How is a System Recovery Partition Accessed

[digitalprospecter]

Hey everyone,

I have started this thread in response to a question raised in another thread by the OP.

The question is: Is access to a Recovery Partition managed by the BIOS or by the Operating System?

Here is the context in which the question was put forth:

"I'm a computer forensic examiner so I'm familiar with creating images I was wondering if it was possible to restore an image of a recovery partition and boot from it. I tried with no luck but would like to figure out why it won't work or if it is possible to make it work. My guess is that the MBR was causing the issue. Here is a scenario: you have a drive that has been wiped and you create a 10GB partition and restore the recovery partition image to it. If the rest of the drive is blank with no file system, will the recovery partition work? From what I've seen so far the answer is 'no'. I would assume that the instructions to go from POST into recovery mode is stored in the BIOS. If this is true then not having a file system on the primary partition shouldn't matter. Or is recovery mode initiated by the OS? If that is the case then I understand why my experiment didn't work."

 

[Ijack]

Surely the recovery partition must be managed by the BIOS. It wouldn't be much use for the OS to manage it if the OS is hosed and needs to be recovered.

My guess is that it's simply a matter of making the recover partition the active partition, but it's possible that there's something in the MBR needed to make it boot. In this latter case I still wouldn't say that the OS was managing the recovery partition.

Edit: Here's an explanation of how a particular recovery partition works. The details will probably differ with manufacturer.

 

[digitalprospecter]

Surely the recovery partition must be managed by the BIOS. It wouldn't be much use for the OS to manage it if the OS is hosed and needs to be recovered.

My guess is that it's simply a matter of making the recover partition the active partition, but it's possible that there's something in the MBR needed to make it boot. In this latter case I still wouldn't say that the OS was managing the recovery partition.

Edit: Here's an explanation of how a particular recovery partition works. The details will probably differ with manufacturer.

Interesting link... I found this comment in the article:

"How the DSR Partition Boots
Both DSR types boot by using MBR boot code customized by Dell. This Dell MBR does not affect the boot process when booting the Windows partition or the Utility partition--indeed, no special MBR is needed to boot either of those. However, the DSR partition cannot be booted without this new MBR."

So it sounds like it is BIOS invoked, but requires the existance of a MBR.

Thanks ijack.

 

[Zoron]

Recovery partitions are usually BIOS-managed (you usually have to press a key or combination of keys at the POST screen to start the recovery process). Manufacturers do allow you to create your own set of recovery discs in the event of a hard drive failure so that you can still run the recovery without the partition in place.

My experience with my Acer laptop tells me that you do indeed need the right MBR in place in order to be able to boot from the recovery partition... it came with Vista and I did a clean upgrade to Windows 7. After installing 7, my recovery partition was no longer accessible. It was still on the hard drive, but I could not boot to it. (It probably didn't help that Win 7 decided it wanted to use that partition for it's own recovery partition).

 

[digitalprospecter]

So far, we seem to be leaning towards a combination of BIOS in conjuction with a valid MBR to properly access a Recovery Partition.

 

[Zoron]

That sums it up perfectly.

 

[digitalprospecter]

Best answer selected by digitalprospecter.

 

[digitalprospecter]

Thanks Zoron and ijack. I wish we could give out more than one best answer, but since we can't, I felt that Zoron's post was the most definitive.

Cheers!