How to repair a broken Windows 7 recovery partition

[Tripredacus]

This is a tutorial intended to fix a recovery partition on Windows 7 if the computer has suffered an error or fault prior to being able to complete the OOBE phase. By default (or design) Windows 7 does not allow the ability to run recovery if the OS is in Audit Mode or if the PC has not completed the OOBE phase. If there was an error that occurred during first boot, such as a power failure, it would not be possible to either continue setting up the PC or to run the hard-disk based recovery. For the regular user, it would leave them with an unusable PC unless they had also purchased the recovery DVDs.

This tutorial makes some presumptions:

1. The recovery partition is a standard Windows 7 setup and does not use third party recovery solutions.

2. The user has access to a WinPE with the same architecture (32/64 bit) as the installed Windows 7. The WinPE may be either a stock, custom or the one from a Windows 7 or higher installation DVD.

3. The ability to get information from a computer of identical model and setup. This may or may not be required but it would certainly be helpful.

4. The ability to get a file from another computer with the same type of recovery partition, or potentially a WinPE or Windows 7 install DVD.

Things to get from another PC

In points 3 and 4 above, we need files from elsewhere. The first is to get the BCD settings from the similar PC. From an elevated command prompt run:

BCDEDIT /ENUM ALLorBCDEDIT /ENUM ALL>BCD.txt

This will show what the proper BCD settings are for that PC. Outputting it to a text file will let you take that information with you if both PCs are not in the same location. Prior to completing the OOBE phase, the recovery related entries in the BCD are missing. So this will help to know what is needed to be created on the broken PC.

The second thing we need is boot.sdi. This file will not be on the broken PC but is located on the working one and should also be on a Windows 7 DVD.

If you do not have access to a Windows 7 DVD you can get the boot.sdi from another Windows 7 PC's recovery partition. It is best to stick to the same brand of PC as different manufacturers may use different methods. Some, like HP, may even use a third party solution. It is best to get this file by using a WinPE but it can also be done using a normal Windows installation. If using Windows, make sure to use an elevated command prompt. To identify where the file will be located, you need to look at the BCDEDIT output from earlier, specifically this section from the bottom:

Device options--------------identifier              {b7db3b72-b6ec-11e3-ae5c-0090f5e7d27f}description             Ramdisk Optionsramdisksdidevice        partition=\Device\HarddiskVolume2ramdisksdipath          \Recovery\WindowsRE\boot.sdi

Here is the complete working BCD:

Windows Boot Manager--------------------identifier              {bootmgr}device                  partition=\Device\HarddiskVolume1description             Windows Boot Managerlocale                  en-USinherit                 {globalsettings}default                 {current}resumeobject            {b7db3b6f-b6ec-11e3-ae5c-0090f5e7d27f}displayorder            {current}toolsdisplayorder       {memdiag}timeout                 30Windows Boot Loader-------------------identifier              {current}device                  partition=C:path                    \windows\system32\winload.exedescription             Windows 7locale                  en-USinherit                 {bootloadersettings}recoverysequence        {b7db3b71-b6ec-11e3-ae5c-0090f5e7d27f}recoveryenabled         Yesosdevice                partition=C:systemroot              \windowsresumeobject            {b7db3b6f-b6ec-11e3-ae5c-0090f5e7d27f}nx                      OptInWindows Boot Loader-------------------identifier              {b7db3b71-b6ec-11e3-ae5c-0090f5e7d27f}device                  ramdisk=[\Device\HarddiskVolume2]\Recovery\WindowsRE\Winre.wim,{b7db3b72-b6ec-11e3-ae5c-0090f5e7d27f}path                    \windows\system32\winload.exedescription             Windows Recovery Environmentinherit                 {bootloadersettings}osdevice                ramdisk=[\Device\HarddiskVolume2]\Recovery\WindowsRE\Winre.wim,{b7db3b72-b6ec-11e3-ae5c-0090f5e7d27f}systemroot              \windowsnx                      OptInwinpe                   YesResume from Hibernate---------------------identifier              {b7db3b6f-b6ec-11e3-ae5c-0090f5e7d27f}device                  partition=C:path                    \windows\system32\winresume.exedescription             Windows Resume Applicationlocale                  en-USinherit                 {resumeloadersettings}filedevice              partition=C:filepath                \hiberfil.sysdebugoptionenabled      NoWindows Memory Tester---------------------identifier              {memdiag}device                  partition=\Device\HarddiskVolume1path                    \boot\memtest.exedescription             Windows Memory Diagnosticlocale                  en-USinherit                 {globalsettings}badmemoryaccess         YesEMS Settings------------identifier              {emssettings}bootems                 YesDebugger Settings-----------------identifier              {dbgsettings}debugtype               Serialdebugport               1baudrate                115200RAM Defects-----------identifier              {badmemory}Global Settings---------------identifier              {globalsettings}inherit                 {dbgsettings}                        {emssettings}                        {badmemory}Boot Loader Settings--------------------identifier              {bootloadersettings}inherit                 {globalsettings}                        {hypervisorsettings}Hypervisor Settings-------------------identifier              {hypervisorsettings}hypervisordebugtype     Serialhypervisordebugport     1hypervisorbaudrate      115200Resume Loader Settings----------------------identifier              {resumeloadersettings}inherit                 {globalsettings}Device options--------------identifier              {b7db3b72-b6ec-11e3-ae5c-0090f5e7d27f}description             Ramdisk Optionsramdisksdidevice        partition=\Device\HarddiskVolume2ramdisksdipath          \Recovery\WindowsRE\boot.sdi

This shows that boot.sdi is located in \Recovery\WindowsRE. Now to locate where that actually is. In CMD, run DISKPART. At the diskpart prompt run SEL DISK 0 and then LIST PART. This will show something similar:

X:\WINDOWS\system32>diskpartMicrosoft DiskPart version 6.2.8250Copyright (C) 1999-2012 Microsoft Corporation.On computer: MININT-GM4300DDISKPART> sel disk 0Disk 0 is now the selected disk.DISKPART> list part  Partition ###  Type              Size     Offset  -------------  ----------------  -------  -------  Partition 1    Primary            500 MB  1024 KB  Partition 2    Recovery          6000 MB   501 MB  Partition 3    Primary             49 GB  6501 MB

The partition that has the Recovery Type is the one we would want in this example. Some PCs might have their boot file in another partition! But for this tutorial, we'll say it is Partition 2. It is currently hidden and has no drive letter (WinPE may have on assigned) so we need to reveal it. We will select the partition, verify it is the correct one, change the ID and then give it a drive letter.

DISKPART> sel part 2Partition 2 is now the selected partition.DISKPART> detail partPartition 2Type  : 27Hidden: YesActive: NoOffset in Bytes: 525336576  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info  ----------  ---  -----------  -----  ----------  -------  ---------  --------* Volume 3     E   Recovery     NTFS   Partition   6000 MB  Healthy    HiddenDISKPART> set id=07 overrideDiskPart successfully set the partition ID.DISKPART> assignDiskPart successfully assigned the drive letter or mount point.DISKPART> detail partPartition 2Type  : 07Hidden: NoActive: NoOffset in Bytes: 525336576  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info  ----------  ---  -----------  -----  ----------  -------  ---------  --------* Volume 4     C   Recovery     NTFS   Partition   6000 MB  Healthy

Using ASSIGN will change to the first available drive letter. Since I ran this in a custom WinPE, there is no C drive before and it was E. Running ASSIGN in Windows will prompt a new volume screen from Explorer. Exit DISKPART and get the file. It is recommended using normal commands in CMD to get it rather than using Explorer. This is because the elevated CMD can gain access to the WindowsRE folder while Explorer won't because it doesn't run elevated.

Change to the newly assign drive letter, and locate the file using commands like so:

dir boot.sdi /s /a:h

If it finds it in C:\Recovery\WindowsRE then you need to change the attributes to remove it.

attrib boot.sdi -S -H

Then you can use COPY to put the file on a USB drive or other way to get it off the system. After the file is safely elsewhere, re-run the attrib command but use +S and +H instead. Next you would go back into Diskpart and do the above process again, except you will use REMOVE (instead of ASSIGN) and set the ID to whatever it was before... in this case 27.

Now for what to do on the broken PC. This would be done using WinPE as (obviously) Windows isn't accessable. If you want to make it easier you can put the boot.sdi where it is supposed to go now. Using the above process (minus running BCDEdit) you can locate the Recovery partition, change the ID, assign a letter, copy the file into where it is supposed to go, remove the drive letter and change the ID back.

Once the file is where it is supposed to be, we can fix the BCD so you can run recovery. Using the BCD information from the other PC we will need to recreate the entries with the same settings. There is one difference here, the BCD for the recovery partition that would normally be created by going through OOBE is already present but it cannot be seen. So we will make a generic one called {ramdiskoptions} instead of using a GUID. For the purposes of this tutorial, I will use the data from the example BCD posted above in the spoiler.

BCDEDIT /CREATE {ramdiskoptions} /d "Ramdisk Options"BCDEDIT /SET {ramdiskoptions} ramdisksdidevice partition=\Device\HarddiskVolume2BCDEDIT /SET {ramdiskoptions} ramdisksdipath \Recovery\WindowsRE\boot.sdiBCDEDIT /CREATE /d "Windows Recovery Environment" /APPLICATION OSLOADER

When you run the last command, it will show you that a GUID was created. When I ran it, it gave me this one:

{85ea1c35-b70f-11e3-b961-0090f5e7d27f}

So that is the one used in the rest of the commands.

BCDEDIT /SET {85ea1c35-b70f-11e3-b961-0090f5e7d27f} device ramdisk=[\Device\HarddiskVolume2]\Recovery\windowsRE\Winre.wim,{ramdiskoptions}BCDEDIT /SET {85ea1c35-b70f-11e3-b961-0090f5e7d27f} path \Windows\system32\winload.exeBCDEDIT /SET {85ea1c35-b70f-11e3-b961-0090f5e7d27f} osdevice ramdisk=[\Device\HarddiskVolume2]\Recovery\windowsRE\Winre.wim,{ramdiskoptions}BCDEDIT /SET {85ea1c35-b70f-11e3-b961-0090f5e7d27f} systemroot \windowsBCDEDIT /SET {85ea1c35-b70f-11e3-b961-0090f5e7d27f} winpe yesBCDEDIT /SET {85ea1c35-b70f-11e3-b961-0090f5e7d27f} nx OptIn

If you look at the previous BCD, the settings match. Now all that is needed is to enable the F8 menu.

BCDEDIT /SET {default} recoverysequence {85ea1c35-b70f-11e3-b961-0090f5e7d27f}BCDEDIT /SET {default} recoveryenabled yes

This will let you see the "Repair your computer" option in the F8 menu. Since there are no user accounts, it may present an Administrator account as a choice. There should be no password and hopefully that is the case. Then you will see whatever is supposed to show up if the Recovery was working.

I typed this up real quick, hopefully I didn't make an error.

[Spork Schivago]

I know this is an older post.   I wanted to say I really enjoyed your instructions that you provided here.   I wanted to know if you had any articles on how to actually setup a Recovery Console.

I deploy Windows 7 and it creates three MBR type partitions.  An active 500MB System Reserved partition, an empty 14GB recovery partition and a 133GB partition that holds the Windows 7 installation.

I'm just having trouble setting up the store for the recovery partition.   Currently, on the OS partition, there's a hidden Recovery directory.   I'd like it so the winre.wim and boot.sdi file reside on the actual Recovery partition.   When the user presses F10 during POST, I want it to start up recovery and deploy the image that I captured to reinstall the OS.   I want it to delete the System Reserve and the Windows partition, recreate them, and then deploy the image to the partition containing Windows.

Do you have any write ups on how to accomplish this?   Thank you.

Edited March 10, 2016 by Spork Schivago

[Tripredacus]

Did you post about this on Technet? I think I may have seen it or a similar topic earlier today.

There is this public information:

https://technet.microsoft.com/en-us/library/dd744280(v=ws.10).aspx

In general, I can say that the Boot files go in the System partition, winre.wim in the recovery partition.

I do not use this method, so I do not know what the details of it are. For the method I am familiar with, the process works by backing up the OS volume (in parts I believe) to windows.old, removing the files outside of that folder, and then uses Setup to install Windows using the recovery image to that volume. It does not remove partitions nor should it. If you want a system that removes partitions, then you will have to use a recovery method that does not load anything off the hard drive.

[Spork Schivago]

Did you post about this on Technet? I think I may have seen it or a similar topic earlier today.

There is this public information:

https://technet.microsoft.com/en-us/library/dd744280(v=ws.10).aspx

In general, I can say that the Boot files go in the System partition, winre.wim in the recovery partition.

I do not use this method, so I do not know what the details of it are. For the method I am familiar with, the process works by backing up the OS volume (in parts I believe) to windows.old, removing the files outside of that folder, and then uses Setup to install Windows using the recovery image to that volume. It does not remove partitions nor should it. If you want a system that removes partitions, then you will have to use a recovery method that does not load anything off the hard drive.

Thank you.   Yes, I have a few posts on technet and one of them asked some questions about setting up a recovery partition.

Why do you say that the recovery method should not remove the Windows partitions and recreate them?   Is it because the Windows Recovery environment relies on parts of the Windows installation (like the username / password) and isn't really designed to fully restore the PC to factory specs, just reinstall Windows when things break?   I'd like it to use my custom install.wim file.

Also, I have followed that article to a tee but I added the /bootkey 4400 to the last ReAgentc program so I can hit F10 during POST to boot into the recovery environment, however, when I try the F10 stuff, I get a message saying missing BOOTMGR or something.   I believe I'm missing a key step here.   I struggle very much with the BCDEdit stuff and I suspect I might need to use that command to setup a store on the Recovery partition.

If I can automate setting up the recovery partition when 7 is deployed, I am definitely okay with it saving the OS to Windows.old.   Thank you for your help.

Edited March 11, 2016 by Spork Schivago

[Tripredacus]

Even the newer recovery in Windows 8 or 10 does not make any changes to the partitions. Why would it need to be deleted? It is just a container. AFAIK Windows 7 recovery will always backup to the windows.old and this can't be disabled. So you can run into a problem if you are low on space on that volume due to files or small disk size.

 

I've not done anything with bootkey before. Only use the default F8 (Repair your computer) or running recovery from Control Panel. For times when I need to recover a custom image using an answer file, I use FactoryRecoveryTool.

http://www.msfn.org/board/topic/142990-installing-windows-7-from-recovery-partition/#entry918385

[Spork Schivago]

I thought the purpose of the bootkey was in case something happened to the OS partition.   I thought the idea was if the OS partition became corrupt for whatever reason, having the recovery stuff on a separate partition, you'd still be able to recover your system.

I'll look into the FactoryRecoveryTool.    I know, when I followed the first article, even if I didn't use the bootkey option, when I followed the directions where you go into the Control Panel, do the backup and recovery advanced options and everything, I'd get an error message saying the recovery stuff couldn't be found.

Thanks for explaining this stuff to me.   I really appreciate the help and everything.

[Spork Schivago]

I think what the main problem is Reagentc.exe isn't updating the BCD store.  After I run it, when I execute BCDEdit /ENUM ALL, I see everything is still pointing to WinRE on the OS's partition in the \Recovery\{GUID} directory.  The way I run Reagentc is after 7 is installed, I hit F8, boot into Recovery, pick the command prompt and run the command.   Maybe I shouldn't be running it from there.  I'm trying something new.

In WSIM (Windows System Image Manager), in the answer file, I created a Synchronous RunCommand during the OOBE phase, after first login.   I have a cmd script that copies install.wim, WinRE.wim and boot.sdi to the recovery partition and then run the ReAgentc command.   Perhaps this will work.   If I can just get WinRE setup on the Recovery partition and have it recognize install.wim, I'll call this done.  It'd be nice if this new way I'm trying it works.   Then I can just deploy the images and it'll automatically set everything up and save me some time in the future.

Edited March 11, 2016 by Spork Schivago

[Tripredacus]

BCDEdit by itself will act upon the store of the booted OS, if it exists.* So if you boot into WinRE and run BCDEdit, you will see the BCD as it applies to WinRE. To read the BCD for the OS, point to the location of the system partition. Do this using the /Store switch.

Regarding your partition question, I believe that it is a standard practice to put boot files on the first visible partition on a disk. In situations where the System Partition is not Part1 (such as in some Win8/10 deployments) the actual first partition is marked as hidden. We are talking about multi-boot scenarios. Say for example a critical part of the OS or boot file on the OS Partition were deleted or corrupted. In a single boot scenario, you would then be required to boot off something else like CD or USB to fix it. But if your boot files are kept on a separate partition, your OS can go south and you can still boot into WinRE or whatever else. And technically you could delete you OS volume, boot to WinRE and then use Setup to install Windows back to that location again.

*to note, if you PXE boot a WinPE, the BCD store is kept on the PXE server, not on the client.

[Spork Schivago]

BCDEdit by itself will act upon the store of the booted OS, if it exists.* So if you boot into WinRE and run BCDEdit, you will see the BCD as it applies to WinRE. To read the BCD for the OS, point to the location of the system partition. Do this using the /Store switch.

Regarding your partition question, I believe that it is a standard practice to put boot files on the first visible partition on a disk. In situations where the System Partition is not Part1 (such as in some Win8/10 deployments) the actual first partition is marked as hidden. We are talking about multi-boot scenarios. Say for example a critical part of the OS or boot file on the OS Partition were deleted or corrupted. In a single boot scenario, you would then be required to boot off something else like CD or USB to fix it. But if your boot files are kept on a separate partition, your OS can go south and you can still boot into WinRE or whatever else. And technically you could delete you OS volume, boot to WinRE and then use Setup to install Windows back to that location again.

*to note, if you PXE boot a WinPE, the BCD store is kept on the PXE server, not on the client.

This is what I was attempting to accomplish.   I thought I had the partitions setup in such away, where if the OS partition was destroyed, people could still boot into WinRE and then reinstall Windows.

My AutoUnattend.xml answer file didn't work.   Seems like the script wasn't even written.   So, this is what I did.

I PXE boot into WinPE.   I delete the 500MB System partition and the OS partition and then recreate them using DiskPart.   I use imagex to apply my custom install.wim to the OS partition (drive D:).   Then I use BCDBoot D:\Windows /s C: to create the store on the System Partition (drive C:).   I then run the two ReAgentC commands.    When I hit F10 to boot into the WinRE environment, BOOTMGR is missing.    I use BCDEdit /store C:\Boot\BCD /enum ALL to list the stuff in the store.   It doesn't point to my WinRE.wim or my Install.Wim file at all though.   It doesn't point to any.

ReAgentC /Info /Target D:\Windows  shows the proper data though.   But BCDEdit /store C:\Boot\BCD /enum ALL doesn't list my WinRE.wim at all!

Is it possibly that ReAgentC or something is messing with the BCD Store on the PXE Server?

[Spork Schivago]

I feel like I'm missing something.   Like I should be using BCDEdit as well as ReAgentC.   I just can't figure out what to do with BCDEdit.   If I can't get this soon, I think I'm just going to tell the customer he's going to have to just use the thumb drive to reinstall.   It kind of sucks, I think it'd be great, as in a personal triumph, if I could figure this out.  It's become more of a personal challenge at this point in time.   I just hate to have to give up on something.

[Spork Schivago]

Tripredacus,

I wanted to thank you for your help.   When I asked the question, I didn't understand Windows enough to ask the question properly.   I've learned so much in the last few days and I believe I understand what's going on now.   The instructions you posted work fine.    The problem was with the /bootkey option.   I thought that I could somehow boot into the Windows Recovery Environment using F10 during POST but I now believe I need a third party program to do this.   I think the WinRE requires files on the OS partition (like maybe winload.exe?)   I know when I boot the PC, I can hit F8, I see the Recovery stuff, and I can recovery Windows.   Thanks for all the help!   I'm going to consider my original goal accomplished for now.

Thanks!