How Microsoft's New CrowdStrike BSOD Recovery Tool Works
ThioJoe
5 min, 36 sec
The video provides an in-depth analysis of Microsoft's recovery tool released in response to the BSOD Day update issues.
Summary
- The presenter initially planned to make a video about the BSOD Day update but experienced a recording error.
- Microsoft released a PowerShell script as a recovery tool, which the presenter examines in detail.
- The script includes options for handling BitLocker-encrypted systems and essentially deletes a corrupted file to resolve the issue.
- Two bootable ISO options are analyzed, and their differences, particularly in handling BitLocker, are explained.
- The video concludes without a definitive explanation for the underlying cause of the BSOD issue but suggests more testing was needed.
Chapter 1
The presenter shares his initial intent to discuss the BSOD Day update and the subsequent delay due to a corrupted video file.
- The presenter had planned to make a video on Saturday about the BSOD Day update.
- A recording error resulted in a corrupted video file, delaying the production.
- The presenter decided to wait a few days to gather more information before discussing the topic.
Chapter 2
The video provides an overview of Microsoft's recovery tool and its basic functionality.
- Microsoft released a PowerShell script as a recovery tool for the BSOD Day update issue.
- The tool deletes the corrupted file causing the BSOD and requires the Windows Assessment and Deployment Kit for boot media creation.
Chapter 3
Two recovery options within the tool are examined, detailing their methods and prerequisites.
- The tool offers two ISO file options for recovery; both are bootable images with slight differences.
- One option requires the BitLocker recovery key to proceed, while the other requires admin login credentials.
Chapter 4
The presenter analyzes the contents of the bootable ISO files created by the recovery tool.
- Both ISO files contain a batch file named CSRemediationScript.bat that is set to auto-run.
- The main difference between the two ISOs is the presence of an extra script called repair.cmd in the second one.
Chapter 5
The presenter delves into the specifics of the batch scripts included in the recovery tool.
- The safe mode version of the script simply reboots the computer in safe mode.
- The WinPE version tests for BitLocker, prompts for the recovery key, and then deletes the corrupted file.
Chapter 6
The process of handling the corrupted file causing the BSOD is explained.
- The corrupted file is referred to with a pattern like C0000291.sys, making it easier to identify and delete.
- Both options of the tool aim to delete the corrupted file either through safe mode or by manually dealing with BitLocker encryption.
Chapter 7
Attempts to test the recovery tool in virtual machines are detailed.
- The presenter attempted to run both ISOs in virtual machines but was unsuccessful due to the lack of an actual Windows installation.
- The actions of the batch script were still discernible, indicating the simplicity of the tool.
Chapter 8
The video highlights the challenges posed by BitLocker during the recovery process.
- BitLocker's automatic decryption with normal login credentials complicates the recovery process when Windows cannot boot.
- The manual backup key is necessary for decryption in such cases, which the tool accommodates with its two different methods.
Chapter 9
Chapter 10
The video concludes with a reflection on the need for extensive testing and offers additional resources.
- The presenter concludes that the BSOD issue was widespread and should have been more thoroughly tested.
- A link to another video on WinPE and bootable items is provided for viewers interested in further information.
More ThioJoe summaries
How to Avoid 99% of Malicious EXE Files
ThioJoe
The video provides guidance on how to minimize the risk of malware when downloading files, focusing on the importance of checking digital signatures and other security tips.