Imaging Windows 7 on a laptop

 

This page is about imaging Windows 7 on a Toshiba laptop - not for multiple laptop imaging, but for operating system and data protection on a single laptop.

In common with many of the volume manufacturers of laptops, many Toshiba laptops are sold without the Windows 7 installation DVD`s. Instead, the hard drive is partitioned into 3 partitions - typically they would be set up something like -

The C:\drive contains the Windows 7 operating system.

The D:\ drive contains an image of the Windows 7 installation, complete with all installed software - at least that is the theory.

In the event of a serious corruption of the operating system, by pressing F8 before Windows boots, you can follow some instructions and reimage the C:\ drive from the image on the D:\ drive.

Toshiba have added a menu item to the standard Windows 7 recovery menu available through F8, it is the bottom item, called "Toshiba HDD Recovery". It provides a couple of screens, and then goes about its business.

It works fine - but I`m not sure if imaging is actually the correct term - Toshiba use the description image, however I don`t think it is normal sector by sector imaging.

After Windows has installed, it goes through a set-up procedure, then installs a substantial amount of additional software - all the usual bloatware that computer manufactures think we want.

So you sit and watch Windows install all the bloatware for 20 minutes or so, then after it has finished, you spend another 30 minutes uninstalling it again. So far, I haven`t found out how to stop it doing the installs.

After all this, you should have a new installation of Windows 7 plus all the extras.

The above process more or less works okay, except that on the laptop I was working on, I ended up without 64 bit Internet Explorer in the final result. 32 bit Internet Explorer was there okay, but the 64 bit version had gone. So the image on D:\ was not exactly the same as the original installation.

It does look though if the process is not sector by sector imaging, but is some kind of build - this is somewhat confirmed by the presence of boot.wim files tucked away in the D:\ drive.

Now one of the nice things about this is - if you have changed the partition table, by say, shrinking the C:\ drive, and created a new partition for data storage - the recovery process keeps the modified partition structure, Windows 7 is installed into the shrunk C:\ partition, and the new data partition is left intact. Which is good news or bad news, depending on circumstances.

It is good news if you have created other partitions for data storage or other operating systems. It is bad news if you have picked up one or more of the more nasty forms of malware that make a home for themselves in the recovery partition. Doing this form of re-imaging will not get rid of it or them.

The 400Mb recovery partition is essential for this recovery mechanism to work, and also for booting up the laptop - if changing the partition table, make sure this partition remains intact.

 

Backing up the backup

Toshiba quite properly suggest that in the event of a hard drive failure and replacement, this method of recovery will not work - so they provide a program that allows for the backup of the image on D:\ onto a set of two DVD`s.

Their programme works fine, and produces a set of two DVD`s, the first one of which is bootable - although you may have to change the BIOS to get the laptop to boot from the DVD - the BIOS may be configured to boot first from the hard drive. Press F12 on bootup to change this.

Recovery from these DVD`s is not the same as doing a re-image from the recovery partition - the process assumes that the hard drive is blank, and completely wipes the existing partitions - all of them - even the D:\drive - it partitions the hard drive from scratch, lays down a new recovery partition, a new C:\ drive, a new D:\ drive, installs Windows, and lays down a new recovery image on the D:\ drive.

After booting up from the first DVD, there is a screen to select the language, then a screen to confirm the image that is going to be installed, then a warning message that all hard disks will be erased - then off it goes.

The installation uses cmd.exe, so you can watch part of it - it uses Diskpart to do the partitioning, so if you are sharp, you can watch all your valuable data dissappearing.

But anyway, don`t do a re-imaging from the DVD`s unless you really do want to start completely from scratch.

The Toshiba program that makes the DVD`s says it will only allow one set of bootable DVD`s to be made. However I made a second set, and it is certainly bootable, but I haven`t gone through the full installation with it.

So after all this, Toshiba have provided two mechanisms to put the laptop back to its original state.

 

The Toshiba recovery partition

This section is a bit of a deviation from imaging, but hopefully provides some useful additional information which is somewhat relevant.

A standalone Windows 7 installation will by default set up a 100Mb recovery partition. It contains the Windows 7 recovery environment that on older versions of Windows used to live on the installation DVD`s or CD`s - so the recovery options can be accessed without having to put in the installation DVD or CD. The Windows 7 recovery environment is based on Windows PE.

This recovery partition also contains the boot manager for Windows 7 - the booting mechanism that had been used in earlier versions of Windows - ie, NT, 2000, XP - was ditched when Vista arrived - Vista, Server 2008, and Windows 7 use a different mechanism in which a file "bootmgr" is the starting point for the boot sequence after the BIOS has done its bit. In Windows 7, this "bootmgr" file is contained within the root of this recovery partition. This is still the case in the modified Toshiba recovery partition.

Toshiba have changed this default recovery partition to a 400Mb recovery partition, and have added the option of recovery from the Toshiba image on the hard drive.

Toshiba have written into the partition table that this is a hidden partition - however it appears that there are two ways to hide partitions - the tools that do partition manipulation know about one way, and Toshiba have used a different way.

Using a tool like Easeus Partition Master ( a free download ) allows you to set up and hide partitions, but although it knows that the recovery partition is not "normal", it can`t be used to unhide it.

Diskpart ( the Windows command line tool used in build scripts ) recognises both types of hidden partition, but shows them in different ways.

The "Detail" command in Diskpart shows that there is no volume associated with an Easeus created hidden partition, and Diskpart will not allow a drive letter to be assigned to the partition.

However the "Detail" command in Diskpart shows that there is a volume associated with the Toshiba recovery hidden partition, and Diskpart will allow a drive letter to be associated with it. Once a drive letter is assigned, Windows Explorer shows the existence of the partition, and you can dig down to a certain extent into the folders within the partition. However you meet more problems with hidden contents, and some folders are shown as empty, even though they do have contents.

The Windows 7 GUI disk management tool available through control panel shows both types of hidden partition, but treats them differently, so it knows there is a difference.

If you assign a drive letter to the Toshiba recovery partition using Diskpart, the Windows 7 GUI disk management tool does not recognise it.

A drive letter assigned by Diskpart to the Toshiba recovery partition does not survive a reboot.

Just to add to the confusion, although Easeus Partition Master knows that the Toshiba recovery partition is not "normal", the file browser in it allows you to dig down into the folder structure, and see individual files.

Another free download tool - MiniTool Partition Wizard Home Edition v5.2 - sees things a bit differently - it completely ignores the fact that the Toshiba recovery partition is supposed to be hidden, and shows it as a normal partition. The file explorer drills down into the partition with no restrictions.

It also allows you to assign a drive letter to the Toshiba recovery partition, and unlike doing this through Diskpart, this drive letter will survive reboots and cold restarts. The recovery partition now also shows in Windows Explorer, although the same problems exist with not being able to see into folders that occurs after mapping a drive letter with Diskpart.

MiniTool also allows for the hiding and unhiding of normal partitions.

After yet more raking around, I finally found out what is happening - there are indeed two types of hidden partition. The type of a partition is identified in the partition table by a hex identifier.

So now things fall nicely into place. The free download partition managers can create normal and hidden NTFS partitions - ie, types 0x07 and 0x17 respectively.

They can`t interact properly with type 0x27, the Windows recovery partition, so just make up their own minds how to deal with them.

Some other types of partition that might be of interest include -

Now if you are thinking of adding a Linux setup, you might want to know that the Easeus programme will create type 0x83 partitions - ie, ext2 or ext3 - but not a swap partition.

The MiniTool programme allows you set up Linux swap, ext2, and ext3 partitions.

They both allow you to set up FAT32 partitions.

However, back to the Windows recovery partition - and here Diskpart wins the game - you can use Diskpart to change the type of this partition from 0x27 to 0x07 - ie - to turn it into a normal NTFS partition - using the "SET ID=07" command. I definitely don`t recommend that it is done, but Diskpart can do it. It is a partition that is far better left hidden away.

In addition, even if the type is changed to 0x07, Windows Explorer will still not drill down into the folder structure, there is some other kind of restriction being applied there as well.

 

Windows backup and restore

It would be nice if the laptop could be restored to some state other than the original state - and this is possible as well - Windows 7 contains a programme called "Backup and Restore" - it is available throught the All Programs / Maintenance menu.

This programme allows you to create images of the C:\ drive and the recovery partition, and to save them to either the D:\ drive, or externel DVD`s.

To use the images, you also need to create a system recovery disk, which the same programme encourages you to do, after creating the backup image.

The system recovery disk provides some other useful tools to dig inside a faulty Windows, as well as the ability to reimage the C:\ drive.

Using Backup and Restore is not too difficult to use, but it does have some peculiarities. You also need to be aware that the Backup and Restore utility actually does two quite separate different forms of backup -

To create system images, select the option on the left of the window to create a system image and follow the instructions. On Windows 7 Home Premium, you can select whether to save the image onto the hard drive or a set of DVD`s.

On the professional versions of Windows 7, you can also select whether to save the image onto an external network location, instead of onto the hard drive or DVD`s.

Depending on where you are going to save the image to, you may get a screen asking which partitions to create an image of. Not surprisingly, you can`t create an image of the partition onto which the image is to be saved.

The image must include the recovery partition and the Windows system partition. Other partitions are optional - I think it will only include NTFS partitions, it will not image FAT32 partitions.

One bad thing is that you don`t get the option of whether the recovery partition will be included in the image - it is always included.

Maybe good news if you`ve got malware hiding in the recovery partition, as long as the image was taken before the laptop is infected. However you would have to remember to make a new image after setting up multibooting, as the first boot loader - ie, bootmgr - is on the recovery partition.

The utility does seem to be rather inflexible about where it is going to save the image to - if it is being saved to the hard drive, then you can choose the partition to save it into, but you can`t choose a path inside the partition - it saves the image onto the root level of the partition.

The partition onto which the image is to be saved must be NTFS.

It is also inflexible about the names of images - it saves the image into a folder called "WindowsImageBackup". I believe that if a folder with this name already exists in the chosen location, it will be overwritten. So if you want to store more than one image in the same location, rename each image - more on this later.

According to the documentation, you need to make a system repair disk, otherwise you will not be able to restore the laptop from the image - again, more on this later.

The big advantage of this Microsoft imaging over the Toshiba imaging is that you can take an image after you have removed all the bloatware, hardened Windows 7, and put on the software you do want. You can then get instantly back to your wanted configuration if something breaks.

Well, almost instantly !

 

The restoration

Restoration of system images is done from the WindowsPE recovery environment.

Windows backup and restore does not change the disk partition table, so other partitions are not affected. The image restoration process requires that the partitions that are to be re-imaged are set up exactly the same as they were when the image was taken. So don`t take an image, and then use a partition manager to change the partitions.

It is logical to expect that the way to re-image a dead laptop is by booting it into a recovery environment from a system recovery DVD or CD - and indeed this is the case - you can select it from the menu, and so will allow the re-imaging to take place.

It is a little unexpected that you can also boot into a Windows recovery environment by pressing F8 during startup, and to do the re-imaging from there - it is unexpected because you are now re-imaging the same partition that you have used for booting up the laptop. So that`s clever.

The screens used to set up the re-imaging are again quite inflexible - the recovery programme goes off and searches the available drives, and looks for a "WindowsImageBackup" folder - if you have changed the name of the folder to something else, it will not be found, and there is no way to tell the recovery programme where to look.

I don`t know why Microsoft have made the backup and restore programme so inflexible - why not make it possible to choose a name for an image, and to select a path. As far as I can see, if you want to keep more than one image, and you don`t want to continually rename them, the only way round this would be to create a small NTFS partition for each image.

More accurately, you would create NTFS volumes with logical drives in an extended partition, and you can have quite a lot of these, so could store multiple images. However this does mean that you are going to have to do quite a lot of partition resizing, and then setting up an extended partition, and then the volumes.

Small is perhaps not a valid description of the partition size - even a minimal installation of Windows 7 creates an image of around 12Gb in size.

However apart from this inflexibility, the concept of having an operating system with a built-in re-imaging facility for standalone home use is a great development, and I for one am making good use of it. In the commercial environment, I still think that unattended builds produce better computers than imaging.

 

 

 

 

 

website design by ron-t

 

website hosting by freevirtualservers.com

 

© 2024   Ron Turner

 

+                                   +  

 

Link to the W3C website.   Link to the W3C website.