Sunday, September 08, 2013

The "Windows 8 Recovery" Bug

You probably ended up here from a Google Search.  Good.

And yes, it's a bug.  One that Microsoft has yet to fix.  And you will at some point find yourself encountering it.  In order to explain its resolution, I need to explain the bug, and the technology behind it in a way you can consume.

I'm a big "teach a man how to fish" fan.  So I'm going to first explain why you're having a problem, then I'll give you the definitive solution.  I'm almost confident that you've browsed many forums, help articles, and tech sites that give you plenty of "fixes", only to find none of them work.  That's why I have to teach you why the issue is an issue before I give the solution because, there isn't a single solution for everyone.

In a nutshell:  Windows itself is preventing the successful run of the recovery application.

A quick disclaimer.  The solution I put here is how I fixed mine.  I have seen a couple of other solutions, and I'll share them, but I honestly don't think they're the root of the problem, rather a symptom of the underlying issue, which is based on what I put here.  That's a theory only.  It at least will point you in the right direction.

About Shadow Copy Technology
Back in the days of Windows Millennium, Microsoft made common a technology that was later refined into what we know of today as System Restore.  This allows Windows to create hidden "snapshots" of your computer's configuration, so that you can "rollback" in the event of an issue or in the event software or hardware is installed that causes problems.  Initially, this was a standalone process, but it evolved over time into a hybrid technology that runs in the background, called Volume Shadow Copy.  The idea of snapshots is that a background service can evaluate and make a compressed replica of the entire structure of a disk much faster than a running program.  It also gets around the issue of locked files because the snapshot service is constantly evaluating everything on the computer.

About System Restore
System Restore allows you to store copies of fixed points in time of your computer so that you can roll back in the event of an issue or failure.  In concept, you can leave System Restore running for a quick and easy restoration of the computer's setup.  It will not save you from viruses, because if a virus infects your restore points, you will only end up restoring the same virus in place.  Rather, it is designed for instances where something you have installed or changed needs to be quickly undone, and the computer restored to a previous state.

Note that System Restore is NOT a backup, in that it cannot be transferred to any other computer or restored from a different version of Windows.  It also should not be the only safety net used to protect your Windows installation from damage or corruption.

How Windows 8 Is Affected
When Windows 8 is first activated, System Restore is running in the background constantly.  This is represented by hidden devices that are mounted where the shadow copies are stored.  The service that runs this process is started manually when the computer is booted, but doesn't terminate while System Restore is running.  The problem here is that while the Volume Shadow Copy service is running for System Restore, that service cannot then be used for other imaging processes that may make use of it.

The Solution
First, verify your failure is the same as mine.


The dreaded "The recovery image cannot be written" error.  Yours likely failed at 27% or thereabouts.  The reason mine failed earlier was because I stopped the Volume Shadow Copy service midstream, verifying a connection between what recimg.exe does and that service, to drill down the root cause of the error.

Second, disable System Restore on your C: drive.  This might cause you to panic, but I submit you can always turn it back on after this process has completed if you really want Restore running (and I do recommend having it run at least a little).  You'll want to disable System Restore AND delete all restore points.  This is to ensure that the Volume Shadow Copy service does not try to access anything.  You don't need to reboot afterwards.


For your Windows (C:) drive, highlight it and click Configure at the bottom to disable the Restore.  You can also do some Google searching for more information about this process.  It's not hard.  But I write this assuming you are somewhat versed in how to get to the above window.


Third, disable the Volume Shadow Copy service under the Services console.  Leave it set to Manual.  This will allow recimg.exe to call it independently when it starts to run.


Once the above steps have been completed, go ahead and re-run your command, and let it run.  Of course, make sure you have at least 8GB of space free on your drive (thus the reason for deleting old System Restore points).  This time, you should (hopefully) get a different result.


From here you can continue following the steps to create your USB recovery drive.

Also, it's possible that if you change your Windows 8 version, your OS may "forget" that there actually is a recovery partition already present.  In my case, I upgraded to the version with Media Center, and even though there's clearly 8GB reserved for the recovery partition, Windows 8 swears I didn't have one.  I'll delete it once I verify the USB drive is working fine.

Some other things I've read:

  • Uninstall TrueCrypt
    • TrueCrypt, depending on how you've got it working, may have a hidden volume defined that is choking recimg.exe for the same reason.  Uninstalling seems to be the solution, but obviously, I wouldn't suggest installing TrueCrypt in the first place.  Run it in portable mode.  
  • BCD (Boot Configuration) in use as C:\bcd
    • This can occur if you've got dual boot or other software that requires changes to boot configuration, such as partition managers and the like.  But under normal circumstances this folder shouldn't even exist.  Some have suggested running mountvolume.exe C:\bcd /d to resolve the issue, but all that does is map the folder to a disk.  it's better to resolve the reason for it being present (a quick reboot may do just that).