Manual recovery from Windows 7 System Image Backup(VHD) using Ubuntu/Linux

Windows 7 system image backup saves the whole windows partition in raw format inside a VHD-file(Virtual Hard Disk). The VHD format is also used in virtual environments, as Hyper-V and Virtualbox. Unfortunately Windows system restore is limited in the capability to restore to another disk layout. But with the use of vdfuse in virtualbox-fuse(universe) it’s possible to restore the partitions manually with a Ubuntu Live system. Then you are in complete control yourself, disk layout etc.

This was done to restore a system disk(crashed SSD) to a regular hard drive which was already in use (contained the backups). The partition on the regular hard drive was moved to make room for the system partitions in the beginning, and the backup was mounted through vdfuse and restored with dd.

Walk through
Prepare a Ubuntu Live system(USB, cdrom, etc) and boot it. Partition the new disk with GParted. In my special case, I moved my existing partition to the right/end of disk. Then I noted the new placement:

sudo fdisk -l /dev/sdb

I’m not sure where Windows system image stores (if it does) the MBR, but you could search through the WindowsImageBackup folder for a file of 512 bytes. Most likely, it manually creates the partitions and writes a fresh boot sector. This can also be done by creating the partitions and using a Windows install disc/USB to repair the startup. There should be a 100MB “System reserved” primary partition with bootflag enabled, and the Windows partition itself. Here I just copy the working MBR from the crashed disk:

MAKE SURE YOU KNOW WHICH HARD DRIVE IS WHICH BEFORE USING DD
sudo dd if=/dev/sda of=/dev/sdb bs=512 count=1

Then I added the already moved partition (the data is still there, we just lost the reference to the partition when moving MBR from sda to sdb).

sudo fdisk /dev/sdb

If you haven’t a moved a partition, skip this step: Reboot computer, use an Windows install disk to check the integrity of the moved partition (chkdsk), when done boot Ubuntu again.

Add universe to apt sources(/etc/apt/sources.list):

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://archive.ubuntu.com/ubuntu/ precise universe

archive.ubuntu.com can be replaced with your local mirror. Usually the local mirror is named XX.archive.ubuntu.com, where XX is your country code (no for Norwegian -> no.archive.ubuntu.com).
Update apt and install virtualbox-fuse:

sudo apt-get update
sudo apt-get install virtualbox-fuse

Mount the partition which contains the backup (WindowsImageBackup directory). Find the VHD-files. Create two empty directories and mount the VHD-files(read only):

sudo mkdir /media/f1
sudo mkdir /media/f2
vdfuse -r image-file1.vhd /media/f1
vdfuse -r image-file2.vhd /media/f2

Inside the VHD-files, there is a Partition1 file. This is the raw image of the partition backed up. In f1/f2 you should find one Partition1 file which is 100MB, and another which is the same size as your Windows partition. You could mount these files to look at the backup:

sudo mkdir /media/temp
sudo mount -o loop,ro /media/f1/Partition1 /media/temp
ls /media/temp
sudo umount /media/temp

When ready, use dd to copy its contents to you new partition:

MAKE SURE YOU KNOW WHAT YOU ARE DOING, 
DD DOES NOT CARE ABOUT YOUR IGNORANCE!!
sudo dd if=/media/f1/Partition1 of=/dev/sdXX bs=64M

if is the input file, of is the output file. XX is the partition, one character and one number. sda1 is sda’s first partition, sdc3 is sdc’s third partition.

Umount the partition with the backups, reboot and cross your fingers.