OneDrive tried to write-back all cloud files and stuffed my laptop

Hello

Win10 pro 22H2 build 19045,4291

Is there a utility that can parse the MFT (& backup copy) and identify what's real and what's fake reserved space? I realise such a utility would need to parse the contents and see if the extension matched the file type, but it could rely on installed apps to confirm.

I have an HP Envy 14 with a 1Tb NVMe with Windows on C: and my personal data on P:. I also buy a family subscription to MS365 including 1TB of OneDrive cloud storage per license. Format is GPT. I moved my OD special folder onto P: so I could move my data into it. I'm folder centric so it's organised by years. I didn't at the time realise I could set OD at the top folder level and by default it was set to 'free up space', i.e, cloud storage only. OD needs a full manual: you configure this, it will do that. Instead, there's a glib 2 minute video.

What OD did is:
a) Create an alternative special OD folder under c:\Users\Me\OD
b) Move my personal data from P:\[year] into this folder
c) Mark it as online only

Looking at wireless traffic and files disappearing from explorer, I quit OD. I found that I could check 'Keep on my device' at the root folder and checked that, naively assuming it would replace the files back where they came from.

What OD did is:
d) attempt to write back far more data to C: than the available space on C:
e) after it ran out of apparent space, place files in a \recovered folder without the original filename, a bit like chkdsk found files, 'file001.jpg' etc. I say apparent space because 'dir' in a cmd window marked files with an asterisk that appeared to mean 'reserved space' not actual file.

Fortunately, P: was backed up to an external drive so I could replace most of the stuffed files.
Win10 pro was less forgiving. New installs wouldn't, and some existing installs now failed to run: FB messenger, AOMEI backupper for reboot, HP Support Assistance, MS 365 updates ...

I did a Repair Upgrade re-install of Win10 pro and that recovered the machine. I created a backup of C: so I have a golden image using AOMEI, that unfortunately won't restore because AOMEI can no longer enumerate the internal SSD (behaves like no bitlocker key) despite this working previously.

Now OD has performed some other undocumented action and I'm back with stuffed laptop and unable to restore my golden image even from a USB boot that has worked twice before on the same golden image.

Any suggestions?

Thanks
Mike

Thanks @dalchina
Good that the tenforums community have stepped in where MS was delinquent. 8,000 threads on tenf quoting OD suggests they didn't do a good job explaining its peccadillos, those being subtle but devastating in damage.
I have a golden image from Aomei that I want to restore. ABU is installed but the confusion on the disk means it fails the request both from the installed/reboot and a USB reboot, although I think the failure is because it doesn't request a bitlocker key. That doesn't explain the two times I successfully used ABU: the difference being OD. I created the golden image after the first OD 'attack' and did a win10 upgrade repair install that fixed the issues.
It's frustrating that I have a working image that I can't reload. I'd like to undo enough of the damage so that AOMEI can run.
<Mike>

Thanks @dalchina

dalchina said:

Ah - you mentioned Aomei Backupper.. strange you can't restore an image - I assume you've disabled bitlocker, and your image files are on an external drive. Presumably you created the image when bitlocker was not in effect.

No, Yes and No. The curious thing is that this is the 3rd time I've tried to use my golden image to recover from a OneDrive attack. It worked the last two times, which indicates AOMEI have updated something bitlocker. It has the look of a bitlocker key fail because none of the internal disks show. The golden image was a Repair Upgrade of Win10 pro after the first attack, and was working well. A reboot from inside windows fails I think due to the MFT chaos. The USB boot doesn't have enough info to cope.

dalchina said:

Is there a particular error message you can research?

Not from AOMEI. I had a Win10 Repair Upgrade error message and it has no hits online. My second GoogleWhack.

dalchina said:

Try asking here:
AOMEI Forum

Thanks. I already have a thread.

dalchina said:

It seems you have Win 10 Pro... would be worth adding that to your specs/under your avatar.

I can do that. I put them under my profile.

Regards, Mike