Boot into Windows recovery system after Truecrypt loaded encrypted system drive

Z

zurnmaf

Member
Hello,


situation:

- I have an old SSD with W7 that I cloned to a bigger SSD some years ago. Now I wanted to boot from that SSD again but get error 0xc000000e (or 0xc0000001 or 0xc000000f depending when I tried to add new BCD entries in my journey, but more on that later).

- I boot via MBR.

- Now to fix those errors the internet tells me to run the repair tool from the Windows CD. Problem:

- This old system drive (as well as my new one) uses full disk encryption with Truecrypt. This means that the 100 MB EFI partition, as well as the C:\ partition will show up as RAW partitions in the disk manager from Windows if I just plug in my old SSD to my PC.

- I can mount those two partitions from the old SSD to whatever drive letter I want with Truecrypt and access the BCD with EasyBCD.

- But of course if I boot from the Windows CD those drives are not mounted and thus encrypted and the repair function from Windows won't work.


Now my idea was the following:

- Mount the EFI-partition from the old SSD with Truecrypt so I can access it in my current Windows and edit the BCD.

- I extracted "boot.wim" from the Windows DVD to an unencrypted drive (E:\). This is the rescue disk. I cannot add it to the EFI partition, because it's too big.

- I used EasyBCD to add the entry to this PE image to the BCD.

- Unfortunately, EasyBCD sets the path to "(boot)" when I choose the .wim location from E:\, which means it obviously won't find it. I now used VisualBCD to set the paths to what it actually is.


Now after booting from my old SSD and entering my Truecrypt password, I got the new BCD entry and I was able to start the recovery image from it. I was quite happy, until I realized that despite I booted into the Truecrypt bootloader and thus got access to the decrypted drive, the recovery system was not able to use the underlying "layer" (so I assumed) to access the encrypted system drive.


Question:

Any idea why the recovery was not able to see the decrypted drive?
When I added some other entries to BCD and ended up in grub, grub was able to list all files from the decypted drive, this is why I assumed Truecrypt would now just be an active "layer" under whatever I start.

I have no idea why the old SSD does not boot, this is why the Windows repair was the only solution I could try.

Here is the current BCD I use on that encrypted drive that does not boot Windows:
1. is the W7 it should load but gives 0xc000000f
2. Is Recovery image on the unencrypted E:\ that boots but the encrypted drive that the BCD that this recovery booted from is on, shows up as RAW.
3. Same image but on the supposedly C:\ drive that I want to boot.
4. A recovery img entry I found via VisualBCD that I added back to the bootmgr - same problem 0xc000000f (or e or 1, don't know right now).
4. Another test entry, ignore it.

How does this C:\ partiton stuff translate to what is really going on underneath? Because it is written that the editor will translate what I currently see on my live PC to the correct device name/id/whatever. But here is the problem: I mounted the encrypted EFI drive as T:\ via Truecrypt and that seems to mess things up(?).

Any ideas how to fix this without unencrypting the old drive?
Can maybe booting into FreeDos help?
I tried adding the FreeDos entry via EasyBCD, it says it will find the image itself but that's about as far as it gets (I put an .img on the EFI partition). Your help website does not mention a guide on how to actually get FreeDos booting. Maybe FreeDos then can access the drive correctly (meaning decrypted) and I can use diskpart or bootrec from there(?).



Code: 
Windows Boot Manager
--------------------
identifier              {9dea862c-5cdd-4e70-acc1-f32b344d4795}
device                  partition=\Device\HarddiskVolume16
description             Windows Boot Manager
locale                  de-DE
inherit                 {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
default                 {37a5d141-21d6-11e5-acf0-d5a08660ef8d}
resumeobject            {37a5d140-21d6-11e5-acf0-d5a08660ef8d}
displayorder            {37a5d141-21d6-11e5-acf0-d5a08660ef8d}
                        {281a0da6-260e-11ee-816c-bc5ff4387852}
                        {33909d64-260e-11ee-816c-bc5ff4387852}
                        {37a5d142-21d6-11e5-acf0-d5a08660ef8d}
                        {ec6a34b4-ca75-479f-971a-9b9febc1b2fc}
toolsdisplayorder       {b2721d73-1db4-4c62-bf78-c548a880142d}
timeout                 30

Windows Boot Loader
-------------------
identifier              {37a5d141-21d6-11e5-acf0-d5a08660ef8d}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
recoverysequence        {37a5d142-21d6-11e5-acf0-d5a08660ef8d}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {37a5d140-21d6-11e5-acf0-d5a08660ef8d}
nx                      OptOut
quietboot               Yes
bootlog                 Yes

Windows Boot Loader
-------------------
identifier              {281a0da6-260e-11ee-816c-bc5ff4387852}
device                  ramdisk=[E:]\boot.wim,{27f2601c-260e-11ee-816c-bc5ff4387852}
path                    \Windows\System32\Boot\winload.exe
description             NST WinPE Image E
locale                  de-DE
osdevice                ramdisk=[E:]\boot.wim,{27f2601c-260e-11ee-816c-bc5ff4387852}
systemroot              \Windows
detecthal               Yes
winpe                   Yes

Windows Boot Loader
-------------------
identifier              {33909d64-260e-11ee-816c-bc5ff4387852}
device                  ramdisk=[C:]\boot.wim,{3369edca-260e-11ee-816c-bc5ff4387852}
path                    \Windows\System32\Boot\winload.exe
description             NST WinPE Image C
locale                  de-DE
osdevice                ramdisk=[C:]\boot.wim,{3369edca-260e-11ee-816c-bc5ff4387852}
systemroot              \Windows
detecthal               Yes
winpe                   Yes

Windows Boot Loader
-------------------
identifier              {37a5d142-21d6-11e5-acf0-d5a08660ef8d}
device                  ramdisk=[C:]\Recovery\37a5d142-21d6-11e5-acf0-d5a08660ef8d\Winre.wim,{37a5d143-21d6-11e5-acf0-d5a08660ef8d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
osdevice                ramdisk=[C:]\Recovery\37a5d142-21d6-11e5-acf0-d5a08660ef8d\Winre.wim,{37a5d143-21d6-11e5-acf0-d5a08660ef8d}
systemroot              \windows
nx                      OptIn
winpe                   Yes
custom:46000010         Yes

Windows Boot Loader
-------------------
identifier              {ec6a34b4-ca75-479f-971a-9b9febc1b2fc}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             New Windows 7/Vista Loader 1
locale                  de-DE
inherit                 {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
bootdebug               No
osdevice                partition=C:
systemroot              \Windows

Code: 
Windows Boot Manager
--------------------
identifier              {9dea862c-5cdd-4e70-acc1-f32b344d4795}
device                  partition=\Device\HarddiskVolume16
description             Windows Boot Manager
locale                  de-DE
inherit                 {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
default                 {37a5d141-21d6-11e5-acf0-d5a08660ef8d}
resumeobject            {37a5d140-21d6-11e5-acf0-d5a08660ef8d}
displayorder            {37a5d141-21d6-11e5-acf0-d5a08660ef8d}
toolsdisplayorder       {b2721d73-1db4-4c62-bf78-c548a880142d}
timeout                 30

Windows Boot Loader
-------------------
identifier              {37a5d141-21d6-11e5-acf0-d5a08660ef8d}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
recoverysequence        {37a5d142-21d6-11e5-acf0-d5a08660ef8d}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {37a5d140-21d6-11e5-acf0-d5a08660ef8d}
nx                      OptOut
quietboot               Yes
bootlog                 Yes
 
zurnmaf said:
How does this C:\ partiton stuff translate to what is really going on underneath?
Click to expand...
See reply here

Win 10 dual boot with partition clone

I tried to copy the current system to an external USB disk (backup / restore). Same problem. I think it's the BCD and the drive letters. It is possible that easyBCD will translate drive letters into internal partition designations (numbered hard disks / partitions). If I duplicate the system...
neosmart.net neosmart.net
 
The ID for GPT drives seems to be the uniqueid you can get from diskpart, see https://www.tenforums.com/backup-re...-uniqueid-gpt-bcd-point-before-rebooting.html.
Though what is the ID for MBR drives?

Because clearly setting them via EasyBCD does not work, and since I assume it's just a GUI for bcdedit, bcdedit also shows the wrong value for the boot drive, because it shows C: which is wrong since the drive is not even mounted. I used bcdedit /store "T:\Boot\BCD" to see the output.

I tried to use the uniqueid from dispart for that encrypted drive, but that did not work:
Code: 
bcdedit /store "I:\Boot\BCD" /set AAABD805 device partition=C:
> The element data type specified is not recognized, or does not apply to the specified entry.


EDIT: Ok I solved it. The key is not to rely on any "high level" software like bcdedit/easybcd because they do not properly map the disks.
First of all the BCD file is just a registry hive so you can load the hive via regedit.
Find the entry for the Windows you want to start, look in the 0x11000004 entry for the name.
Look up the diskid via diskpart, in my case AA AB D8 05.
Then open the corresponding 0x11000001 entry and overwrite the 4 bytes at offset 38. You have to reverse the ID! -> 05 D8 AB AA.
Do the same for the entry 0x2100001.
Unload the hive, reboot.

Done, BCD finds the Windows partition again.

For reference: Fixing Disk Signature Collisions
 
Last edited:
Back
Top