Creating or restoring downloads in GPT markup

Creating or restoring downloads in GPT markup – Vadim Sterkin

The task is simple, and in general can be solved with one bcdboot command in the recovery environment:

bcdbootW:Windows

Here W

- a conventional drive letter with the OS, but the real one is quickly determined like this. The command copies all the files needed for booting to the EFI partition and creates a BCD boot configuration.

But there are nuances. The other day I was solving a problem in this formulation: there are several disks in a PC, and if you remove one, the only Windows from the other one will not boot. Writes Windows failed to start - 0xc0000225 - The boot selection failed because a required device is inaccessible

The configuration of the disks and partitions was like this (instead of beautiful screenshots - photos from the screen, because it is based on real events).

At the same time, there was no EFI partition on the OS disk, which is very unusual.

But this is easy to fix. You can squeeze out 100MB from the system partition in diskmgmt.msc, and everything else is already in the recovery environment:

sel disk 0 create partition efi size=100 format quick fs=fat32 label=”System” assign letter=”S”

However, after creating the EFI partition, the bcdboot command ended with the message Failure when attempting to copy boot files . Upon closer inspection, one of the other drives revealed an EFI partition that was confusing all the cards (Volume 6 in the first picture)

In the end it was decided like this:

bcdboot W:Windows /s S: /f ALL

Here:

W
- Windows partition,
S
- EFI partition
/s S:
- copies download files to the specified S partition
/f ALL
- copying boot files for UEFI and BIOS (in this case it is not necessary, but can also be forced)
/l ru-ru
- bootloader language (not used here, but people often ask how to change it)

As a result, the bcdedit paints the following picture:

In the Windows Boot Manager section, you can see the EFI boot section and the full path to the boot control file. The Windows Boot Loader section specifies the partition of the system to be loaded and the full path to the Windows boot loader. When you turn on the PC, control is transferred to the boot manager, which in turn boots Windows.

Example of partition configuration on a PC with UEFI

Let's look at an example disk configuration in GPT layout on a UEFI system. The order of the partitions depends on the OS.

Windows RE

In GPT partition Windows RE

300-500MB in size (depending on OS) contains the recovery environment. There is a similar size partition on systems with MBR partitioning - there it is called System Reserved and, along with RE, it contains the files necessary to boot Windows.

The recovery environment is in the winre.wim .

It ends up on the Windows RE partition during the installation of the OS on a formatted disk or during the preparation of the PC by the manufacturer. In both cases the principle is the same:

During the process of creating a partition structure for Windows RE, a special attribute 0x8000000000000001 is assigned. It is a combination of two attributes - one blocks automatic drive letter assignment, and the other marks the partition as required for system operation, which prevents it from being removed from Disk Management.
A system image is applied to the Windows partition - standard install.wim or customized custom.wim. As a result, winre.wim ends up in the Windows\System32\Recovery folder.
The Recovery\WindowsRE folder is created on the Windows RE partition, after which this recovery environment location is registered with the reagentc
. W:\Windows\System32\reagentc.exe /setreimage /path T:\Recovery\WindowsRE /target W:\Windows

The utility is included in Windows, but not Windows PE or RE, so it runs from the operating system partition. Along with registering the RE, the command moves winre.wim from the Windows partition to the Windows RE service partition. If you want to see the file, first assign a drive letter using the diskpart utility. Since the file has system and hidden attributes, the fastest way to show it is dir /ah.

As a result of these steps, the recovery environment is booted from the Windows RE partition. I will show the details of the process in an upcoming story about restoring a backup.

The Windows RE partition is not required for Windows to function. The recovery environment may be absent or located directly on the partition with the operating system. However, placing Windows RE on a separate partition serves two purposes:

Booting into the recovery environment on a PC with an encrypted Windows partition
. It is impossible to boot into the recovery environment if it is on a Windows partition that is encrypted. The Windows RE partition is excluded from encryption, so you can always get into the environment and use its tools.
Protecting your recovery environment from rogue hands
. Since the partition cannot be deleted in Disk Management, it is somewhat less likely to die due to carelessness, although it is not difficult to delete it using diskpart if you wish.

System (EFI)

EFI partition

, formatted in FAT32, is required for GPT partitioning on UEFI systems. The standard EFI partition size is 100MB, but on 4K Native Enhanced Format drives (4KB sectors) it is increased to 260MB due to FAT32 limitations. PC manufacturers may store some of their tools on this section, so its size varies depending on the manufacturer.

In GPT partitioning, the EFI partition performs one of the roles assigned to the System Reserved partition in MBR partitioning. It contains the boot configuration store (BCD) and the files needed to boot the operating system.

During Windows installation, it is booted with just one command from the bcdboot

.
The installer knows the letter of the Windows partition (install.wim is applied to it): bcdboot W:\Windows
The command creates the EFI\Microsoft\Boot folder in the root of the EFI partition, copies the boot files to it and creates a boot configuration (BCD).

In some elements of the Russian

Windows (eg diskmgmt.msc) EFI is incorrectly called an encrypted system partition. There is no encryption there, nor is there any mention of it in the English OS.

MSR (Microsoft System Reserved)

The partition is formatted in NTFS and takes up 128MB in Windows 8 and 8.1, and 16MB in Windows 10. It is also required for GPT partitioning because it does not allow the use of hidden sectors of the disk (unlike MBR). As a result, the MSR partition is required for service operations of built-in and third-party software (for example, converting a simple disk to a dynamic one). But Windows can work without it, of course.

Despite the presence of “System Reserved” in the name, the MSR partition has nothing in common with the System Reserved partition in the MBR partition. Additionally, it is not visible in file managers and Disk Management, although diskpart

shows him.

Windows

This is the operating system partition to which the standard install.wim image or a customized image is applied.

Other sections (Recovery, etc.)

PC makers are also adding additional partitions, such as one to store their recovery tools (replacing the standard Windows RE) and another with a backup system image for restoring to factory settings. They may have special GPT attributes for the same reasons as Windows RE.

Thus, the process of deploying an OS on a PC can begin by saving the factory WIM image on the R partition. This allows you to first apply it to the system partition and then register it as a backup image with one command.

W:\Windows\System32\reagentc /setosimage /path R: /target W:\Windows /index 1

As a result, the Reset and Refresh Your PC recovery tools rely on this image, although manufacturers can implement their own rollback paths by pressing function keys.

Data recovery from GPT and MBR partitions

While Windows 10 is slowly but inevitably taking over home and office computers, more and more users are starting to look for a data recovery program that works with the new operating system. Hetman Partition Recovery 2.3 (as well as subsequent versions) is fully compatible with Windows 10, its new system structures and security mechanisms. Let's look at some of the key technical features of the tool.

GPT and MBR support

At the dawn of the era of personal computers (at least those running the Microsoft operating system), hard drives were crashed exclusively using the Master Boot Record, or MBR. In those days, the MBR was part of the system boot process, and the BIOS was in charge of everything. Then, the loading sequence looked like this. The computer's BIOS (a set of programs that runs from a chip built into the motherboard) initialized the hardware, started the hard drive, and attempted to load software from the disk. In order to determine where exactly to look for the boot code, the BIOS analyzed the partition information that was stored in the Master Boot Record.

GPT (GUID Partition Table) is a universal standard for disk partitioning. Technically, this is part of the new UEFI standard, which was created to replace the ancient BIOS. Initially, GPT was only partially supported by 32-bit versions of Windows 7. But, all 64-bit versions of Windows, starting with Windows Vista, fully support booting from GPT disks. Windows 8, 8.1 and Windows 10 can boot from GPT disks in 32-bit and 64-bit versions.

When restoring a hard drive, it is important to choose a utility that supports the current drive partitioning scheme. Hetman Partition Recovery fully supports MBR and GPT, even if you are running the program on a system that has limitations or does not support this partition scheme. For example, the most common 32-bit version of Windows XP does not have access to GPT partitions of hard drives, while Hetman Partition Recovery has the ability to analyze and recover such hard drives without problems.

A unique feature of Hetman Partition Recovery is its ability to work on all motherboards: both BIOS and UEFI based, which allows you to recover GPT partitions even if the motherboard does not support UEFI.

It's worth saying that while supporting both disk partitioning schemes, Windows 10 favors the newer GPT as part of the boot process.

How to find out if a disk is GPT or MBR

What is the markup style of the storage media connected to the computer - GPT or MBR? How to find out? In a working Windows environment, this can be done using standard disk management. diskmgmt.msc through search or the “ Run ” . And look at the Windows partition structure as shown above. If the media is purely for user data, there is no Windows on it, call the context menu on it and look at the inactive conversion function. If it is " Convert to GPT disk " then the disk is MBR style. If “ Convert to MBR ”, then, accordingly, the disk has a GPT style.

This information is presented much simpler in the free utility Show Disk Partition Style from the developer Sordum. It is portable, we just download it, launch it and see a simple sign indicating the layout style of all storage media connected to the computer.

In the interface of advanced disk management managers we will get more information on any aspects of media. For example, in one of them - AOMEI Partition Assistant - we will see a direct indication of the layout style both on the disk map and in their tabular summary.

Windows 10 compatible

If we talk about compatibility with Windows 10, then the latest version of the operating system from Microsoft has implemented a number of changes throughout the system. After all the controversy surrounding Microsoft's previous attempt with Windows 8, the new Windows 10 is designed to be the best Microsoft Windows that has been introduced so far.

When upgrading to Windows 10 from a previous version of Windows, the Setup Wizard attempts to preserve all user data, including programs, documents, and files. However, in some cases this may not be possible (for example, when upgrading from a 32-bit version of Windows to a 64-bit version, or vice versa). And in some other cases the transition may not be complete. Windows 10 is known for its ability to remove software without asking, and in some cases even lock your computer causing it to freeze (or what's known as a "bootloop"). If something like this happens to you and you lose access to your files, or if your documents are lost during an operating system update, you will need data recovery software.

Hetman Partition Recovery is designed to help you recover files and folders even if you cannot boot Windows (in which case you need to connect the hard drive to another, working system). Even if the files are completely lost and a new file system or partition structure is created on the disk, Hetman Partition Recovery will help using signature search.

Discussion

This entry does not pretend to be a comprehensive FAQ on GPT, especially since Microsoft already has it (I think I even saw its Russian version, but I couldn’t find it right away). I just wanted to lift the veil on one of the stages of installing Windows, as well as clarify some very confusing terminology and clear up basic questions about creating a partition structure. In the next article, I will discuss the intricacies and strategies for backing up UEFI PCs.

In general, the presence of UEFI in the motherboard does not exclude the possibility of using MBR partitioning. By the way, write in the comments what system and markup you have!

If the MBR is on UEFI, please tell us why this happened. If you had any problems creating GPT markup, please write down what they were and how you solved them.

Once again I paraphrased this paragraph, because in the comments they continue to find fault with the word “mandatory”.

Signature search

Signature search is a general designation for a number of content data recovery algorithms. With signature search, the data recovery tool will search for actual data and not just analyze the file system. The operation of signature search algorithms is similar to the operation of antivirus products. They scan the entire surface of a hard drive or read the entire contents of a flash drive or memory card in order to find identifiable signatures. As soon as a detectable signature is encountered (and there are thousands of them in the Hetman Partition Recovery database), the algorithm will look for the file header, analyze it, and try to determine the length of the file based on the information obtained from the header.

In some situations, simply analyzing the file header is not enough. For example, text or HTML files do not contain file length information. In such cases, the algorithm will continue to read the disk sectors one by one, looking for a sector that does not contain information that will be considered part of that file. If we are talking about a text file, the signature search algorithm (in this case it is more content analysis than signature search) will determine the encoding of the file and scan subsequent sectors to determine whether they contain text in the same encoding. If matching binary data is encountered, the algorithm considers that the end of the text file has been reached.

For some formats, such as Skype databases (or SQLite databases in general), the process is even more complex, since the database does not have a specific fixed encoding and the header does not define its size. In the case of such files, Hetman Partition Recovery will continue to scan subsequent sectors, trying to determine whether they belong to the file originally found.

In a word, signature search helps to recover data located on a failed, damaged or unbootable disk.

How to format a GPT-protected partition

If the drive is new and does not have any important data on it, the easiest way is to use the following instructions:

Open a command line (Start - Run - cmd, or Win + R - cmd).
Enter the diskpart command in the line and select the disk with the GPT partition: select disk *, where * is the number of the corresponding HDD. You can see this number in Disk Management.
Type clean in the command line and press Enter - this command will completely delete data from the drive. After this, a message should appear indicating that the cleaning was successful.
Enter the last command - create partition primary, which will reinitialize the HDD, and press Enter. You will see a line on the screen indicating that the specified partition was created successfully.

After performing these manipulations, the protection from the disk will be removed, and it can be reformatted for any file system.

Conversion with special programs

If there is valuable information on the HDD that you do not want to lose, you will need a special utility to convert GPT to MBR - for example, Paragon Hard Disk Manager.

Launch Paragon and select the GPT partition in it.
Right-click on the drive and select “Convert from GPT to MBR” from the pop-up menu.
Confirm your actions by agreeing to the warnings issued by the program, and click the button to start the conversion process on the toolbar.
The conversion will begin, in some cases requiring a PC restart.

When the task is completed, you will receive a regular drive with a standard boot record and completely saved data.

Sometimes it happens that the user decides to reinstall the operating system, but eventually receives a message that the installation cannot continue because the disk has a GPT partition style. In this case, a program called MiniTool Partition Wizard will come to the rescue.

The utility is completely free and is distributed in two versions - a version for working in the normal interface and a bootable image. In this case, you will need the latter.

Download the program image and burn it to a flash drive using the Ultra ISO utility.
Without removing the flash drive from the computer, reboot it and enter the BIOS using the Del or F4 key. Change the boot priority and boot from the flash drive. After that, select launch the program.
Select the drive you want to convert (it is the drive, not one of its partitions - this is important).
Find the line “Convert GPT Disk to MBR Disk” on the right side of the window and click on it.
Find the “Apply” inscription at the top and click on it to confirm the action. If pop-ups appear with a question like “Are you sure you want to do this?”, click OK and wait for the process to complete.

If you receive an error when trying to convert, notifying you that the drive is a system drive and cannot be converted, follow these steps:

Find and select a partition on the drive called “Reserved by the system” (usually its size does not exceed 300 MB) and delete it by clicking on the “Delete Partition” button.
Confirm the changes made by clicking on “Apply”.
Repeat the conversion algorithm described in the previous paragraph.

When the conversion is complete, the drive partitions will remain in place and you can install the operating system without any problems.

Conclusion

Hetman Partition Recovery is one of the most comprehensive data recovery tools on the market. The program supports a variety of magnetic and solid-state devices, including all types of hard drives, SSD drives, USB drives, memory cards, regardless of brand and model, as well as many storage devices that you have probably never seen in real life. The product is actively developed and constantly updated, including support for the latest versions of Windows. You can download a free trial version of the program!

How to open a GPT protected partition

Having understood the whole theory, you can proceed directly to explaining how to change GPT to MBR so that the hard drive can be opened within a 32-bit system. Looking ahead, let's say that there are two ways. The first involves using the command line, and therefore most people may not like it, because working in a graphical interface is much more convenient and clearer. That is why the second method is for such people. It already implies the use of a special program. But first things first.