1 - How to image a Windows system using a bootable WinPE USB drive and ImageX

How to image a Microsoft® Windows® system using a bootable WinPE USB drive and ImageX

ImageX allows you to take complete backup of a Microsoft® Windows® volume and save the image to a file. You can then restore any system with it's original image in just a few minutes.

• A Microsoft® Windows® system with a minimum of 3GB free disk space.

• A USB flash memory drive or USB hard disk drive (a minimum of 1GB is recommended).

• RMPrepUSB

• The Windows 7 Automated Installation Kit (WAIK).

• A utility that can mount an ISO file (such as the freeware utility 'Virtual CloneDrive').

Procedure

1. Install WAIK and create a Windows PE folder

Using your personal Windows XP/Windows Vista®/Windows 7 PC (not the target system that you wish to image):

1. Download the Windows 7 WAIK ISO file (e.g. KB3AIK_EN.iso 1.7GB). You must agree to the Terms and Conditions.

2. Download and install your ISO mount utility. (VirtualCloneDrive in this example)

3. Double-click the WAIK.iso file. The WAIK Welcome window should launch. If not, double-click StartCD.exe on the new drive letter in Explorer.

4. Install the .Net Framework Setup from the WAIK menu.

5. Install the MSXML 6 SP1 Setup from the WAIK menu.

6. Install the Windows AIK Setup from the WAIK menu.

7. Exit from the WAIK menu.

8. Click on Start Menu, All Programs, Microsoft Windows AIK, Deployment Tools Command Prompt to open up a command prompt window.

9. Type copy ..\x86\imagex.exe c:\ and press Enter.

10. Type COPYPE x86 c:\pe86 and press Enter.

11. Type copy c:\pe86\winpe.wim c:\pe86\ISO\sources\boot.wim and press Enter.

12. Type copy c:\imagex.exe c:\pe86\ISO and press Enter.

2. Make a bootable USB drive

3. Boot the target system and take an image

The following actions are performed on the target system (the one that you want to take a backup of):

1. Connect the USB drive to the target computer's USB port.

2. Switch on the target computer and press the appropriate key to enter the BIOS Setup menu. (eg F1, F2, DEL)

3. Check whether the Legacy USB support is enabled, and configure the Boot Order so that the USB drive will boot first. Ensure that the BIOS USB-ZIP mode setting is set to Fixed Disk and not Removable Disk (if available).

4. Save and Exit the BIOS menu. The target system should now boot to the Windows WinPE environment from the USB drive.

5. To find the USB drive and hard disk drive letters - type NotePad, then click on File, Open and click on the Computer icon. You can now see how your hard disk volumes are lettered in WinPE. Assume that your USB Flash drive has the letter F: and you wish to backup your C: drive in the instructions below.

6. Exit from Notepad.

7. At the command prompt, type F:\imagex /capture c: f:\mybackup.wim "my comments here" /norpfix /check /verify and press Enter.

8. When this is completed, a backup of the C: drive is available in the mybackup.wim file.

9. If, at a later date, you wish to take another backup, you can append this to the previous backup as follows: imagex /append c: f:\mybackup.wim "second backup" /check /verify /norpfix

Note: ImageX using single-instancing, so adding subsequent similar images does not greatly increase the size of the .wim file.

You can backup other volumes from the hard disk, by following the above procedure.

4. Restoring an image

1. Boot to WinPE from the USB drive

2. Format the target drive volume first (otherwise the existing files will still remain). Eg Type format C:

3. Type imagex /apply f:\mybackup.wim 1 c: /check /verify

Note: If you want to restore the second backup that you made, replace the 1 with 2 in the above command.

If needed, you can use DISKPART to partition and format a blank hard disk first as follows.

DISKPART /s dpart.txt

where the file dpart.txt contains the lines:

LIS DISK

SEL DISK 0

CLEAN

CRE PAR PRI SIZE=100000 ALIGN=16065

FORMAT FS=NTFS LABEL="MYDRIVE" quick

ASSIGN LETTER=J

ACTIVE

CRE PAR PRI ALIGN=16065

FORMAT FS=NTFS LABEL="BACKUP" quick

ASSIGN LETTER=K

LIST VOL

SEL DISK 0

SEL PAR 1

LIST DISK

LIST PAR

DETAIL PAR

EXIT

In case of an XP image, type Bootsect /nt52 J: or you may see a 'bootmgr is missing' error when you attempt to boot the XP target system. The drive letters assigned in the diskpart script above are used to prevent conflicts with existing volume letters. When the system reboots, the active partition (J: in this example) will become drive C: and the other partition (K:) will be given the D: drive letter.

Note: The ALIGN=16065 text portion is needed only to boot a 'pre-setup stage' XP image (i.e. an image that will run Setup.exe or Setup32.exe when it boots). You can usually omit this portion of text for most Windows images.

Bootsect.exe can be found in the WAIK, under Tools\PETools\x86.

Before you reboot the system, you can also make any small adjustments to the files on the J: drive as you have direct access to these files (for instance, you could copy files or folders to drive J: or K: or add a link to the Windows Startup folder so that a program runs on first user log-in).

For instance, a simple prep.cmd script file to automatically install Windows XP image onto a new hard drive in approx. 5 minutes from a bootable WinPE USB flash memory pen drive would be as simple as:

diskpart /s dpart.txt

imagex /apply mybackup.wim 1 J:

bootsect /nt52 J:

echo Finished! - Press a key to reboot

pause>nul

wpeutil reboot

If you have problems booting to Windows 7 or Vista, you may have problems with the BCD. Boot to WinPE and use bcdedit /enum /v to view the BCD settings. To fix BCD boot issues, you can use the following procedure:

1. del C:\boot\bcd

2. bootrec /RebuildBcd

3. Now test it to see if that worked - if not repeat step 1 and then skip to step 3 onwards...

4. bcdedit.exe /createstore c:\boot\bcd.temp

5. bcdedit.exe /store c:\boot\bcd.temp /create {bootmgr} /d "Windows Boot Manager"

6. bcdedit.exe /import c:\boot\bcd.temp

7. bcdedit.exe /set {bootmgr} device partition=C:

8. bcdedit.exe /timeout 10

9. del c:\boot\bcd.temp

10. Now we have a clean, working bootloader. But we need to add a Vista/Win7 entry to it:

11. bcdedit.exe /create /d "Windows Vista" /application osloader

12. use "Windows Vista2 or "Windows 7" as appropriate

13. bcdedit.exe should return a message with a GUID for the newly-created entry, something like this:

14. The entry {c0dfc4fa-cb21-11dc-81bf-005056c00008} was successfully created.

15. You'll need to use the value that bcdedit.exe returned for you below, along with the drive letter for the drive that Windows is installed to:

16. bcdedit.exe /set /set {default} device partition=c:

17. bcdedit.exe /set {default} osdevice partition=c:

18. bcdedit.exe /set {bootmgr} device partition=c:

19. bcdedit.exe /set {c0dfc4fa-cb21-11dc-81bf-005056c00008} path \Windows\system32\winload.exe

20. bcdedit.exe /set {c0dfc4fa-cb21-11dc-81bf-005056c00008} systemroot \Windows

21. And, last of all, tell the Vista/Win7 bootloader to boot the new entry by default:

22. bcdedit.exe /displayorder {c0dfc4fa-cb21-11dc-81bf-005056c00008}

23. bcdedit.exe /default {c0dfc4fa-cb21-11dc-81bf-005056c00008}

24. Tip: Right-Click on the top-left command shell window icon and select Mark, then highlight the GUID in returned in step 8 and press {Enter}. The use the same icon to paste the GUID into the command line for step 9 and then use {UP-ARROW} to edit the command line for the next commands.

5. Connecting to the network

WinPE can connect to a network. You can then save and restore images directly from a network folder or your own computer. Check the example procedure given below:

In the example, we will connect to a shared folder on Fred's Windows XP office computer named 'FredsPC'. The read/write shared folder that Fred has made on his office PC has been named 'sharefld' and Fred is on the 'mydomain' network and has a username of 'freddy' and a password of 'mypassword'.

1. Connect an Ethernet cable and boot to WinPE from the USB drive prepared earlier.

2. Type IPCONFIG /all and check whether you have the valid IP address (not 192.168.1.1).

3. If valid IP addresses are not listed, your WinPE operating system does not contain the correct drivers. To rectify this, copy the correct Windows 7 network driver files (INF/CAT/SYS etc) to your WinPE USB drive, e.g. to the folder F:\NETPE. Then on the target system, type drvload F:\NETPE\xxxxxx.inf (where xxxxxx.inf is the name of your driver inf file). Note that all driver files should be present (including xxxxx.inf, xxxxx.cat and xxxxx.sys). Wait for one minute and then type ipconfig /all again. You can also try typing netcfg -winpe to re-initialise the network stack.

4. Type IPCONFIG and check whether you have the correct Default Gateway and DNS Suffix listed.

5. To connect to a network share folder, type

NET USE N: \\FredsPC\sharefld /U:mydomain\freddy press Enter, and when prompted for the password type mypassword.

6. You can now use the N: drive to keep your WIM image files and even backup to the network or restore from the network.

Check links

A good way to check your image after it has been applied, is to boot the system and type in a command console

dir C: /AL

dir C:\Users /AL

If the links don't point to C: then you probably need the /norpfix parameter when applying the image.

6. Preparing images for duplication

If you want to use the Windows image on another computer, you must first prepare the operating system for duplication before you image it. This is because the computer name and Domain Security IDs are contained in the image. The normal way to remove these identifying values is to use the Sysprep tool.

• For XP systems, you must acquire the correct version of Sysprep.exe from the XP installation CD - see http://support.microsoft.com/kb/302577 for details and use the Reseal button. C:\Sysprep\sysprep.inf controls what happens on first user boot.

• For Windows Vista and Windows 7 systems, Sysprep.exe is already in the operating system. C:\Windows\System32\Panther\Unattend\Unattend.xml and C:\Windows\System32\Oobe\Oobe.xml control what happens on first user boot. Ensure you remove all other instances of unattend.xml from all drives (including your USB drive if it is attached when you boot the OS after sysprepping.)

Please research on the Internet for more information about Sysprep.

Tip: When you first boot to a new operating system, the first Windows Welcome screen will be displayed (called the OOBE or Out-of-Box-Experience). If you pressCTRL+SHIFT+F3 at this point, you will be asked if you want to go into Audit Mode. In Audit Mode you can install software and generally prepare the OS for duplication, without creating any user accounts. When you have finished configuring the system, click on the reseal/OOBE button on the sysprep window to shutdown the system (for Vista/Win7 choose OOBE+Generalize). You can then image it using ImageX as above. After imaging, allow the system to boot to test out the image on the hard disk. If it is not successful, restore the image and then use the CTRL-SHIFT-F3 key combination to enter Audit Mode again and fix any issue.

Editing the contents of a WIM file

Using the WAIK, you can mount the backup that you have made to a folder on your office hard disk and then edit the files in that folder which directly edits the image. In this way you can make small adjustments to the image contents (eg moving, deleting, adding or editing files), without needing to boot the target system, make the changes and then re-capture the image. This can be done as follows:

1. On the 'office' system, launch the WAIK command shell (right-click - run as administrator) window using the Start Menu. Close all other cmd and Explorer windows.

2. Type mkdir c:\mount to create an empty folder

3. Type dism /Mount-Wim /wimfile:C:\mybackup.wim /index:1 /Mountdir:C:\mount

4. You can now use Windows Explorer to edit the image which you will find at C:\Mount. Note: If using Windows XP, you are advised to hold down the SHIFT key when deleting files or folders in the image.

5. When finished, commit the changes using the command: dism /Unmount-Wim /MountDir:C:\mount /commit

Note: If you do not want to keep the changes, use /discard instead of /commit.

Read the WAIK .chm help files for more information.

Tip: I would recommend you always use the /check /verify switches with ImageX. Some BIOSes have bugs which can cause wim file or restored file corruption - you have been warned!