MBR error after trying to restore acronis system image

I had Windows 7 installed on C drive and i created disk image of C drive with Acronis before encrypting the system drive with TrueCrypt. Yesterday, i decided to recover the system drive from the acronis image but it didn't work.
When i started Acronis and selected the image it asked me to restart the computer, but after restarting the computer on boot screen i got this message: mbr error 3 press any key to boot from floppy.
If i press a key nothing happens, just the same message appear again. And after this i was unable to load Windows at all, just getting the same message after restarting, and i had to reinstall it from scratch.

Any idea what could be the reason for this mbr error message?

Any idea what could be the reason for this mbr error message?

No.

"Acronis" may mean tens of programs, each in tens of version, each that can be used in tens different ways.

The exact program, the exact version of it and the exact way you created the image, and the exact way you attempted to restore it are needed (as well as some info on the hardware and media involved) as base info to begin guessing what may have happened.

 

Wonko

Program: Acronis True Image 2014

My hard drive is separated to three partitions: C, E and D. The image file was on E. All of the partitions are encrypted with TrueCrypt but as i said the backup image of C was created before encypting it.

Recovery procedure: When you started Acronis True Image and selected the image it said that the program will restart the computer in order to restore the image. Right after the restart i get the mbr error message. Usually when i start the computer i get a message on boot to enter the TrueCrypt password for C drive, now i get the mbr error message before getting to the screen where i have to enter the TrueCrypt password.

I am gessing that the problem might be that the C drive is encrypted though i am not sure. When you select to restore the backup image in Acronis settings there is a setting to recover mbr but it was not checked.

My PC specifications:

OS Version: Microsoft Windows 7 Ultimate, Service Pack 1, 32 bit
Processor: Intel(R) Pentium(R) Dual CPU T2330 @ 1.60GHz, x64 Family 6 Model 15 Stepping 13
Processor Count: 2
RAM: 2038 Mb
Graphics Card: Mobile Intel(R) 965 Express Chipset Family, 384 Mb
Motherboard: Intel Corporation, SANTA ROSA CRB
BIOS Version 1.80
Hard disk: Hitachi HTS542516K9SA00 ATA Device 

Wait a minute, how you are running the Acronis Image program? (I mean from a PE, from a bootable CD, from the actual Windows install on C:\?)

 

It is likely that you need to remove encryption from the E: volume hosting the image, otherwise how can Acronis access it?

 

Wonko

Acronis is well known to have issues backing up/restoring TC volumes, partly because TC doesn't do truly transparent encryption on anything but the system volume. It's possible to restore but ,I think, you will need to restore from a backup that is a byte for byte clone of the crypted volume, and you probably also need to be careful to restore TC into the MBR. If the restored volume isn't crypted after the restore (which is oftentimes the case), you'll probably need to restore the default Windows loader into the MBR, as well as the boot files.

 

TrueCrypt is officially dead BTW, it's authors dropped off not too long ago and said they would no longer develop TC. There is a better alternative called VeraCrypt that is in active development, it's based on TC's code and looks nearly identical, except with new bug/security fixes. And it has backwards compatibility with TC volumes, so they can be mounted easily. UEFI not supported yet, but supposedly coming soon.

 

Another alternative is DiskCryptor, also excellent. Performance is fast and nearly native, volumes are crypted transparently and it will utilize your CPU's encryption acceleration (if supported by CPU). But it's developed by just one anonymous guy, not updated nearly as often as VC either. Which is part of the reason I no longer use it.

 

If you need UEFI/GPT-compatible encryption on the system volume, BestCrypt Volume Encryption is your only choice for now. But it's paid. It's dev company, Jetico, is very reputable, based in Europe, and been around for a long time, they say they will never intentionally backdoor their products for any govt agency, and I believe them. It's what I use.

 

Both TC and VC can also crypt the system volume as well as non system volumes, and BC as well. I use BC for my Windows and other internal NTFS volumes, and VC for all my external drives.

 

Sorry if this post sounded more like an ad for other software, I just figured maybe you might consider them as viable alternatives.

Acronis is well known to have issues backing up/restoring TC volumes, partly because TC doesn't do truly transparent encryption on anything but the system volume. It's possible to restore but ,I think, you will need to restore from a backup that is a byte for byte clone of the crypted volume, and you probably also need to be careful to restore TC into the MBR. If the restored volume isn't crypted after the restore (which is oftentimes the case), you'll probably need to restore the default Windows loader into the MBR, as well as the boot files.

 

TrueCrypt is officially dead BTW, it's authors dropped off not too long ago and said they would no longer develop TC. There is a better alternative called VeraCrypt that is in active development, it's based on TC's code and looks nearly identical, except with new bug/security fixes. And it has backwards compatibility with TC volumes, so they can be mounted easily. UEFI not supported yet, but supposedly coming soon.

 

Another alternative is DiskCryptor, also excellent. Performance is fast and nearly native, volumes are crypted transparently and it will utilize your CPU's encryption acceleration (if supported by CPU). But it's developed by just one anonymous guy, not updated nearly as often as VC either. Which is part of the reason I no longer use it.

 

If you need UEFI/GPT-compatible encryption on the system volume, BestCrypt Volume Encryption is your only choice for now. But it's paid. It's dev company, Jetico, is very reputable, based in Europe, and been around for a long time, they say they will never intentionally backdoor their products for any govt agency, and I believe them. It's what I use.

 

Both TC and VC can also crypt the system volume as well as non system volumes, and BC as well. I use BC for my Windows and other internal NTFS volumes, and VC for all my external drives.

 

Sorry if this post sounded more like an ad for other software, I just figured maybe you might consider them as viable alternatives.

 

Edit: Damn, another double post. I'll be more careful next time before becoming impatient and hammering down on the Submit button because my post didn't immediately appear. I post many messages from my phone, and that's annoying enough to do as it is.

 If the restored volume isn't crypted after the restore (which is oftentimes the case), you'll probably need to restore the default Windows loader into the MBR, as well as the boot files.

Interesting to know that a Windows loader goes into the MBR.

 

Wonko

@ Wonko: Oh, screw off already, you high and mighty weasel. I truly do believe that many posts you make which *appear* to be corrections/clarifiications, are in reality just ways for you to try and assert your self-worth, knowledge, and "holier than thou" attitude to yourself and others, which has the end result of making yourself look smarter, smug, and more righteous, while putting others down. You may do this consciously or subconsciously, whether you realize it or not, perhaps in an effort to sooth your ego and convictions of your knowledge and superiority over others. Noone will ever be able to convince you that you're neither a lord or a deity, much less a Finder, you can believe what you want and I'll never care, but dont go trying to put others down and shove your opinions on the rest of the world by trying to make yourself look better at others' expense. If this is your way if showing off your personality on the Net, then your're doing a really bad job. We all know what I meant, which is that Windows needs to write MBR code into the MBR (certainly not files, not enough room in MBR for them). The boot *files* themselves, would, of course, need to be located in either System Reserved or C itself (or some *other* primary patition, and (usually) marked as active/bootable, so that it can be chainloaded after the MBR code is initialized and hands off the boot phase to the next step. Stop your nitpicking.

@ OP: I think that, maybe, the reason you're getting the MBR error is that you're trying to restore a non-crypted backup into a crypted volume. Normally during this process all info in target volume is destroyed, including the encryption itself, and then replaced with the files/bytes/whatever from the backup.

I don't use Acronis, but I'm assuming that it asks you which backup you want to restore, then asks for a reboot, because C drive can't be restored while Windows is running (other volumes can as long as they're not actively in use). In your case the restore never starts because of the MBR error. Perhaps it sees TC's loader and freaks out. Or there is something wrong with the MBR. I can only guess.

You also say that *the drive the backup is in restored on is crypted*. Acronis can access this while in Windows if the volume is mounted.But when it reboots it is no longer mounted, Acronis s has no way to access the backup to be restored, then bam, error. It doesn't magically know your password and has no way to crack it (if it did this would be very disturbing). TC (and VeraCrypt, by proxy) also has issues with simultaneously mounting more than one volume *at boot* when the same password is used for all. It can do this, but the other non system volumes become accessible too late in the boot process. I had this problem with a dedicated pagefile volume that was supposed to also be mounted on boot at same time as C drive, but it mounted too late, and I got message stating that page file couldn't be accessed. This may or may not be an issue with other crypto softwares, it depends what you use. DiskCryptor and BestCrypt mount all volumes immediately after you enter password, before allowing booting to proceed.

I would suggest that you learn to create some kind of bootable recovery environment (WinPE or whatever) that can be accessed outside of Windows. Depending on how you set it up, and there are many possubilities, you can mounted a crypted volume *within* the recovery environment, then have Acronis do its' restore right then and there. Windows is no longer booted or being used and your crypted volume (where the backup is stored) is now mounted and accessible. Mount all volumes that need to be access during this time and do your restores from the RE. You may also be able to install plugins and other softwares/tools into your RE that you then use for repairs/whatever. The possibilities are endless, it depends what kind of RE you choose to create. I don't have much experience with this but I've read up on it enough. Reboot.pro will prove valuable in the future for learning this kind of stuff.

Another caveat of this is that Windows may or may not be crypted after the restore (if your backup isnt crypted then Windows shouldn't be either). It all depends on whether you want to restore a byte for byte clone (Windows with be encrypted if this is the case but you may have to fix the MBR). If you only want to restore the backup data to the C drive but not the free space (this can take far less time) then you will need to make sure C is mounted and accessible first. Some softwares may restore byte for byte regardless of this, others can restore only the used sectors. But the common denominator here is that C drive must be mounted if restoring only the used space is your intention. This is because a crypted volume is essentially just a bunch of randomized , garbled data, until the volume is mounted. If not mounted there is no effective way to distinguish between the used space and free space. This is by design and part of the way encryption works, which helps make it more secure.

If your intention is to keep Windows crypted and not have to re-encrypt after restore, then you may want to at least take a look at other backup/restore softwares. Drive Snapshot is good for this, very simple to use (almost too simple), and portable. DriveImageXML also works well. And TeraByte Image for Windows. Again, you'll have to shop around. There are also other free alternatives I haven't mentioned (not aware of/tried them).

 

I Hope this gave you some more ideas.................

MBR code is never (let alone "default") a "Windows loader", it is simply MBR code (normally chainloading the bootsector of the partition marked active in the partition table).

 

 

Wonko

Wait a minute, how you are running the Acronis Image program? (I mean from a PE, from a bootable CD, from the actual Windows install on C:\?)

 

It is likely that you need to remove encryption from the E: volume hosting the image, otherwise how can Acronis access it?

 

Wonko

Acronis True Image is installed on C.

Probably the problem is that the image file is on encrypted volume and Acronis can't access it but i don't have enough free space to create a new partition for the image. And if i have to decrypt E drive i have to format it and loose the data on it because it is too big and i can't move the data.

I haven't tried to put the image on usb flash drive and try the recover procedure from there but i don't think it will work.

 

@AnonVendetta: TrueCrypt is not supported any more but i think it is still safe to use it. I have never heard for any volume that is encrypted with TrueCrypt to have been cracked so far.

Acronis True Image is installed on C.

Probably the problem is that the image file is on encrypted volume and Acronis can't access it but i don't have enough free space to create a new partition for the image. And if i have to decrypt E drive i have to format it and loose the data on it because it is too big and i can't move the data.

I haven't tried to put the image on usb flash drive and try the recover procedure from there but i don't think it will work.

Yes. to restore the program needs to have access to an unencrypted image (or filesystem hosting it), I don't see why it should not work with an image (unencrypted) on USB (unless of course the environment - PE or Linux Live - in which you run it has issues with accessing/mounting the USB device).

 

The generic idea of imaging a volume is that the image is not stored (normally) on the same device, i.e. accessing the image residing on "other" media/device) is the "standard" usage paradigm of *any* imaging program, but surely you cannot use the Acronis installed on C: to re-deploy "self".

 

Wonko

I already clarified my understanding of the MBR code, boot files, and chainloading of the PBR. You're right about the default thing, but to me whatever lives in the MBR is the default code that chainloads *whatever*, at least until it is overwritten by *something* else (GRUB, etc). There generally isn't room in the MBR for both Windows and GRUB *or* whatever to share the space peacefully. Which is why UEFI, with the concept of keeping the boot files separate from the OS, is better. And then no loader can dominate the EFI volume except the fallback loader. I never *said* MBR code is a Windows loader, although it may have seemed that way initially. The MBR code is just code, sometimes installed by Windows/Grub/whatever, that points to the active volume where a bootsector is located. Which is why you oftentimes see grub, grub4dos, syslinux, etc text/GUI in the form of menus/mesaages when powering on, which seems to be a loader in and of itself.

There really was no need for you to blow out of proportion what should have been the obvious and intended meaning, since most people posting here have enough experience to know these things, being members of this type of forum.

And while it's never a good idea to store your backup image on the same partition that is being backed up, or even the same drive, it can be done. Another disk drive (preferably external) is best. Peter can use the Acronis installed as a program on C to restore "self" as well as the C drive. All that is needed is to either boot into some kind of external recovery media and restore from there. Since the *whatever* to be restored (and Acronis installed on C) isn't in use then, it will work. Acronis may also be able to select the backup image, reboot into some kind of an onboard recovery scenario (without external media to boot the restore program from), perhaps stored in RAM or some other temporary place, since the partition to be restored usually isn't where the restore software is running from. Drive Snapshot does something like this. You just select image to be restored, if C drive it tells you to reboot, where a DOS-like prompt appears to restore. No external media required, unless your backup is in such a thing, in which case it needs to be connected and accessible. Are you *really* sure you know what you're talking about?

@ Peter: I know TC is still secure and has never been cracked. There is a famous case of the US FBI confiscating a South American druglord's PCs that were TrueCrypted. I do believe he was arrested but never convicted, they later had to release him because they couldnt crack/obtain his password. But once you get a look at VeraCrypt you'll see what I mean. It has the advantage of being actively developed, which means regular fixes and sometimes new features. To state again, it has TC volume compatibility as well and looks so similar to TC that you'll forget you're not using TC anymore in a matter of mins/hours. It uses even stronger algorithms too, you'll need to check their site for all the new (yet few) features. The devs aren't anonymous , unlike TC's devs, and the code is free/open source. It can crypt both system and non-system volumes on BIOS/MBR systems. A Linux/Mac version is also available. You won't have to relearn what you already know about TC to get used to VC and the backup/restore software you use with TC now should work practically the same with VC. Of course, any known TC issues/limitatations/idiosyncrasies of TC will most likely be present in VC. You get the best of both worlds, with something that is slightly more secure and always being updated, rather than sticking with something that is no longer worked on or supported. It's nice to stick with what you know and trust, but sometimes moving on may be better.

Yes. to restore the program needs to have access to an unencrypted image (or filesystem hosting it), I don't see why it should not work with an image (unencrypted) on USB (unless of course the environment - PE or Linux Live - in which you run it has issues with accessing/mounting the USB device).

 

The generic idea of imaging a volume is that the image is not stored (normally) on the same device, i.e. accessing the image residing on "other" media/device) is the "standard" usage paradigm of *any* imaging program, but surely you cannot use the Acronis installed on C: to re-deploy "self".

 

Wonko

 

 

I remember that i have tried to recover image from usb drive in the past but for some reason it didn't work.
The next time i will put the image file on usb flash drive and try to do the recovering from there.

Edited by Peter80, 14 August 2015 - 06:41 PM.

There really was no need for you to blow out of proportion what should have been the obvious and intended meaning, since most people posting here have enough experience to know these things, being members of this type of forum.
 

Sure, the clarification was only needed for the few that have not enough experience (the actual minority that *needs* exact info), those that already know exactly the way it works will at the most raise their eyebrows reading that a Windows loader needs to be restored to the MBR, just as I did.

 

Wonko