Windows 8: Difference between revisions

From miki
Jump to navigation Jump to search
Line 388: Line 388:
=== How can we view a detailed disk layout ===
=== How can we view a detailed disk layout ===
Q? They show a XML Output of DiskConfiguration, where we see the typeid of partitions; how do we get that output?
Q? They show a XML Output of DiskConfiguration, where we see the typeid of partitions; how do we get that output?

=== How to backup a Windows system ===
* [http://superuser.com/questions/631395/windows-7-on-gpt-partitioned-ssd-backup-using-dd Windows 7 on GPT partitioned SSD backup using dd - superuser.com]

Do a backup of:
* GUID partition table (GPT)
:This can be copied using <code>dd</code>
* EFI system partition (ESP)
:Use any file-level copy software (like <code>tar</code>, or <code>cp</code>). <code>partimage</code> is also a valid option.
* Windows system disk (<tt>C:</tt> drive)
* Use <code>ntfsclone</code>

* There is no need to copy the ''Microsoft Reserved Partition''. It is merely a placeholder that Windows uses for some disk operations or for dynamic disks.

* On restore, ideally make sure that GUID of all partitions are the same as on the origin system. You can view the GUID under linux with
<source lang=bash>
sudo sgdisk -i 1 /dev/sda
# Partition GUID code: C12A7328-F81F-11D2-BA4B-00A0C93EC93B (EFI System)
# Partition unique GUID: 2C47C282-EE6E-45DE-A5AD-E8658CA67DE6
# First sector: 2048 (at 1024.0 KiB)
# Last sector: 390625 (at 190.7 MiB)
# Partition size: 388578 sectors (189.7 MiB)
# Attribute flags: 1000000000000000
# Partition name: 'EFI System'
</source>

:GUID is set with
<source lang=bash>
sudo sgdisk -u 1:2C47C282-EE6E-45DE-A5AD-E8658CA67DE6 /dev/sda
</source>

Revision as of 11:56, 23 July 2014

References

Lots of valuable information on EFI.
From author of rEFInd, an alternative boot loader. Seems less likely to fail than grub, etc.
 (apparently involves copying image.wim to c:\refresh or something)


Never delete the RECOVERY / RESTORE partition. These seems needed to restore a windows from factory image.

Windows Tips

  • Left / Right click each corner
  • Swipe left to go to last app
  • SWipe right for start menu
  • Win + W: search
  • Win + X: admin menu
Clean up - free lots of space

Terminology

Online vs offline system
Online refers to the currently running windows system, whereas Offline refers to another

system, different from the current running one. Since repairing a broken windows system is usually done by booting from an external recovery disk (usb or dvd, or another partition on hdd), the system to repair is then always offline.

ESP
EFI System Partition. This partition replaces the MBR boot record on EFI-systems.
EFI
Extended Firmware Interface.

Convention

In this page, we assume the following convention for volume number and name (label) and assigned letter.

Assumptions:

  1. Volume ### Ltr Label Fs Type Size Status Info
  2. ---------- --- ----------- ----- ---------- ------- --------- --------
  3. Volume 0 F DVD-ROM 0 B No Media
  4. Volume 1 C OS NTFS Partition 188 GB Healthy
  5. Volume 2 D DATA NTFS Partition 180 GB Healthy
  6. Volume 3 S SYSTEM FAT32 Partition 300 MB Healthy Hidden
  7. Volume 4 T Recovery NTFS Partition 900 MB Healthy Hidden
    • Volume 5 R Restore NTFS Partition 20 GB Healthy Hidden
  8. Volume 6 E RECOVERY FAT32 Removable 960 MB Healthy
Volume Letter Label Fs Size Description
1 C: OS NTFS >100GB Windows partition
2 D: DATA NTFS >100GB Partition for documents...
3 S: SYSTEM FAT32 300MB the EFI system partition (ESP)
4 T: Recovery NTFS 900MB A bootable partition used for recovery
5 R: Restore NTFS 20GB The OEM partition contains the factory image.

Besides the volumes above, there can be some extra volumes (visible in diskpart) and some virtual disks (visible in mountvol):

  • Removable volume corresponding to the recovery drive usb stick
  • virtual drive (usually letter X:) corresponding to currently running windows system

(usually corresponding on a .WIM image on the removable volume).

Command-line tools

bcdboot

From help: 

    S:\EFI\Microsoft\Boot>bcdboot /?

    Bcdboot - Bcd boot file creation and repair tool.

    The bcdboot.exe command-line tool is used to copy critical boot files to the
    system partition and to create a new system BCD store.

    bcdboot <source> [/l <locale>] [/s <volume-letter> [/f <firmware>]] [/v]
                     [/m [{OS Loader ID}]] [/addlast]

      source     Specifies the location of the windows system root.

      /l         Specifies an optional locale parameter to use when
               initializing the BCD store. The default is US English.

      /s         Specifies an optional volume letter parameter to designate
                 the target system partition where boot environment files are
                 copied.  The default is the system partition identified by
                 the firmware.

      /v         Enables verbose mode.

      /m         If an OS loader GUID is provided, this option merges the
                 given loader object with the system template to produce a
                 bootable entry. Otherwise, only global objects are merged.

      /d         Specifies that the existing default windows boot entry
                 should be preserved.

      /f         Used with the /s command, specifies the firmware type of the
                 target system partition. Options for <firmware> are 'UEFI',
                 'BIOS', or 'ALL'.

      /addlast   Specifies that the windows boot manager firmware entry
                 should be added last. The default behavior is to add it
                 first.

    Examples: bcdboot c:\windows /l en-us
              bcdboot c:\windows /s h:
              bcdboot c:\windows /s h: /f UEFI
              bcdboot c:\windows /m {d58d10c6-df53-11dc-878f-00064f4f4e08}
              bcdboot c:\windows /d /addlast
     
    Microsoft Windows [Version 6.3.9600]

bcdedit

   S:\EFI\Microsoft\Boot>bcdedit /?

   BCDEDIT - Boot Configuration Data Store Editor

   The Bcdedit.exe command-line tool modifies the boot configuration data store.
   The boot configuration data store contains boot configuration parameters and
   controls how the operating system is booted. These parameters were previously
   in the Boot.ini file (in BIOS-based operating systems) or in the nonvolatile
   RAM entries (in Extensible Firmware Interface-based operating systems). You can
   use Bcdedit.exe to add, delete, edit, and append entries in the boot
   configuration data store.

   For detailed command and option information, type bcdedit.exe /? <command>. For
   example, to display detailed information about the /createstore command, type:

        bcdedit.exe /? /createstore

   For an alphabetical list of topics in this help file, run "bcdedit /? TOPICS".
  • This tool is handy to edit the BCD file.
  • It can also be used to reset the EFI variables in the UEFI firmware (aka. the BIOS non-volatile storage).
  • Note that they are hypervisor-related settings (for use in VirtualBox or similar?)

bootrec

It seems this tool is no longer relevant for EFI systems. It manages the MBR record.

mountvol.exe

Use mountvol to view the GUID of partitions: 

mountvol
# Possible values for VolumeName along wih current mount points are:
#     \\?\Volume{549cd1cd-a02a-11dd-9456-001d600c1bfd}\
#         G:\
# 
#     \\?\Volume{22e1b70a-ea2d-11dd-acd9-806e6f6e6963}\
#         C:\

The string \\?\ is present in all volume GUIDs and it tells Windows to turn off path parsing. These strings are the true path to the volume, whereas the one with the single letter are mere aliases. This can be checked by entering the full path in a Run Dialog (Win-R.

  • Note: it seems that some volumes assigned to letter by diskpart are not always shown as mounted by mountvol (for instance, for the Recovery and Restore partition).
# Mount the ESP partition to drive letter S: (same as assigning letter in diskpart.exe)
mountvol s: /s

dism.exe

  • Tool to create and restore image

Note: it seems that image restore is faster if target partition as been first formatted (cleaned) with diskpart.

  • Tool to mount / unmount image as virtual disk

This page] says that dism.exe is equivalent to imagex.exe and should take similar time.

CMD.EXE

# List ALL files. NEVER DO "dir" ALONE COZ' IT IS MISLEADING!
dir /a

# Change path AND drive
cd /d C:\Windows

# Delete a subdirectory
rd /s


Tips:

  • Use TAB to auto-complete. If needed, add a temporary space before the file name when constructing the

command.

  • TAB can also be used to complete command process name (like task<TAB> for taskmgr.exe)
  • Use start cmd.exe to start a new command prompt window.

Miscellaneous

Note that the recovery drive is a full fledged windows system with all necessary tool (task manager,

notepad, command prompt, etc)

  • notepad.exe
  • Use notepad.exe's open file dialog box as poor-man's explorer on recovery drive.

UEFI boot vs MBR boot

MBR old method Old tool:

  • bootrec (to edit MBR and surrounding)
  • bcdedit (to edit BCD)

New tool:

  • bcdtool (to construct EFI partition)
  • bcdedit (to edit BCD)

Factory reset

Official method - Microsoft

http://technet.microsoft.com/en-us/library/hh825041.aspx

Unofficial - ASUS

References

Using diskpart:

  • Create GPT table
  • Creating EFI partition (implicit special ID)
  • Creating Recovery + Restore partion + special ID + gpt attributes
  • Creating Microsoft Reserved Partition (mandatory 100MB, no data inside, only to allow other partition to grow)
  • + assign letter to unmounted volume

See Zyratastic for a complete log. 

   DISKPART script:  DiskPart /s F:\<your text file name>.txt
       select disk 1
       clean
       convert gpt
       rem == 1. Windows RE tools partition ===============
       create partition primary size=300
       format quick fs=ntfs label="Windows RE tools"
       assign letter="T"
       set id="de94bba4-06d1-4d40-a16a-bfd50179d6ac"
       gpt attributes=0x8000000000000001
       rem == 2. System partition =========================
       create partition efi size=100
       rem ** NOTE: For Advanced Format 4Kn drives,
       rem change this value to size = 260 ** 
       format quick fs=fat32 label="System"
       assign letter="S"
       rem == 3. Microsoft Reserved (MSR) partition =======
       create partition msr size=128
       rem == 4. Windows partition ========================
       rem == a. Create the Windows partition ==========
       create partition primary 
       rem == b. Create space for the recovery image ===
       shrink minimum=6000
       rem ** NOTE: Update this size to match the size
       rem of the recovery image **
       rem == c. Prepare the Windows partition ========= 
       format quick fs=ntfs label="Windows"
       assign letter="W"
       rem === 5. Recovery image partition ================
       create partition primary
       format quick fs=ntfs label="Recovery image"
       assign letter="R"
       set id="de94bba4-06d1-4d40-a16a-bfd50179d6ac"
       gpt attributes=0x8000000000000001
       list volume
       exit

   Batch script to restore image, etc (F:\<your batch file name>.bat)
       rem === Copy the image from the USB to the recovery image partition, where "F:\Images" is the path to your image file =======================
       md R:\Recovery
       copy F:\Images\install.wim R:\Recovery\install.wim

       rem === Apply the image to the Windows partition. MAKE SURE TO CHANGE THE INDEX NUMBER (like Index:2) TO MATCH YOUR WINDOWS VERSION =============================
       dism /Apply-Image /ImageFile:R:\Recovery\install.wim /Index:1 /ApplyDir:W:\

       rem === Copy the Windows RE Tools to the Windows RE Tools partition ==========
       md T:\Recovery\WindowsRE
       copy W:\windows\system32\recovery\winre.wim T:\Recovery\WindowsRE\winre.wim

       rem === Copy boot files from the Windows partition to the System partition. THE /s S: PARAMETER IS VERY IMPORTANT!! ===
       bcdboot W:\Windows /s S: 

       rem === In the System partition, set the location of the Windows partition. CHANGE INDEX HERE AS WELL ===
       W:\Windows\System32\reagentc /setosimage /path R:\Recovery /target W:\Windows /index 1

       rem === In the System partition, set the location of the WinRE tools =========
       W:\Windows\System32\reagentc /setreimage /path T:\Recovery\WindowsRE /target W:\Windows

Troubleshooting

Boot error code

0xc000000f
Probably windows cannot find the .WIM file to boot. Eg. boot file is named boot.vim instead of "boot.wim"

Grub does not see windows partition

  • EFI partition must have the boot flag before running sudo update-grub.

FAQ

Don't forget conventions above.

How can the EFI partition be reset / reconstructed

References
Windows

In windows, bcdtool can reconstruct the content of the EFI partition after format. To reset an EFI partition. In the following, we assume that the EFI partition already exists.

  • Format the existing EFI partition with diskpart
diskpart
# In diskpart:
sel disk 0
list vol                 # Locate volume of EFI partion, FAT32, ~300MB
sel vol 3                # Assuming volume 3
format quick fs=fat32 label="SYSTEM"
assign letter s
exit
  • Use bcdtool to reconstruct the EFI partition. This assumes that the windows partition is

mounted on C:, and that it is in a working state. 

# Minimum:
#      bcdboot C:\Windows /s S: 
bcdboot C:\Windows /s S: /l fr-FR /f ALL
  • Reset the EFI variables (see zyratastic)
   bcdedit /S:\EFI\Microsoft\Boot\BCD /clean

 - bcdboot reconstruct the EFI partition
 - Clean the EFI variables with:
   # bcdedit /storeP:\ath\to\BCD\file\on\mounted\efi\part/import /clean

If you consider only Windows, the organization of the ESP is straightforward: besides the mighty Bootx64.efi, everything is under the \EFI\Microsoft\Boot\ directory. The only file you might edit is the BCD, through bcdedit. To be able to boot, you need just \EFI\Boot\Bootx64.efi, \EFI\Microsoft\Boot\BCD, and \EFI\Microsoft\Boot\boot.stl on the ESP, assuming the former is a copy of \EFI\Microsoft\Boot\bootmgfw.efi; keeping this later is a good precaution, particularly since you are considering the installation of other boot managers which could replace the mighty Bootx64.efi (but should generally left untouched bootmgfw.efi.) During the boot process, some (hidden) BCD.log* and BOOTSTAT.DAT files will be automatically created in \EFI\Microsoft\Boot\. You might also see \EFI\Microsoft\Boot\bootmgr.efi, although nobody seems to know what it is good for... The ll-CC directories with the MUI resources help to be able to display non-English messages instead, depending of the settings in BCD; similarly, the fonts could be needed for non-Latin cases; I found out that removing all this i18n stuff for cleaning purposes, did not help on the long run, since I use to turn them back in place, to get back my own language while booting.

  • To re-enable Hyper-V, I also had to run the following:
 bcdedit /set {default} hypervisorlaunchtype Auto
 bcdedit /set {default} nx OptIn


What are .WIM images

  • These are file containing several disk volume that can be mounted as virtual volumes, much like

loopback device on linux.

  • use Dism.exe to mount them.
md C:\offline
DISM.exe /Mount-Image /ImageFile:C:\test\images\myimage.vhd /Index:1 /MountDir:C:\offline /ReadOnly
C:\>dism /unmount-image /mountdir:C:\offline /discard
# 
# Deployment Image Servicing and Management tool
# Version: 6.3.9600.16384
# 
# Unmounting image
# [==========================100.0%==========================]
# The operation completed successfully.
  • Don't forget to unmount the image when done (using Dism.exe), either committing the changes or discarding them.
  • Note that the parent volume can be unmounted even if it still contains some virtual volume mount point.

These virtual volume are back available by mounting again the parent.

How mount / boot the OEM restore partition

  • Take a recovery drive
  • Replace the boot.wim with the one found in restore partition
  • This boots, but ASUS application creates an error, probably because it cannot find the restore image Image.wim.
R:\RecoveryBoot>copy r:\RecoveryBoot\BOOT.WIM E:\sources\ASUSBOOT.WIM

How can we view a detailed disk layout

Q? They show a XML Output of DiskConfiguration, where we see the typeid of partitions; how do we get that output?

How to backup a Windows system

Do a backup of:

  • GUID partition table (GPT)
This can be copied using dd
  • EFI system partition (ESP)
Use any file-level copy software (like tar, or cp). partimage is also a valid option.
  • Windows system disk (C: drive)
  • Use ntfsclone
  • There is no need to copy the Microsoft Reserved Partition. It is merely a placeholder that Windows uses for some disk operations or for dynamic disks.
  • On restore, ideally make sure that GUID of all partitions are the same as on the origin system. You can view the GUID under linux with
sudo sgdisk -i 1 /dev/sda
# Partition GUID code: C12A7328-F81F-11D2-BA4B-00A0C93EC93B (EFI System)
# Partition unique GUID: 2C47C282-EE6E-45DE-A5AD-E8658CA67DE6
# First sector: 2048 (at 1024.0 KiB)
# Last sector: 390625 (at 190.7 MiB)
# Partition size: 388578 sectors (189.7 MiB)
# Attribute flags: 1000000000000000
# Partition name: 'EFI System'
GUID is set with
sudo sgdisk -u 1:2C47C282-EE6E-45DE-A5AD-E8658CA67DE6 /dev/sda
Retrieved from "https://miki.immie.org/mediawiki/index.php?title=Windows_8&oldid=6318"