Restoring Windows from a damaged system image


Yesterday, I tried to restore a Windows system image using Windows 8.1 recovery mode on one of my machines but instead of getting the usual completion message, the restoration process terminated prematurely with “The parameter is incorrect. (0x80070057)”. Looking for possible remedies, I stumbled across this blog entry on Technet which lists common reasons for and solutions to problems. For this particular error message, it listed the following solution:

This error is caused by a bug in File Backup where if you don’t back up at least one file during the full backup, every backup after that fails. The workaround is to go through the Backup wizard again and choose a new full file backup at the very end.

Thank you for the information, but at that point in time, my machine was already no longer booting properly so this solution was not really applicable to my system. After all, not having a bootable machine was the whole point of running a full restore using a previously created system image. After several hours of trying different solutions, I eventually got the machine running again. In the following, I quickly run through what worked for me. I hope that this will help others running into similar problems.

Approach

The basic idea for a manual system restore is to get a basic Windows installation running, e.g. using the Windows installation disc, and to replace the contents of the system partition (usually assigned to the C letter) with the content of the backup. If you have a Windows installation disc, the former is straight forward. If you do not have a disc available you can get one from Microsoft’s website. The latter can be done using tools that are available in the Windows recovery console.

Step 1 – Create the basic partitions

In order to restore the UEFI partition required to start the boot process, you can simply perform a clean install of Windows using the original installation disc. At the begining of the setup process, make sure to delete the broken partitions on your installation hard disk. If you want to have a special partitioning, its advisable to configure it during the setup processes since the repartitioning at a later point will require the use of the diskpart command line tool. If your UEFI partition is still working and the partitioning is correct, you can also skip this step.

Step 2 – Start the recovery process

Once you clicked through the installation and Windows has booted for the first time, reboot your machine into recovery mode. However, in order to be able to fully delete all files on the Windows system partition, make sure to use the installation disc to start the system recovery. To do this, shut down the machine and use the boot manager of your BIOS to boot from the CD or USB stick. When the Windows setup screen comes up, select the language options and the keyboard layout and enter the recovery mode. In the recovery mode open the advanced settings and bring up the recovery console.

Step 3 – Locate the system image

Once you have opened the recovery console, you can use diskpart to mount the disk image that has been created during the Windows system image backup. To do this, locate the hard drive that contains your backup. On this disk you should find a folder called WindowsSystemImage. Inside this folder, there should be a subfolder with the name of your PC, e.g. Johns-PC. Underneath you should find another directory whose name contains the date or the backup, e.g. Backup 2014-12-01 12345. Inside this folder you should see a number of virtual hard disks (i.e. files whose extension is VHD or VHDX). Locate the right virtual hard disk that contains your Windows system installation (unless you have a special partitioning this will probably be the largest file. Write down the absolute name of the file (i.e. path and file name), you will need it in the next step.

Step 4 – Mount the system image

Next, you will have to mount the virtual hard disk. If you are running Windows, you can simply use the hard disk partitioning tool which you can find in the control panel but since you are running in recovery mode, this graphical tool is not available. Fortunately, it is possible to use the diskpart command line tool to get the job done. The basic commands that you need are detailed in this blog post:

  • Start the diskpart tool: diskpart
  • Select the image you want to mount: select vdisk file=”full-path-to-image-file-from-step-3.vhdx”
  • Attach the image: attach vdisk
  • Locate the partition with the data: list partition
  • Select the partition with the data: select partition 2
  • Assign a drive letter to the partition: assign letter=V
  • Exit the diskpart tool: exit

Step 5 – Format the Windows disk

Next, you will have wipe all files from the partition to which you want to restore to. If you did a clean install of Windows in step 1, it is likely that the recovery console has assigned the drive letter C. However, since this step is not reversable, make sure to check that this assignment is correct. Once you checked, run the following:

  • Format the target partition: format c: /q
  • Select yes and then type enter to assign no name.

Step 6 – Copy the files from the system image

To copy the files from the virtual hard disk, you can try to use xcopy or robocopy which are both available in the Windows recovery console. However, if you have large files, I would strongly recommend to use robocopy since you might get out-of-memory errors using xcopy. A detailed description of robocopy can be found in Microsoft’s Technet Library. When copying the files from the virtual image to the Windows system disk, it is important to also copy the security settings and other meta data stored in the file system attributes. In order to do this, you can use the following command line:

  • Copy the files using robocopy: robocopy v: c: /efsraw /copyall /sl /zb /r:2 /w:0 /e

Possible issues: When running this command, robocopy failed to copy some of the files in my OneDrive folder and it reported the error code 1920. According to this discussion on Microsoft’s Technet forum, this seems to be normal. To work around the issue, I simply deleted the whole OneDrive folder using rmdir before rebooting the system and I recreated it once Windows was running again. Afterwards, OneDrive was downloading the files again.

Step 7 – Exit the recovery mode and reboot

Now that your Windows system partition has been restored from backup, you can repeat steps 3 through 6 to recover other partitions, if necessary. When done, you can simply exit the recovery mode and reboot the system. If you are lucky, your system should be back to normal. If not, you are probably doomed.