Rebuild Legacy MBR from GPT Backup Copy

[data-medics]

OK, so I've got an odd situation case here. It's a Microsoft Surface Pro 2017 which has the SSD in single chip package soldered right onto the main board (so removing and directly reading it is a problem). I was, however, able to get the thing booted to Linux and was actually able to ddrescue the SSD onto another HDD (YAY!!! ).

The only sectors that couldn't read were the first 8 sectors containing the MBR and GPT. The GPT isn't a problem since there's a backup copy at the end of the drive and I was able to copy/paste that back to where it belongs near the beginning. However, there's no backup copy of the legacy MBR which Windows still looks for and will totally ignore the GPT if it's missing.

Normally this wouldn't be a problem, but...this thing is BitLocker encrypted, the customer does not have a copy of the recovery key anywhere, and this tablet has a TPM chip locking the encryption to it.

So, my plan of attack (the only thing I can think to try at this point) is to rebuild the MBR and get the tablet to boot from an external HDD with the full image. I'm really hoping that'll work.

I've studied GPT enough to pretty much write one from scratch, but I'm not quite sure how to regenerate a lost MBR that's part of a GPT/BitLocker/bootable install.

Does anyone here have any experience rebuilding an MBR from the GPT so as to get a drive bootable?

[michael chiklis]

I don't know if this can help you, i never tried those:
http://www.hddoracle.com/viewtopic.php?f=94&t=542
https://www.eightforums.com/threads/bit ... d-8.21714/
https://docs.microsoft.com/en-us/previo ... 28(v=ws.10)

[data-medics]

Actually, I got Windows to rebuild it on its own. I just had to set the max LBA of the destination drive to match (I accidentally had one trailing sector before) and when connected that time Windows regenerated it all by itself.

Nice!