Hidden Windows 8.1 boot loop

[ultradj83]

Dears,
i splitted my harddrive and installed Windows 8.1 in the 1st partition.

Then I installed Veracrypt to make it the hidden system.

After copying, I have Windows 8.1 boot looping.
Veracrypt prompts for the hidden system password, Windows 8.1 starts loading then BSOD or recovery environment and reset.

What can I do?

Thanks!

[ultradj83]

Any suggestions before I destroy again the system?

[Mounir IDRASSI]

Hi,

Are you able to read any information in the BSOD message of the hidden Windows?
Is the decoy Windows working normally after your enter the decoy password?
Did you install any special software/driver that would make low level access to the disk?

One possibility would be to try to start the hidden Windows 8 in safe mode by using F8 or Shift+F8 just after the password is verified and during the beginning of Windows loading. Can you try it?

The hidden Windows is a copy of the decoy Windows and they should work in an identical way since Windows is not aware that it is running under hidden partition. The only risk could come if you are using some special hardware device driver or software that is probing low level information of the disk and it may crash since the hidden Windows is not running on the real system partition.

Also, inside the hidden Windows, write operations are not allowed to external storage and other unencrypted partitions. So, if there is some driver running in Windows that expects to write information to a media outside the encrypted partition, then it would receive access errors and if the driver is badly written, it will crash.

[ultradj83]

Dear,
no, I'm not using any special software and I'm not using Intel's rapid storage driver.
Just to be clear, this machine has being working for years with Win7 decoy+hidden and Truecrypt.
Once copy to hidden system is starder it goes 100%, then I'm prompted to digit the hidden system password and it goes bluescreen, I'll try to read the details in case.

Thanks!

[Enigma2Illusion]

Can you take a clear picture of the screen when BSOD occurs and attach it to your next post? It would save you time and will help Mounir to see all of the details.

[ultradj83]

Dear, very newbe question, should I encrypt system partition before to start hidden system creation procedure?

I think no, but just to be sure...

Tks!

[Mounir IDRASSI]

No, the hidden system creation is a separate process that doesn't require encrypting the system first. The documentation explains very well the hidden OS creation process: https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System#CreationProcess

By the way, were you able to get information from the BSOD message?

[Anonymous]

Dear,
unfortunately not.

Actually I added an other hard drive (with just data), it has nothing related to the hard drive I'm working on with Vera.
When I start the hidden system creation procedure Vera aborts reporting there's no partition directly behind system partition, but this is not true because partitions are the same as before.
Disk is MBR with 350MB System Reserved, 341GB NTFS System, 357GB RAW.
Formatting the last doesn't solve the problem.

What's happening?

Thanks again!

[Mounir IDRASSI]

Well...this is more and more mysterious.

Can you post a screenshot of the disk layout using Windows Disk Management (under Computer Management)?
Here is an example taken from a running decoy OS:

[ultradj83]

Yesure, attached.

[Enigma2Illusion]

Is the reason for the error is saying the second partition does not exist being due to the size of the second partition is too small?

Using FAT format:
341.46 * .05 + 341.46 = 358.533 GB

Using NTFS format:
341.46 * 2.1 = 717.066 GB

https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System

Initially, the wizard verifies that there is a suitable partition for a hidden operating system on the system drive. Note that before you can create a hidden operating system, you need to create a partition for it on the system drive. It must be the first partition behind the system partition and it must be at least 5% larger than the system partition (the system partition is the one where the currently running operating system is installed). However, if the outer volume (not to be confused with the system partition) is formatted as NTFS, the partition for the hidden operating system must be at least 110% (2.1 times) larger than the system partition (the reason is that the NTFS file system always stores internal data exactly in the middle of the volume and, therefore, the hidden volume, which is to contain a clone of the system partition, can reside only in the second half of the partition).

[ultradj83]

It reports there's no suitable partition.
The size is the same worked last time until BSOD.

Tks.

[ultradj83]

Any ideas?

[Mounir IDRASSI]

Sorry for not anwering earlier.
Enigma2Illusion answer is correct: the partition behind the C: is too small since it should be at least 358.533 GB whereas it is only 356.84 GB. Thus, it is impossible to create a hidden OS inside it.

Concerning the error that there is no partition behind the system partition, the only possibility is that there is some kind of issue with the partition offset.

Can you please give a drive letter to the RAW partition (for example R:), and the use the attached program to display information about it and about C:?

You can run:

• GetDriveExtendedInfo.exe C:
• GetDriveExtendedInfo.exe R:

and then post the output of the two commands in order to understand the layout of your disk and get a clear picture of what's going on.

[Enigma2Illusion]

@Mounir,

Does VeraCrypt provide a different error if the partition directly behind the system partition is too small to give the user a better understanding for the reason of the failure?

[Mounir IDRASSI]

@Enigma2Illusion:

Yes, there is a different error is the partition is too small.
Here is a excerpt of the part of the code of the function BootEncryption::GetPartitionForHiddenOS that do these checks:

if (!candidateForHiddenOSFound)
{
    throw ErrorException (wstring (GetString ("NO_PARTITION_FOLLOWS_BOOT_PARTITION")) + GetRemarksOnHiddenOS());
}

if (config.SystemPartition.Info.PartitionLength.QuadPart > TC_MAX_FAT_SECTOR_COUNT * TC_SECTOR_SIZE_BIOS)
{
    if ((double) candidatePartition.Info.PartitionLength.QuadPart / config.SystemPartition.Info.PartitionLength.QuadPart < MIN_HIDDENOS_DECOY_PARTITION_SIZE_RATIO_NTFS)
    {
        throw ErrorException (wstring (GetString ("PARTITION_TOO_SMALL_FOR_HIDDEN_OS_NTFS")) + GetRemarksOnHiddenOS());
    }
}
else if ((double) candidatePartition.Info.PartitionLength.QuadPart / config.SystemPartition.Info.PartitionLength.QuadPart < MIN_HIDDENOS_DECOY_PARTITION_SIZE_RATIO_FAT)
{
    throw ErrorException (wstring (GetString ("PARTITION_TOO_SMALL_FOR_HIDDEN_OS")) + GetRemarksOnHiddenOS());
}

As you can see, there are 3 different error messages:
- "NO_PARTITION_FOLLOWS_BOOT_PARTITION"
- "PARTITION_TOO_SMALL_FOR_HIDDEN_OS_NTFS"
- "PARTITION_TOO_SMALL_FOR_HIDDEN_OS"

Anyway, I'm curious to see the output of the commands I asked ultradj83 to run.

[ultradj83]

Dears, the partition sizes were the same as before, so I don't know why the 1st time it worked.

Anyway, I fixed this, now 2nd partition is 10% larger than 1st.
I also changed the HDD.

I installed Win 8.1 then I started to create the hidden system.

It worked, now I type the hidden password, Windows begin to load but goes BSOD (attachment), it reports INACCESSIBLE_BOOT_DEVICE.

Do you still want me to do run those commands?
I need to reinstall everything to to that, or install the decoy system but this will overwrite veracrypt's bootloader so I'll have to reinstall it.

Thanks a lot.

[ultradj83]

I've just installed a decoy system and restored vera's bootloaded with the rescue disk, nothing to do, both systems cannot start.
I'll restore and run commands you suggested.

[ultradj83]

Dear, here's the output.

Thanks.

[ultradj83]

Any ideas about this?

Tks.

[Avi Ler]

Late but to whom ever gets to see this error - I fixed it by changing my IDE on Bios to AHCI!