Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Windows 7 partition suddenly won't boot - how to recover encrypted files?

Hello,


For the past 2 years I have been using Windows 7 Home Ultimate on a partition on my early 2014 MacBook Air.


As of last week, the Windows partition will no longer boot. I didn't make any changes to either the Windows or Mac side (e.g. attempting to re-size a partition). In fact I haven't even logged into the Mac side for more than a year.


When Windows loads it crashes before getting to the Windows logo screen, and then offers a choice to Start Windows Normally (which just causes it to crash again) or Launch Startup Repair. At this stage the keyboard works, so it's possible to select Launch Startup Repair. That takes me into Startup Repair, but then the keyboard stops working (and neither does the trackpad or connecting an external keyboard/mouse), so it's impossible to progress beyond the first screen of Startup Repair as you must select an option.


I can press F8 just before startup crashes to see some additional options (e.g. Safe Mode, Safe Mode with Networking etc) but all of those either cause another crash or get stuck on a 'please wait' screen.


I finally managed to create a Windows 7 USB to attempt booting from there (this was a very time-consuming and frustrating process as the Bootcamp Assistant appears to be highly unreliable, frequently returning error messages). I can now can select to boot from the USB from by pressing alt before startup, but when I select it as the startup disk I get taken to an Install Windows 7 screen but again all inputs (keyboard/trackpad/external devices) stop working so it's impossible to select language or progress at all.


Ideally I would like to get the Windows partition booting and accessible again, but in the meantime I urgently need to recover data from it. However - the data that I need to access is encrypted with EFS, which is native in Windows 7 Home Ultimate. Therefore, I can see the folders & files I would like to recover through Finder / Windows HD on the Mac side, but because of the encryption I don't have read access to them. From Finder, I can successfully open non-encrytped files from the Windows side (e.g. the sample pictures in My Pictures folder).


I could unlock the encrypted files on another Windows machine as I have the EFS recovery key saved on a USB, but I can't figure out how I could get them off the non-booting partition on my Macbook, short of having the hard drive physically removed and implanted into another machine?


Thanks in advance.

MacBook Air, OS X El Capitan (10.11.5), null

Posted on Jul 11, 2016 8:41 AM

Reply
10 replies

Jul 11, 2016 4:29 PM in response to Loner T

diskutil list (without the recovery USB connected)

/dev/disk0 (internal, physical):

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *251.0 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 121.5 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data Windows HD 125.0 GB disk0s4

diskutil cs list

No CoreStorage logical volume groups found

sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 490234751

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 237386016 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

237795656 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

239065192 7030680

246095872 244137984 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

490233856 863

490234719 32 Sec GPT table

490234751 1 Sec GPT header

sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 237386016] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 237795656 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 246095872 - 244137984] HPFS/QNX/AUX

Regarding the USB installer - I seem to have taken a step backwards, as my machine will no longer recognize it in the startup disk selection screen, although it did recognise it this morning. It was created using the Bootcamp Assistant and a torrented Windows .iso (the Bootcamp Assistant rejected my official download from the Microsoft site using my product key, and also rejected when i tried with files copied directly from the installation DVD on another PC, then transferred to OSX and converted to .iso in Disk Utility).

Jul 11, 2016 8:29 PM in response to ph0991

The gap between GPT3 and GPT4 is not a good sign. Can you see Windows files from OS X finder in the bootcamp partition?


Is your USB a USB2 flash drive? W7 installer by default does not have USB3 support. The Mac will support both types of hardware. USB HDD should not be used to repair Windows 7.


Using the BCA-created USB, on a 2013 rMBP, http://imgur.com/a/1DaOE#0 , is the Repair process screen sequence.

Jul 12, 2016 8:13 AM in response to Loner T

I can see all Windows files from finder in OS X, and I can open the ones that aren't encrypted with EFS within Windows.


USB is a Sandisk Cruzer 16GB. I have got as far as the third screen shown in the sequence of your link above, but at that point the keyboard and trackpad stop working, and it doesn't recognise an external keyboard/mouse, so it's impossible to select a language and click 'next'

Jul 12, 2016 12:19 PM in response to Loner T

It's USB2, created with BC Assistant. This is what I see on the USB:


User uploaded file


It is not being recognised any more as a boot option when pressing alt before startup, but one time it did work and as mentioned I got to the Windows 7 installation select language screen but couldn't progress further as no inputs (keyboard/trackpad/mouse) would work.


Product version in Bootcamp.xml is 5.1.5640

Jul 12, 2016 1:03 PM in response to Loner T

Completed both of those procedures, but still doesn't recognise the USB as a boot option.


Is it essential to have a working bootable USB, or is there another approach to try?


If it is essential, I will try creating another USB with a new stick, fresh .iso download and fresh Bootcamp support software download.

Jul 13, 2016 7:01 AM in response to Loner T

I attempted to re-make the USB with an official Windows 7.iso download from the Microsoft site (obtained by entering my W7 product key), but using that .iso file, Bootcamp Assistant returns the error message "Boot Camp only supports Windows 7 or later installation..." This .iso was downloaded on a cable connection not by wifi and I have no reason to believe it's corrupted.


I therefore attempted to re-make the ISB with a torrented Windows 7 .iso instead, and it worked. I then manually copied acrossonto the USB $WinPEDriver$, AutoUnattend.xml and BootCamp, all downloaded from the Apple Support website (v 5.1.5640), again on a cable connection. The USB now looks like this:

User uploaded file

However, I still cannot boot from this USB. I've tried it in both slots, and it is not recognised as a boot option when pressing option/alt before startup.

Windows 7 partition suddenly won't boot - how to recover encrypted files?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.