WIM tool enhancements and Fiddling with VHD’s

Lighter posting this weekend.  I’m cleaning up the back yard for Spring and other assorted house-cleaning chores I’ve been putting off for a while.

Michael Pietroforte at his awesome 4sysops blog has one of the best sysadmin sites I just can’t wait to see a new post from.

Michael’s skill is taking those tools and utilities that many might pass over and not only drawing our attention to them, but identifying those elements that show their usefulness.

I know few others who actually will crawl through the pages of a MS beta release help file looking for leads and hints of newer and greater features.

So with respect to Michael, most all of these links come from his site.  Give him the props.

I’m drawing attention to them as a heavy ImageX, WIM, VHD user.  If these aren’t your things, then there is little to get excited about here.

New Developments in Microsoft Imaging

ImageX for Windows 7 - new features – 4sysops blog – Windows 7 (specifically the Windows 7 WAIK) will introduce a new and improved version of Microsoft’s image capture, application, and management tool ImageX. 

It is currently available in a beta stage in the WAIK Windows 7 Beta download.  Michael points out two primary observations of the new ImageX tool. 

First it supports mounting multiple WIM files at the same time for management work.  Like Michael I was a bit confused because I have already been doing this in the Vista/SP1 WAIK ImageX tool. 

Secondly, it does appear that mounting/dismounting WIM files with the new ImageX file takes much longer to execute.  I suppose the new ImageX tool brings additional service to the WIM file that was not present in the original versions. 

For now I am keeping the new and old version side-by-side with slightly modded file names.  For quick mounting and file exploring/extracting, I use the original.  For production WIM changes, I’m using the newer version.  For comparison, the Vista SP1 WAIK ImageX.exe file is 373 kB; the Windows 7 Beta WAIK ImageX.exe file is 463 kB in size.

ImageX for Windows 7 - new command-line options – 4sysops blog – Michael then follows up with a post outlining the new/improved ImageX commands and possible usages.

• imagex /cleanup – deletes abandoned resources in the WIM
• imagex /commit {/append image name} – This tweak now allows you to save changes to a mounted WIM without having to unmount it as was previously required.
• imagex /command_line option /logfile – Now you can create a logfile of all activity done in an ImageX session.  Great for troubleshooting WIM maintenance issues.
• imagex /command_line option /temp – Michael supposes that this lets you manually specify a custom location on the “host” system where ImageX uses for temp location need in mounted WIM servicing.
• imagex /cleanup – This one is a bit murky.  Looks like it cleans up the host system’s association of mounted WIM’s that were not cleanly unmounted (say unexpected system reboot).

What I did was to install the Windows 7 beta WAIK in a virtual system, then I extracted the program folder that was created back out to my Host system.  This allows me to not only read the help file to my heart’s content, but also gave me access to both the new W7 PE 3.0 WIM files and the new ImageX file version as well.

I also found that I could also manually build a working folder/contents for the W7 WAIK PE 3.0 structure with all the W7 WAIK PE 3.0 files and then still use the Vista SP1 WAIK command line tools to build PE 3.0 boot disks just fine.  I’ve not attempted to try installing multiple versions of the WAIK on a single system so since this seems to work, I’m enjoying the very best of both Win PE 2.0 and Win PE 3.0 (beta) building now!

FREE: GImageX - a GUI for ImageX –  – 4sysops blog – Based on these posts, I advised Michael that he might want to check out the ImageX GUI (GImageX) utility that makes intense work with ImageX much more user friendly and intuitive.  He did and this is his review.

DISM - WIM image configuration for Windows 7 and Vista – 4sysops blog – All my work is with ImageX so I hadn’t heard of DISM before.  Turns out is is new to Windows 7 WAIK.  DISM stands for  “Deployment Image Servicing and Management”.  From Michael’s post:

DISM replaces the Package Manager (pkgmgr.exe), PEimg and Intlcfg in the Vista WAIK. Package Manager is a command-line tool that allows you to install and configure OS updates, packages and drivers on an offline OS image. PEimg is for creating and modifying Windows PE 2.0 images offline and Intlcfg is used to change the language and locale, fonts and input settings on a Windows image.

You can install the Windows 7 WAIK, including DISM, on Vista SP1. <snip> DISM works only with Vista SP1, Server 2008, Windows 7, and Server 2008 R2.

...it seems to me that none of the so-called management tasks works with Vista images. Management tasks are used to gather information about images. For instance, you can use DISM to enumerate all drivers or hotfixes that are available in a Windows 7 image, but this wouldn’t work with a Vista SP1 image.

<snip>

DISM and imageX have in common that you can mount WIM images with both tools. Once you have mounted an image with imageX, you can use other WAIK tools, or simply Windows Explorer, to manipulate the image. DISM, on the other hand, not only allows you to mount an image; you also can use it to apply changes. Therefore, for Windows 7, DISM is the appropriate tool to configure OS images. The main purpose of imageX is to capture and deploy images, features that DISM lacks.

For more information see Michael’s examples of DISM commands

Playing with Virtual Hard Drives

Windows 7 DISM - how to mount, manage, and service WIM images – 4sysops blog – Michael picks up where he left off on the previous post and now dives into examples of DISM commands to work with WIM files.  From my perspective, it looks like it will be a useful tool in getting additional information on WIM files and internal structures.  Michael also shares how it can be used to service the host OS.  I think we will be seeing more about this tool as Windows 7 matures in the sysadmin world.

Mount, attach and create VHD files in Windows Vista and Windows 7 – 4sysops blog – Turns out that Windows 7’s (and Vista) built-in backup tools operate by creating VHD format files.  Mounting them in VPC 2007 is pretty easy, but doing it without that tool so you can explore or extract a few files is a pain. 

Windows 7 allows you to mount a VHD file using the Computer Management console.  You can also you (my favorite friend) DISKPART to attach a VHD file and mount it to the system.  How cool is that?!!

You can also mount a VHD file in scripts using diskpart: Create a text file with this content:

SELECT VDISK FILE=”file path and name of the vhd file”
ATTACH VDISK

To attach the VHD image in a script, you have to use “diskpart -s text file name”

Michael didn’t specify but I suspect there is likely a new DiskPart version in Windows 7 as well.  I’m going to have to go back and extract that one from my W7 install and do a comparison.

This might be of worthy note for sysadmins to explore as a “evidence source” if backups were turned on in Vista or Windows 7 and you are trying to find out the source of malware or other bad-system (or user) behavior.

FREE: WIM2VHD - Convert a WIM image to a VHD image – 4sysops blog – Neat tool, but limited to Windows 7 and Server 2008 R2 WIM files.  Vista/XP WIMS not supported.  Basically the tool/process allows you to take a sysprepped WIM file you captured with ImageX, then convert it to a VHD file, for testing in a supported virtual environment before physical deployments.  I really could use this tool for my imaging and system deployment work.  But we aren’t quite up to W7 OS just yet.  Eventually….

FREE: VMware DiskMount GUI - Mount VMDK files – 4sysops blog – I don’t (currently) use VMWare as a virtualization source, instead using VirtualPC 2007 as well as Virtual Box. However, this tool would allow you to mount a VMDK file disk to your host system.  Good to know.

FREE: Vmdk2Vhd - Convert VMware VMDK to Hyper-V VHD – 4sysops blog –  Good tips and information if you get a hold of a VMDK file and need to move it into VHD format.

Enlarge a VHD – 4sysops blog – Making a VHD file larger can be done but isn’t very intuitive.  Michael has done his homework and shows us how to use this tool to expand an existing VHD file to a large size.  Kinda-like replacing a 100-GB drive to 250 GB hardware size by adding more platters; but virtually.  Michael points out that this isn’t enough, you then have to “extend” the partition size so the system can use this added space.  Diskpart to the rescue!

The Deployment Guys : Deploying Win 7 to Boot From VHD with MDT 2010 – Configuring a system to multi-boot different OS’s is the realm of hard core system hackers and OS addicts.  It is cool and there are many good utilities that can help noobies out there do this.  Windows 7 has a new ability to actually boot alternative OS systems from VHD’s to the physical hardware of the system.  This is pretty cool.  The Deployment Guys show how to make it happen.

Related Bonus

Windows 7 Boot from VHD | TechNet Edge

This is good for multi-boot environment where you want to run multiple operating systems on same machine without losing the performance. This is possible by VHD booting. As every VHD is like a Hard disk with primary partition; so you can create multiple VHDs with operating systems installed onto it.

I have prepared 3 parts series on Boot from VHD

Part 1 Create/Mount VHD files in Windows 7
Part 2 Boot from VHD in Windows 7
Part 3 Boot from VHD in Windows Vista

Digital Forensic SIFT’ing: How to perform a read-only mount of filesystem evidence - SANS Computer Forensics, Investigation, and Response – Since we were on an image and mounting kick, thought some might find this post technically interesting as well.

Cheers.

--Claus V.