs, then manually copy and paste them to a text file (ready to open when I’m back at my PC).
So that’s recaptured my work and the PC is ready to be completely razed to the ground if necessary (actually, it’s being rebuilt right now…). And the moral of the story? Never apply updates on Friday the 13th!
@markwilsonit have you not learned, change freeze on a friday 13th 🙂
— Mark Vale (@UnifiedVale) May 13, 2016
[This is an edited version of a post that was originally published at markwilson.it]
