GPT/UEFI Recovery Partition problem

ubuysa

ubuysa

The BSOD Doctor
I'm fixing an HP notebook for a friend. He upgraded from Windows 8 (pre-installed) to Windows 10 and his wireless card isn't connecting. He claims it was working ok immediately after the upgrade, of course he's "done nothing" and it's just stopped working (where have we heard that before?). I've done all the obvious (reinstalled drivers etc.) and refreshed Windows 10.

I'm now wondering whether it might be a card fault, so I want to go back to the Windows 8 system that was pre-installed via a factory reset to see whether it all works with Windows 8. He didn't make recovery disks when he got the notebook so all we have is the recovery partition on disk.

My problem is that the recovery partition is there but pressing F11 won't boot it and the HP Recovery Management software was not installed or retained during the Windows 10 upgrade. I'm guessing that Windows 10 has overwritten the boot files and lost the F11 recovery partition option. If this were an MBR disk I'd use diskpart to make the recovery partition active and reboot. But GPT doesn't support or use active partitions.

I really want to use the recovery partition image because it will have all the right drivers installed. So are there any GPT/UEFI experts on here who can help? I'm hoping I can somehow edit the boot partition to include the F11 key and the recovery partition, or make the recovery partition bootable somehow.

This is the first time I've had to work with GPT disks and UEFI so I'm a novice. How can I get the HP recovery partition to boot?
 
ubuysa

ubuysa

The BSOD Doctor
ihavenoideawhatiamdoing said:
As long as he has the key and has used a Microsoft account shouldn't you just be able to create an iso and then give it the key+Microsoft account?
Click to expand...

I could, but where to get a Windows 8 iso from? The official Microsoft site requires a product key to begin the download and no key sticker is on the laptop. It just has a sticker saying Windows 8.

In any case I really want to do a factory restore, I'm starting to suspect the wifi card itself so I want an OS platform I can trust and that's the pre-installed system. This is also going to be a learning experience for me on GPT disks and UEFI boot, so I really want to boot the installed recovery partition if I can (and I must be able to somehow).
 
Last edited:
ubuysa

ubuysa

The BSOD Doctor
ihavenoideawhatiamdoing said:
Wait I found a way to move it to a usb stick and then I could boot of that (cant remember how but maybe googleing will find it)
EDIT: Found it! http://windows.microsoft.com/en-GB/windows-8/create-usb-recovery-drive
:)
Click to expand...

Interesting, I'll give that a try. Thanks.

FWIW I've spent last night and this morning immersed in the bowels of BCDEDIT. I still don't fully understand it. The notebook has three recovery partitions, all hidden. One is labelled Recovery (in Greek, the notebook is owned by a Greek friend) but it appears to be empty. The other two both have boot.sdi and boot.wim files in them and I've no idea which one to use (if either).

I've restored his notebook to the way it was when he gave it to me and I'm going to suggest he contacts HP and gets a recovery USB stick from them for Windows 8 (the notebook has no DVD drive). Then I'll restore it to factory condition with that and see whether everything works normally. We'll decide whether to upgrade to Windows 10 when we know whether the hardware is good.

Here's another lesson for anyone reading this: IF YOUR PC/LAPTOP COMES WITH SOFTWARE TO MAKE A SET OF RECOVERY DISKS OR A USB STICK THEN USE THEM BEFORE YOU DO ANYTHING ELSE!
 
ubuysa

ubuysa

The BSOD Doctor
ihavenoideawhatiamdoing said:
Cant you just re install the windows 10 iso and use the key/Microsoft account/bios key thing and then reinstall the drivers
Click to expand...

Yes I could and I might in time. The issue now is that I don't know for sure whether the wifi issues are hardware or Windows 10. So I want to put the original factory supplied OS on there (Windows 8) with all of the factory supplied drivers. If we still get the wifi issues then it's hardware, if we don't it's something to do with the Windows 10 install.

At the moment I'm less interested in just getting any OS on there, I want the original OS on there for testing purposes. The user is going to contact HP and get a set of recovery disks for the original OS and we'll take it from there.

Thanks for your help, it's much appreciated.
 
Frank100

Frank100

Rising Star
Hi,

The issue here is whether it removed the partition or whether it made changes to the partition. GPT partitioning isn't actually that different from MBR, it just has extra bits. If you have access to a hex editor program you can access the disk directly and make changes to the hex values. You would need to know what you are looking for though. The basic run through in this post might be enough to answer the question, is this worth the time it will take and within the realms of doable for you with the software you will have at your disposal?

MBR partitioning starts with the Master Boot Record (hence the name) and at hex offset 448 within the first sector (LBA 0) the Master Partition Table can be found with there being up to four 16 byte entries for up to 4 partitions. This is where the maximum of 4 primary partitions comes from or where you have to have an extended partition with further partition tables for extra partitions if you want more than 4 partitions on a disk. A flag of hex 80 at the start of each 16 byte partition entry denotes the active partition (if there is one), otherwise it is hex 00 (non-bootable - at least until it is made active and assuming it has boot code in the partition itself).

For GPT partitioning there is a Protective MBR in the same location (LBA 0) but this will only contain a reference to the fact it is using GPT, but this entry will start at hex 448 so that legacy operating systems will understand what to do with a GPT disk (XP 64 bit and up). The next sector will contain the primary GPT header which you can pretty much ignore but it is the next sector after that, (LBA 2) where you will find up to four 128 bytes entries, very similar to the 16 byte entries in the Master Partition Table on MBR, for the first 4 partitions on the GPT disk. GPT disks can have up to 128 partitions with the remaining partition data in 128 byte blocks starting in LBA 3 and going on up till LBA33 (if there really are that many partitions).

With almost no exceptions the first partition itself will start at LBA 34 although it is the relevant 128 byte partition entry you want to look at not the partition. This is where it all becomes complete guess work. What partition contained the recovery software? You might be able to find this out from the online user manuals for the laptop but it's going to be quite griefy. If you can find out which partition it should be in/used to be in, you can look in LBA 2 (the third sector on the disk) and see what partition information is there. If it was the third partition for example then you would start at hex offset 384 (3x128bytes). It's possible it was partition 5 or higher in which case you would start looking in LBA 3 (where you would find the partition entries for 5,6,7,8 - if there are that many).

Each partition type has a Globally Unique Identifier (GUID) type which describes what the partition type is. There are look up tables online and so you could look at the 16 byte GUID, which is the first 16 bytes in each entry and rule that partition in or out as being the recovery partition.

A lot of this depends on what Windows 10 did when it installed. The disk should already have been partitioned as GPT under Windows 8 so it's not like it changed the scheme.

Even if you are comfortable looking at raw hex and know what you are looking for (and found out which was the recovery partition), it's an hour or more of work after you got the disk out, or after you booted the laptop with a Linux distribution and used the built in command line hex editor. That might make this completely over the top. I thought I would offer some suggestions in case you were keen to take on new challenges and absolutely can't abide admitting defeat. Or maybe this provides the justification you want to say this isn't really a viable solution to your friend's problem.

Best of luck

Frank100
 
ubuysa

ubuysa

The BSOD Doctor
Frank100 said:
Hi,

The issue here is whether it removed the partition or whether it made changes to the partition. GPT partitioning isn't actually that different from MBR, it just has extra bits. If you have access to a hex editor program you can access the disk directly and make changes to the hex values. You would need to know what you are looking for though. The basic run through in this post might be enough to answer the question, is this worth the time it will take and within the realms of doable for you with the software you will have at your disposal?

MBR partitioning starts with the Master Boot Record (hence the name) and at hex offset 448 within the first sector (LBA 0) the Master Partition Table can be found with there being up to four 16 byte entries for up to 4 partitions. This is where the maximum of 4 primary partitions comes from or where you have to have an extended partition with further partition tables for extra partitions if you want more than 4 partitions on a disk. A flag of hex 80 at the start of each 16 byte partition entry denotes the active partition (if there is one), otherwise it is hex 00 (non-bootable - at least until it is made active and assuming it has boot code in the partition itself).

For GPT partitioning there is a Protective MBR in the same location (LBA 0) but this will only contain a reference to the fact it is using GPT, but this entry will start at hex 448 so that legacy operating systems will understand what to do with a GPT disk (XP 64 bit and up). The next sector will contain the primary GPT header which you can pretty much ignore but it is the next sector after that, (LBA 2) where you will find up to four 128 bytes entries, very similar to the 16 byte entries in the Master Partition Table on MBR, for the first 4 partitions on the GPT disk. GPT disks can have up to 128 partitions with the remaining partition data in 128 byte blocks starting in LBA 3 and going on up till LBA33 (if there really are that many partitions).

With almost no exceptions the first partition itself will start at LBA 34 although it is the relevant 128 byte partition entry you want to look at not the partition. This is where it all becomes complete guess work. What partition contained the recovery software? You might be able to find this out from the online user manuals for the laptop but it's going to be quite griefy. If you can find out which partition it should be in/used to be in, you can look in LBA 2 (the third sector on the disk) and see what partition information is there. If it was the third partition for example then you would start at hex offset 384 (3x128bytes). It's possible it was partition 5 or higher in which case you would start looking in LBA 3 (where you would find the partition entries for 5,6,7,8 - if there are that many).

Each partition type has a Globally Unique Identifier (GUID) type which describes what the partition type is. There are look up tables online and so you could look at the 16 byte GUID, which is the first 16 bytes in each entry and rule that partition in or out as being the recovery partition.

A lot of this depends on what Windows 10 did when it installed. The disk should already have been partitioned as GPT under Windows 8 so it's not like it changed the scheme.

Even if you are comfortable looking at raw hex and know what you are looking for (and found out which was the recovery partition), it's an hour or more of work after you got the disk out, or after you booted the laptop with a Linux distribution and used the built in command line hex editor. That might make this completely over the top. I thought I would offer some suggestions in case you were keen to take on new challenges and absolutely can't abide admitting defeat. Or maybe this provides the justification you want to say this isn't really a viable solution to your friend's problem.

Best of luck

Frank100
Click to expand...

Many thanks for this Frank, you clearly know this stuff well. I've got you down as the go-to guy now for any disk partitioning problems I might come across! :)

I think that what happened is that the Windows 10 upgrade over-wrote the EFI partition and the F11 Recovery Partition entry was lost. I was thinking that I might be able to learn something about boot configuration data and using BCDEDIT to modify it, and be able to reinstate the F11 Recovery Partition entry. I'd now be much happier to muck about with BCD on a less complex environment, though it's still something of a black art. Having three partitions that were clearly recovery related complicated things a lot because I had no idea which one to boot. One partition appeared empty but wasn't and the other two both had boot sdi and wim files in them. The HP recovery environment is clearly more complex than booting a single recovery wim and I'm not interested in learning how the HP recovery environment works!

BTW. I was using the Macrium Reflect recovery system to muck about with BCD, not only can it restore Macrium Reflect images but it's got a lot of useful diagnostic and troubleshooting tools in there too. It's based on the Windows 10 PE.

The user is going to get a set of recovery disks from HP and that sounds a lot easier than hacking the partition table, even though that might be interesting.


Many thanks again for taking the time to provide such detailed and useful information. :)
 
Last edited:
Frank100

Frank100

Rising Star
It certainly is a bit of a black art when you factor in the proprietary nature of the recovery processes of the major manufacturers like HP and Dell, both of whom like to throw away the rulebook and do their own thing. They of course don't share very much about what they've done leaving IT people to reverse engineer the data and processes and look for what they do recognise, so they can understand how to work out the rest.
 
You must log in or register to reply here.
Top