Rescue and Recovery

From ThinkWiki
Revision as of 04:38, 31 January 2011 by Voominc (Talk | contribs) (How to overwrite the MBR using the IBM Product Recovery CD-ROM)
Jump to: navigation, search

Rescue and Recovery version 3.0 consists of a bootable partition containing various system recovery tools, including full recovery of the preinstalled Windows XP partition. It can be activated by pressing the ThinkPad, Access IBM or ThinkVantage Button during system boot. It contains a FAT filesystem (sometimes labeled "IBM_SERVICE", "SERVICEV001", etc.), and has partition type 0x12 ("Compaq diagnostics" in fdisk).

As opposed to a Hidden Protected Area Recovery partitions are ordinary partitions, accessible through the partition table. As they are ordinary partitions they are accessible by ordinary partitioning tools. They should be dealt with carefully.

Rescue and Recovery is a Windows-specific feature. If you intend to recover into Windows when you have an issue, it is important to follow the warnings here carefully. If you intend to run another operating system exclusively and never return to Windows, removing this partition is safe. If you remove it, you can still reinstall windows at a later time, provided you have created a Recovery set of discs (1CD + 1DVD or 5CDs required). Booting from the Recovery CD will restore the system to the factory state including the recovery partition.

Proper MBR

ATTENTION!
Only tinker with the MBR and the Rescue and Recovery partition if you know what you're doing. Mistakes can leave the system unbootable and can make it very difficult to retrieve the data on the harddisk.

Consideration 6 of the Readme states:

"The Master Boot Record (MBR) must be configured properly for the Rescue and Recovery application to function properly. When possible, the Rescue and Recovery application attempts to ensure the proper configuration of the MBR. This can only occur if the Rescue and Recovery application is installed after other applications that requires the MBR."

Apparently, the MBR is not "configured properly" if LILO or GRUB have written it. The following is the case:

  • The default bootloader seems to ignore the active bit and always boots the first partition instead
  • The default bootloader contains code to catch a press of the appropriate button during bootup and launch the Rescue and Recovery application in that case
  • Before launching the Rescue and Recovery application at system boot, the default bootloader changes the partition type of the Rescue and Recovery partiton to 0x0b, otherwise it changes it to 0x12 (to hide it from Windows)
  • The Rescue and Recovery application assumes that the first partition contains Windows
  • When booting from the Rescue and Recovery partition, it needs to have its type set (either by Thinkvantage or by GRUB) to 0x0b (FAT32) for the default bootloader to launch the Rescue and Recovery application.

Since neither LILO nor GRUB catch the press of the button (an undocumented mechanism anyway) it is not possible to launch the Rescue and Recovery application by pressing the appropriate button during system boot, once LILO or GRUB have altered the MBR for their boot procedure.

IBM provides a program to manage the Rescue and Recovery bootloader. It is located in C:\Program Files\IBM ThinkVantage\Common\BMGR or C:\Program Files\Common Files\Lenovo\BMGR. It can select the partition to boot, and also allows for rewriting the MBR if it was written by another bootloader. More information is needed about this program. Here is an example that restores the IBM MBR. It seems that it only extends the already installed MBR. Therefore you must have a valid Windows MBR installed if you want to boot into Windows. The GRUB MBR doesn't work here. 

cd C:\Program Files\IBM ThinkVantage\Common\BMGR
bmgr32 /Fbootmgr.bin /v

Some more information about BMGR here, but it may be slightly out of date: http://www.redbooks.ibm.com/abstracts/SG247107.html (lookup BMGR32 in the Index)

Sometimes it is not enough to simply restore the IBM MBR if you want to boot into Windows. The Windows MBR might have been overwritten by another bootloader. In that case you should restore the Windows MBR using a Windows CD. More info can be found on http://www.novell.com/documentation/suse91/suselinux-adminguide/html/ch07s05.html

  • On my T42p and T43p, BMGR32.EXE was in C:\IBMTOOLS\utils. What seemed to work best was to run it first with /Fbootmgr.bin reboot, and if that didn't fix R&R, run it again with the /B0 /M0 /OEM switches. Have a XP install CD ready so you can do a FIXMBR from the Recovery Console if the machine won't boot (happened to me several times).
  • On my X32, BMGR32.EXE is also in C:\IBMTOOLS\utils. It works best with the /M2 switch to restore the R&R MBR:
 cd \IBMTOOLS\utils
 bmgr32 /Fbootmgr.bin /M2 /V
/M0 also works, but /M2 restores it to factory state. As stated above, you must restore the MBR to the Windows XP MBR first before running bmgr32.exe.
If you've run bmgr32.exe too many times, you might have to clear the sectors from sector 1 to sector 62 (sector 0 is the MBR). If you know what you are doing, the following Linux dd command can do it for you:
 dd if=/dev/zero of=/dev/sda bs=512 seek=1 count=62
This command is safe to run only when the first partition starts at sector 63, the 64th sector of the hard drive (probably true).

Using Product Recovery to Restore the Windows MBR

The Product Recovery CD/DVD-ROM erases your hard disk and restores it to its original factory state with Windows. The GRUB MBR can interfere with this. The symptom is that you try to recover, but the recovery process ends immediately, and the computer tries to boot with GRUB. The problem is that the one part of the disk that Product Recovery (version 5.6) does not overwrite is the MBR.

If this happens to you, first completely erase your hard disk using PC Doctor on the IBM Product Recovery CD-ROM:

  • Insert Product Recovery Disk 1 (this procedure assumes version 5.6, circa 2002)
  • Power up the computer, press F12, select CD-ROM Drive as the boot device
  • After IBM Product Recovery boots, it will give you two choices:
    • Full Recovery. Presumably you already tried this and failed.
    • System Utilities. Select this.
  • Select Run diagnostics. The PC Doctor diagnostic program will start.
  • In the menu along the top, choose Utility.
  • In this menu, choose Full Erase Hard Drive and confirm that you really want to erase. Full Erase works, but takes about two minutes per gigabyte. If you find that Quick Erase Hard Drive also works, please edit that fact into this document.

After Erase Hard Drive finishes, your hard drive has no MBR, so Product Recovery has no choice but to install a new one.

  • Reboot, press F12, select CD-ROM Drive as the boot device
  • After IBM Product Recovery boots, this time select Full Recovery.

MBR written by GRUB

The MBR written by GRUB can be used to launch the Rescue and Recovery application. However, if you leave the type of the Rescue and Recovery partition to 0x12 (Compaq diagnostics), trying to boot this partition will result in an error message "c000021a, Fatal System Error". To avoid that, and to make sure the recovery partition is always of the right type, add a line to change the partition type to 0x0b (FAT32) to the Rescue and Recovery partition's entry in your /boot/grub/menu.lst. Also, as we will be hiding the Rescue and Recovery partition from Windows (see below), we need to unhide the partition here to make sure it will be visible and bootable. So, assuming your Rescue and Recovery partition is the second partition, the GRUB entry would look like this: 

 title           IBM Rescue and Recovery
 root            (hd0,1)
 parttype        (hd0,1) 0x0b
 unhide          (hd0,1)
 chainloader     +1
NOTE!
Some people reported this not working (in particular, on a Z61m 9450-3HG). Version 4.0 of Rescue and Recovery uses an NTFS partition, so a partition type of 0x07 (HPFS/NTFS) may be needed.
TODO
verify this note

You will find that while the above lets you launch the Rescue and Recovery application, trying to run the Hardware Diagnostics tool will fail, as it needs a "properly configured" (original) MBR. What happens is that to run the hardware diagnostics, the R&R software temporarily changes the "properly configured" MBR to boot a PC-DOCTOR disk image found on the Rescue and Recovery partition, then asks you to reboot. So all we need to do to get the Hardware Diagnostics back is add another entry to /boot/grub/menu.lst, that will load the PC-DOCTOR disk image. The entry is similar to the IBM Rescue and Recovery one above, with a different chainloader line: 

 title           Hardware Diagnostics
 root            (hd0,1)
 parttype        (hd0,1) 0x0b
 unhide          (hd0,1)
 chainloader     /bootsect.dos

Finally, as mentioned previously, the Rescue and Recovery partition should be hidden from Windows. This is to prevent any modifications being done to it, as they may damage the Rescue and Recovery software. So, assuming that Windows is on the first partition, the Windows GRUB entry would look like this: 

 title           Windows
 root            (hd0,0)
 hide            (hd0,1)
 chainloader     +1

GRUB in a partition's boot sector

A way to have your Access IBM button still functional on bootup, is to create a separate /boot partition, install GRUB to that partition and make it active. This will leave the MBR untouched.

NOTE!
If the above finding is true that the MBR ignores the active bit, that partition has to be the first one. In most recent Linux distributions it is not easy to create /boot as first partition and shrink the Windows partition. In that case the Windows bootloader can be used to boot Windows and Linux, also preserving the Rescue and Recovery functionality. See below.
  • In the BIOS, set the IBM Predesktop Area to 'Secure'.
  • Boot your Linux distribution's installation CD.
  • Follow the instructions and go through the regular installation process.
  • Create a primary partition for /boot (the other stuff can go into the extended partitions) and when the time comes to install GRUB, make sure you install it into the boot sector of the boot partition.
  • Set this boot partition as active.

Using the Windows Bootloader to Boot Linux

The NTLDR Windows bootloader can be configured to boot Linux in addition to Windows. The master boot record (MBR) is unchanged, so the ThinkVantage Rescue and Recovery system boot functionality is preserved. This clever procedure was originally applied to Ubuntu Dapper Drake, and is generalized here.

0. Added warning: with this method, you cannot hibernate windows and boot anything else. The windows boot loader jumps on resuming windows before asking anything (and you can already verify this right now, whatever your current configuration is).

1. Boot Windows and make product recovery disks. You will see this step repeated throught this wiki for good reason. The recovery disks can refresh your hard disk to its original factory state, getting you out of the trouble you might make in the next step.

2. Shrink the Windows NTFS partition to the size you like. You will need a bootable CD that is capable of resizing NTFS partitions. I have done this before with Knoppix, but this time I used Partition Magic (US$70).

Leave the Rescue and Recovery partition (~5GB) at the end of the disk. Other authors claim that it must not be moved. I did move it, and it works fine. Still, in retrospect I agree that the end of the disk is the best place for your Rescue and Recovery partition.

3. Reboot. Push the ThinkVantage button during system boot, and verify that Rescue and Recovery still runs. Reboot into Windows to verify that the partition resize was successful.

4. Begin your Linux installation. Linux will see the Windows NTFS partition as /dev/sda1, and the Rescue and Recovery FAT32 partition as /dev/sda2. When the Linux installer asks you about GRUB, do not install GRUB in the MBR. Instead, install GRUB in the /boot partition (most likely /dev/sda3).

5. After the Linux installation is finished, reboot with a bootable Linux live CD. The "rescue mode" of your Linux installation CD #1 should work fine for this. Usually you start the rescue mode with the command, 

   linux rescue

Start the network if you plan to use FTP in step 7.

6. After you get a shell prompt, become root if necessary, and then write the first sector of the /boot partition (probably /dev/sda3) to a file using the dd command: 

    sudo -i                   # If necessary
    cd /mnt/sysimage/boot     # Or wherever your live CD mounts the /boot partition
    dd if=/dev/sda3 of=grub.img bs=512 count=1

The resulting grub.img file should be 512 bytes long.

7. Transfer the grub.img file somewhere where you can read it from Windows. You can use removable media like a USB flash drive, or even FTP.

8. Reboot into Windows. Copy the grub.img file to c:\grub.img.

9. Make a backup copy of the c:\boot.ini NTLDR control file. c:\boot.ini is read-only and hidden, so you will have to tell Windows to show hidden files, and turn off the read-only property on c:\boot.ini.

10. Edit c:\boot.ini. Append the line, 

   c:\grub.img="Linux GRUB Bootloader"

So that Linux will boot by default, you may also want to change the default OS to c:\grub.img, and reduce the timeout to 5 seconds or so. For reference, here is my c:\boot.ini file for Windows XP: 

   [boot loader]
   timeout=5
   default=c:\grub.img
   [operating systems]
   c:\grub.img="Linux GRUB Bootloader"
   multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Professional" /noexecute=optin /fastdetec

11. Reboot. Now the Windows boot menu should offer you a choice of "Linux GRUB Bootloader" or Windows XP. Choose "Linux GRUB Bootloader", and you will be taken to the GRUB boot menu, where you can select Linux, or even go back to the Windows boot menu.

12. When you need Rescue and Recovery, push the ThinkVantage button upon system boot. Since you have touched neither the MBR nor the Rescue and Recovery partition, Rescue and Recovery will work exactly the same as it did before you installed Linux.

Newer versions of Rescue and Recovery

Rescue and Recovery version 4 is installed on T61/R61.

The partition type is 0x27. By factory default, the R&R partition is the first partition on the disk. The filesystem used is NTFS. The preloaded Windows appear as the second partition, with the active bit set.

(_NOT_ on all T61s. Mine has version 4, but the R&R partition is the 2nd, and its ID is 0x12. More work needed here....)

(The same here on R61 8919-CTO - R&R version 4 was second partition of type FAT32)

R&R version 4 bootloader seems to honor the active bit in the partition table. To install Linux while maintaining the R&R functionality is therefore rather straightforward:

  • Shrink the second Windows partition – or remove it if not needed
  • Add partitions for Linux (or other operating systems), one of them has to be a primary partition since the R&R bootloader cannot boot from an extended one
  • Install GRUB on the boot sector of the newly added primary partition
  • Remove the active bit from the Windows partition and activate the boot partition with GRUB

Older versions of Rescue and Recovery

Some Thinkpads (e.g., T23 and T30) do not come with a Recovery CD, but also do not support the Hidden Protected Area. These ThinkPads have an older version of Rescue and Recovery preloaded on the hard disk to implement the factory recovery function. Most of the comments above also apply to the older versions, with the following differences:

  • The recovery partition type is 0x1c, hidden FAT32, LBA-mapped (or 0xc when unhidden).
  • The boot manager program is in C:\IBMTOOLS\RECOVERY and only runs in a 16-bit DOS environment
FIXME
name of this boot manager needed
  • The IBM Predesktop area runs atop of Windows 98 (command-line) instead of WinPE
  • The ThinkPad A22p laptop does not appear to have a boot manager (that I could find). I was able to restore Rescue and Recovery functionality on such a laptop by using a tool called MBRWizard to copy the first four sectors from a working laptop to a non-working one.

Recovery Boot Hangs

On an R61 I recently tried to restore XP via cd/dvd with a new hard drive in the machine which had fedora 9 installed with an encrypted partition. The boot cd/dvd would start booting, flash "inspecting machine configuration" or something similar, then hang on a blank screen. To check if your cd/dvd is actually okay or not, unplug the HD completely, in my case the cd/dvd booted fine after that. To "fix" this issue such that I could actually run restore, I booted fedora 9 from dvd, repartitioned the drive as unencrypted and vfat, after saving the new partition I was able to go back and boot the recovery cd/dvd. I'm not sure if you actually have to do exactly what I did to the drive or not but that's what I did and it worked so maybe some smaller subset would be sufficient.

Recovery from hard drive

If you are able to load Rescue and Recovery either using F11, or the installed grub, or SGD (Super Grub Disk) (download at http://www.supergrubdisk.org/ and use the option Boot Window fron 2nd partition), you might restore the system to the factory preload.

If you install GRUB in the MBR, the recover will start but it won't replace the MBR. In this case GRUB is started, but without other file it get stuck with error 22. To restore the MBR one could either try to use rnr31_rrd.exe (XP) or rnr40_rrd.ext (Vista) if you have a floppy disk. If you have only a cd on rapidshare there are iso image (google for instance using rnr31_rrd_fixed.iso). I tried but without success. Even if the machine does not boot, somehow the recovery takes place. Using SGD as boot loader the recovery can proceed, but so far I got an unstable machine. In particular the recovery cd cannot be produced anymore...

External links

Models featuring this technology

Retrieved from "https://www.thinkwiki.org/w/index.php?title=Rescue_and_Recovery&oldid=50396"