Powershell & bcdedit: Identify recovery partitions

Question

I am trying to script the elimination/backup of the OEM partition (which just brings back the system to an outdated version of no practical use).

On many systems, using DISKPART list partition returns more recovery type partitions: one is the official Microsoft Recovery Tools partition (WinRE) and others come from the OEMs.

The first step is to safely identify the position of the WinRE partition. I did not find any straight way in bcdedit or PS other than:

$renv=(bcdedit /enum "{default}" | Select-String "^recoverysequence" | Out-String | Select-String "{.+}").Matches.Value
(bcdedit /enum $renv | Select-String "^device" | Out-String | Select-String "\[.+\]").Matches.Value

This returns a string like:

[\Device\HarddiskVolume1]

where the volume number is the partition to use in Diskpart. (Remaining recovery partitions and the OEM type partitions can be backupped).

Is this the correct procedure to identify the WinRE partition?

Any more straight and/or better approach?

score 1 · Answer 1 · answered Aug 29 '17 at 14:03

Aside from streamlining the Select-String with a Lookbehind-RE
I dont't see a better approach ATM.

$renv=(bcdedit /enum "{default}" | Select-String "(?<=^recoverysequence\s+)({.+})").Matches.Value
(bcdedit /enum $renv | Select-String "(?<=^device.+)\[.+\]").Matches.Value
[\Device\HarddiskVolume5]

score 1 · Accepted Answer · answered May 10 '19 at 19:58

There's a command line tool called ReagentC, and it's in the path, so you can call it from any administrative command prompt.

reagentc /info

...will produce some output like:

Windows RE status:         Enabled
Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
Boot Configuration Data (BCD) identifier: 496c58c4-71cb-11e9-af8f-001c42903d2e
Recovery image location:   
Recovery image index:      0
Custom image location:     
Custom image index:        0

Also, if you're writing code to do the work, you can discover the recovery partition by calling a winapi function to do the work. It's an obnoxiously complicated api to call...but for what it's worth, it's DeviceIOControl with the control code of IOCTL_DISK_GET_PARTITION_INFO_EX. If you're not using C or some language that defines unions, this is a pain. The structure you get back varies with whether the disk is GPT or MBR format.

If the disk is MBR, the returned partition type will be 0x27, and if it's a GPT drive the partition type will be the guid: de94bba4-06d1-4d40-a16a-bfd50179d6ac.

Powershell & bcdedit: Identify recovery partitions

2 Answers2