Recovery partition

dhay13

Distinguished
Jan 13, 2010
46
0
18,540
i'm replacing a hard drive in a windows vista machine. i do not have any disks that came with it. has anyone had any luck imaging the recovery partition onto a new drive and installing from that? i'm going to give it a try.
 

dhay13

Distinguished
Jan 13, 2010
46
0
18,540
I imaged the recovery partition using FTK Imager but it won't boot into recovery mode. The problem has been resolved but thanks for the help.
I'm a computer forensic examiner so I'm familiar with creating images I was wondering if it was possible to restore an image of a recovery partition and boot from it. I tried with no luck but would like to figure out why it won't work or if it is possible to make it work. My guess is that the MBR was causing the issue. Here is a scenario: you have a drive that has been wiped and you create a 10GB partition and restore the recovery partition image to it. If the rest of the drive is blank with no file system, will the recovery partition work? From what I've seen so far the answer is 'no'. I would assume that the instructions to go from POST into recovery mode is stored in the BIOS. If this is true then not having a file system on the primary partition shouldn't matter. Or is recovery mode initiated by the OS? If that is the case then I understand why my experiment didn't work.

Has anyone ever had luck doing this or know why it doesn't work?
 

digitalprospecter

Distinguished
Mar 31, 2010
786
0
19,060
That is a great question. I have always assumed that the BIOS has been programmed to access the recovery partition because even on hard disk drives that I have wiped the C: partition on and reinstalled Windows from disc, I have been able to launch the recovery partition afterwards. I know this because I once reload from disc only to find out there was an undisplayed key combination to launch the System Recovery. I followed up on my fresh install with the recovery partition becuase it included all of the drivers and apps. So my guess is the BIOS is programmed to launch System Recovery.

The have put your question out to the forum in this thread (if you want to follow up on the discussion):

http://www.tomshardware.com/forum/246768-45-system-recovery-partition-accessed
 

dhay13

Distinguished
Jan 13, 2010
46
0
18,540
There is a method that allows for recovery of a 'wiped' drive but it is very costly and only has about a 25% success rate. For the common examiner one pass is usually enough to make it impossible for us to get it.
I haven't researched it but have only heard what I learned in my training but this is what I was told. I guess if it were a matter of national security then it might be worth a try but anything less than that it's not worth it. I believe the DoD is the only one that has the ability to do this. The cost I heard was in the $50,000 range.

There are different theories out there though. I know Gutman says 3 passes, DoD says 7 passes, etc. (this might not be accurate but just to give an example).

I know in my experience with the tools available to me, if it's wiped once it's out of my reach. I use EnCase and FTK, the same tools that are used by the FBI, police agencies, etc., so I know they can't get to it using those either. My instructor was/is a Cpl. with the PA State Police and handles all computer crime investigations in this region for PSP. He said in his 11 years of doing this they have never went past this stage. If it was wiped then they dismiss it and look for other evidence somewhere else.
 

dhay13

Distinguished
Jan 13, 2010
46
0
18,540
That would explain why I can't access the restored recovery partition with a blank hard drive. As far as I can tell the MBR is complete and intact on the original drive. Just wondering if I can re-create it on the new drive. Not worth this amount of effort for this job but just out of curiosity I'd like to try it if I get the time.
 

digitalprospecter

Distinguished
Mar 31, 2010
786
0
19,060
If you use the Recovery Console from your Windows XP CD and at the command prompt type: fixmbr

If Vista Disc is used, boot from CD, and go thru install until you reach the "Repair your Computer" option. then choose the Command Prompt option and type bootrec.exe /fixmbr or bootrec.exe /fixboot (if necessary)

Cheers!