What file system does Microsoft Reserved Partition contain?

Question

TL;DR

What file system does this partition contain? (NTFS, FAT32 or something else?)

---

Story

Yesterday, I have used ddrescue to recover a slow and generally end-of-life hard disk drive.

The drive (WD 1TB) contains Windows 10, I don't know if upgraded from previous version or not.

There was but 1 single cluster, 4096 bytes in size, that contained URE (Unrecoverable read error), but somewhere in the beginning of the drive, which made one partition unreadable, I will mark the one below with <-- THIS:

The layout is readable from GNU/Linux Debian 9 as follows:

Device          Start        End    Sectors   Size Type
/dev/sdb1        2048    2050047    2048000  1000M Windows recovery environment
/dev/sdb2     2050048    2582527     532480   260M EFI System
/dev/sdb3     2582528    3606527    1024000   500M Lenovo boot partition
/dev/sdb4     3606528    3868671     262144   128M Microsoft reserved    <-- THIS
/dev/sdb5     3868672 1902323711 1898455040 905.3G Microsoft basic data
/dev/sdb6  1902323712 1953523711   51200000  24.4G Windows recovery environment

As you can see, it is Microsoft Reserved Partition (wiki).

I intend to, at least, re-create the partition and the file system in it.

But since I don't have any other Windows 10 computer at my disposal, I have a very simple question:

What file system does this partition contain? (NTFS, FAT32 or something else?)

Solution 1

Final resolution of my problem

I copied, literally, the whole MSR partition from a healthy drive below, the partition was of the same size in sectors, also note a GPT scheme, it might very well be of importance.

Here's some healthy Windows 10 GPT installation, I managed to find:

Device         Start       End   Sectors   Size Type
/dev/sda1       2048   1026047   1024000   500M EFI System
/dev/sda2    1026048   1288191    262144   128M Microsoft reserved
/dev/sda3    1288192 459608774 458320583 218,6G Microsoft basic data
/dev/sda4  459610112 461398015   1787904   873M Windows recovery environment
/dev/sda5  461398016 485992447  24594432  11,7G Windows recovery environment
/dev/sda6  485992448 488396799   2404352   1,2G Windows recovery environment

---

Procedure in practice

I first backed up the bad partition for the case my efforts would cause more harm than good.

And then directly copied using pv (man page), you can always use dd (man page) if you are used to it.

It was as simple as plugging both of the drives to my Debian server and using something like (intentionally upper-cased the letters to avoid anyone using that command and destroying something):

As root:

pv < /dev/sdA2 > /dev/sdB4

With sudo:

sudo sh -c 'pv < /dev/sdA2 > /dev/sdB4'

---

Investigation

I could not mount the partition anyhow, and let me assure you I tried hard. At least I did try cat'ing it, some of it surprisingly makes sense, so I presume it is there for a reason:

cat /dev/sda2

RRaArrAa��U�U��X�MSDOS5.0 �?��@��)    ���NO NAME    FAT32   3ɎѼ�{���ٽ|�V@�N�V@�A��U�r��U�u
��t�F�-�V@�s�����f��@f�������Af��f��f�F��~u9�~*w3f�Ff��
                                                                ����,����}��|�����t<�t   �������}���}��ߘ��f`�~� fjfPSfh�B�V@���fXfXfXfX�3f;F�r��*f3�f�Nf����f��f���v�֊V@����
�fa�t���f@Iu��BOOTMGR    
Disk error�
Press any key to restart
��U�RRaArrAa����U�U�
An operating system wasn't found. Try disconnecting any drives that don't
contain an operating system.�f�Ff�N$f��fFf�Vf�f�F�f�F�����f�F,f���G�f=������f��fF�������(�8-t�
                       V�m}��^t���;�r�Nu�fX�er������ ���u  �}��f����f����f��fF�������fX�����rЊV@� f���&f�f%���f=���ÿ~f�N
                                                         f3�f��f;F�t:f�F�fFf�Nf�f�^(��t:^�L�Rf��f�F$f��f�ZR�߹�>�Z���U���������������������OS        �V1Lr

---

Conclusion

Without this partition, or in my case a damaged one, Windows Update and a few other things did not work properly, so the customer returned to me later on with this machine to fix these problems. I can report to you, you can safely copy it from a healthy machine in case of damage, supposing the same size and partition scheme.

It obviously contains some data without which Windows for whatever reason would not work properly.

Solution 2

System Reserved partition is generally:

• of type NTFS

• around 100MB size

---

Some Microsoft Reserved partitions related to GPT disk are:

• of type UNFORMATTED

• often 128MB size

If someone decides to make a non-standard installation, the System Reserved can be just about any size. e.g., System Reserved will scale when people swap out the original install disk with something larger and use auto-scaling in the migration software. Some software is 'dumb' and expands all partitions relative to the disk size difference.

---

You may find more info at Microsoft Docs.

Comments

[phuclv]

if you have Debian then just run sudo file -s /dev/sdb5 or sudo fdisk /dev/sdb5 to find out

[LinuxSecurityFreak]

@phuclv file -s /dev/sda2 returns /dev/sda2: data, other ideas?