Intel Optane & You: A Rudimentary Approach To Intel Optane Data Recovery

I vividly remember being 18, working in Geek Squad, and hearing a coworker express his dissatisfaction towards a recent check-in. The computer was in for a failed OS and emergency data recovery, which is standard in terms of things we would do. However, his grievance was that for some reason, the drive seemed to work in the machine that the drive came out of, but not when we hooked it up to the data recovery machine.

The drive seemed pretty standard, except for the label “INTEL OPTANE” on the drive label. I went ahead and quickly Googled what an Intel Optane Drive was, and found on an Intel support page that once the “Optane Link” between the TPM and the drive was broken, the drive was rendered useless. (Source: https://community.intel.com/t5/Intel-Optane-Memory/How-do-I-get-my-Data-off-my-old-Intel-Optane-SSD/m-p/1458794).

Of course, we had to present that information to the customer, who was pretty upset about the news. My manager then requested me to research any possible way to recover data from an Optane drive, knowing that more were probably on the way into our shop.

I firstly consulted Reddit (as this was 2021, no ChatGPT quite yet) and was led to two filesets on Intel’s website. One of the folders was labelled “INTEL” and the other “NON-INTEL”. Inside these folders, along with other files that I would imagine are important to somebody, I found .inf files that pointed me to my first clue: new drivers for Optane-based media.

Without disclosing much about Geek Squad’s inner workings, I can say we used a Windows PE flash drive for most of our fixes. So, I added the INTEL and NON-INTEL folders to the root of the flash drive and loaded up the proprietary “File Manager” on a new affected Optane-based machine. I opened Command Prompt as well and ran diskpart out of curiosity. The only drive that showed was the 29.7GB flash drive.

After some angry Googling, I discovered my mistake: I needed to load the drivers, not just sit them on the root of my PE drive. Using drvload, I loaded the drivers and ran diskpart again and got the drive listed alongside the flash drive. However, the drive showed no partitions. Fortunately, I did an OS backup before experimenting too much.

With this information, I learned that the Optane Link requires the host OS to be functional and booted, or else the drive displays as blank. Unfortunately, my warnings were unheeded by my coworkers, and one of them yanked out an Optane drive and tried hooking it up to another machine. I finally learned what the “Load Driver” button is for on the selection installation destination page of a Windows install.

After some testing, I discovered that I could retrieve all data on a failed OS Optane drive using XCOPY. Here are the steps for this recovery:

  1. Assess if your Optane-based unit is operational. The unit must be able to POST with no issue, even if the OS is fried.
  2. Use a Windows installation USB, preferably matching what was on the system. Prep an external hard drive that can connect via USB to push data onto.
  3. Boot the machine to the USB. The standard installation screen should appear. Click the "Repair My Computer" option in the bottom left.
  4. Navigate to "Advanced Options," then open "Command Prompt." Insert your flash media containing the Intel and Non-Intel drivers, along with your external drive.
  5. Run diskpart and enter list vol to view available drives. Note down your external and flash drive letters.
  6. Exit diskpart and load the drivers using: 
    drvload.exe D:\Intel\iastorVD.inf
    and 
    drvload.exe D:\Non-Intel\iastorAC.inf
  7. Run diskpart again and confirm the C drive appears.
  8. Exit diskpart and use XCOPY to copy data: 
    xcopy C: [External Drive Letter] /h /e /c /k
  9. Complete Windows setup as usual, loading all necessary drivers from your flash drive during installation.

With these steps, I successfully recovered data from Optane drives and even improved compatibility with NVMe drives. This approach proved to be a valuable skill in our shop.