Overwrote Bitlocker MBR
I'm not sure exactly how I overwrote it, but I was writing a floppy image to a floppy disk (using a USB floppy drive), and somehow I inadvertently wrote the floppy disk to my primary hard disk which I have Windows 7 Enterprise x64 installed on with Bitlocker enabled. Now when I boot, I get the error "Non-system disk or disk error." Is there any way to repair this?
I have made a low-level backup in case anything I try does further damage, and here's what I've tried so far...
-
bootrec /fixmbr
- didn't work, now it says "invalid partition table" when I try to boot. -
bootrec /fixboot
- didn't work, command returns "element not found." -
bootrec /rebuildbcd
- didn't work, command returns "Total identified Windows installations: 0"
UPDATE:
After running bootrec /fixmbr
I used diskpart
to recreate the partitions and assign drive letters to them. I was then able to use repair-bde D: R: -rp 123456-*
to start recovering the files. It's still trucking along at the moment, so we'll see how it works out tomorrow.
In case anyone else does this, here's what I had to do, step-by-step, in order to restore my PC to working order.
- Boot from Windows Install disk and choose Recovery, and get to command prompt.
- Run
bootrec /fixmbr
(may not be necessary) - Run
diskpart
and recreate partitions usingquick
flag. Hopefully you know how big your partitions were exactly.- Make sure to mark the System Reserved (if you have one) or C: partition as active.
- Attach a drive of the same size or larger with the same number of partitions you need to recover.
- Run
repair-bde C: Z: -rp 111111-222222-[...]
whereC:
is on the damaged disk andZ:
is on the new disk you're going to temporarily store the recovered / decrypted files on. You'll need to do this for each partition. Hopefully, you have your BitLockers recovery passwords. - Once
repair-bde
finishes, verify you're files were restored. Then useto copy the files back to the old damaged disk.robocopy /mir Z:\ C:\ /xf hiberfil.sys /xj /xjf /xjd
-
UPDATE: Something I did not realize at the time is the
/mir
flag does not copy ownership or security. What I should have ran isrobocopy /e /copyall Z:\ C:\ /xf hiberfil.sys /xj /xjf /xjd
.
-
UPDATE: Something I did not realize at the time is the
- Use the Windows install disk Startup Recovery option to repair the boot loader & System Reserved partition.
- Reboot PC and Windows should load.
- Check if your junction points (e.g.
C:\Documents and Settings
points toC:\Users
) were restored properly as junction points. Mine were not. Could have been where I forgot the/xj /xjf /xjd
flags the first time I ranrobocopy
or it could have beenrepair-bde
. I lean towards the latter.- If you need to recreate your junction points, I used
junction /s /q C:\ > junctionpoints.txt
from SysInternals on another working install to list all of the Windows junction points. - Then I used
mklink /j "C:\Documents and Settings" "C:\Users"
to recreate the junction points on the damaged PC.
- If you need to recreate your junction points, I used
- Re-enable BitLocker
- Go to Control Panel and do Repair on Microsoft Office. This may not be necessary for you, but Outlook did not work me until I did this.
Note: After you do this restore PC, your unique machine ID will change, so some licensed software that uses this unique ID (e.g. DameWare Remote Support in my case) may need to be re-activated.
If you hadn't used Bitlocker this would be fairly easy. However, with Bitlocker in the picture it is not only much harder but potentially impossible.
There are three problems you need to resolve.
1) You will have to restore a valid MBR and bootloader (or GPT+EFI bootloader if you were using that). This is fairly easy - the commands you've already done above will do this.
2) You will have to manually re-create your partition table.
3) You will have to retrieve a copy of your Bitlocker master encryption key. This is NOT the password.
Part 3 is the difficult one. However, if you have the default Windows 7 setup of a 100-300MB boot partition followed by your main OS partition, you may be in luck.
Furthermore, the process above is what you need to do if you want to restore the disk to a working state. If you are able to access the disk from a different computer, then recovering data to a second drive is a somewhat easier process than repairing it in situ.