11

What is the most efficient, native way to image a Windows partition?

  • Is the native method generally the best method for most users?
  • How does the native method differ from conventional cloning?
  • What are the pros and cons of native versus third-party tools?

How do I configure system partitions on a new drive for applying an image?

Annotation:

  • Many have taken issue with the "image" nomenclature, and it is the correct terminology
    • It's not up to an individual to change a developer's nomenclature since arbitrarily doing so would only sow confusion when referencing Windows' man pages [Microsoft Learn]
  • While I can't definitively point to any specific Windows whitepaper, Windows' "image" nomenclature likely comes from how Windows is referred to from a servicing standpoint, which is as an "image", and is why DISM has the /Online and /Image parameters:
    • Online image servicing deals with a %SystemDrive% while booted to it
    • Offline image servicing deals with a non-booted to %SystemDrive%
    • Image management deals with the topic of this question
JW0914
  • 7,865
  • 4
    "Why is the native method generally the best method for most users?" - that's not really an honest, non-biased question. – gronostaj Aug 31 '20 at 13:40
  • 4
    @gronostaj More to the point, rather than what it isn't, we can say that it is a loaded question. – J... Aug 31 '20 at 13:42
  • @gronostaj While I had in mind precisely what I wanted to address in the answer, the questions are both thoughtful & pertinent. – JW0914 Nov 15 '20 at 13:10
  • @J... As to loaded, not at all, as there's only one native way to image partitions in Windows for the last ~20yrs. I became exasperated continually addressing parts of these in comments and as answers on cloning issues questions, so I wanted to create a Q and A that addressed them in-depth, hoping to also squash misnomers & factually inaccurate info along the way (appears to be harder than it really should be since many aren't bothering to read the source links). – JW0914 Nov 15 '20 at 13:10
  • 3
    @JW0914 All that's fine, but it's still a loaded question. It presupposes that the native method is, in fact, generally the best method in asking why. – J... Nov 15 '20 at 16:17
  • The question of how the OP defines efficiency comes to mind. If your focused on speed you will choose no compression, but if you focused on image size you will choose max compression and slowest speed. These are exclusive of each other you can not have the smallest image size at the fastest speed. Also the question of time to actually image a computer comes up, which includes all setup time. For example, If your an average user,who never installed sccm before, setting up SCCM that could take days to configure. Making a bootable clonezilla usb takes <1 hour. – cybernard Jul 14 '23 at 15:13
  • @cybernard Imaging Windows to an SSD via dism with compression set to max/recovery has been faster in my experience than using fast with an HDD (I cover this in the accepted answer). There is zero setup time for dism||imagex. No user will ever be using SCCM, which is now MEM, as the license alone is thousands of dollars - MEM, and its predecessor SCCM, are only for businesses managing hundreds to thousands of machines and OEMs, as installing and imaging is done via LTI/ZTI Task Sequences like this. Clonezilla isn't a native Windows solution. – JW0914 Jul 14 '23 at 17:05
  • You can't compare a SSD to an HDD. If I use fast compression with an SSD its even faster than max/recovery on a SSD. – cybernard Jul 14 '23 at 17:15

2 Answers2

23

What is the most efficient, native way to image a Windows partition?

For the majority of users, capturing an image of a partition via DISM (XP ≤ 7: ImageX) is generally the best and most efficient method, while also not causing the common configuration issues with third-party tools or Windows Image Backup and Backup and Restore (Windows 7)

  • Win XP ≥ 10 has always natively supported imaging of partitions and filesystems:
    • Imaging the OS partition is slightly different than other partitions, as it can only be imaged from WinPE/WinRE
    • Microsoft's Windows Imaging File Format whitepaper explains the WIM format
      • WIMs [Windows IMage] can capture an entire partition or individual folders/files
      • ESDs [Encrypted Software Distribution] can only capture an OS partition and must use /Compress:Recovery (algorithm is ~33% more efficient than /Compress:Max)
        • Windows ≥ 10: Can only be used for PBR [Push-Button Reset] exported images
          Windows ≤ 8.1: Only a bootable Windows install can be captured as an ESD

  • All WinPE/WinRE WIMs have DISM included within them (Win XP ≤ 7: ImageX):
    • WinPE: Windows Preinstallation Environment
      (Windows Setup boot media: SHIFT+F10 to access terminal)
    • WinRE: Windows Recovery Environment
      (WinRE is a WinPE image containing extra WinPE Optional Components vital to recovery) 
      # Once booted to WinRE: Advanced → Troubleshoot → Command Prompt

      To boot to WinRE:
      

      Shutdown /f /r /o /t 0

Annotation:

  • Many have taken issue with the "image" nomenclature, and it is the correct terminology
    • It's not up to an individual to change a developer's nomenclature since arbitrarily doing so would only sow confusion when referencing Windows' man pages [Microsoft Learn]
  • While I can't definitively point to any specific Windows whitepaper, Windows' "image" nomenclature likely comes from how Windows is referred to from a servicing standpoint, which is as an "image", and is why DISM has the /Online and /Image parameters:
    • Online image servicing deals with a %SystemDrive% while booted to it
    • Offline image servicing deals with a non-booted to %SystemDrive%
    • Image management deals with the topic of this answer

Imaging

(Powershell cmdlet)

Specify exclusions or exceptions by creating a WimScript.ini config file, with /ScratchDir being required in WinPE since it only has 32MB of scratch [temp] space by default:

  • Even though /CheckIntegrity (ImageX: /Check) and Verify extend processing time, they should always be used since they prevent corruption from occurring within the WIM/ESD

  1. Either Capture or Append an image:
    • Capture Image: 
      # Windows ≥8: DISM
  Dism /Capture-Image /ImageFile:"Z:\Base.wim" /CaptureDir:"C:" /Name:"Windows Backup" /Description:"Base Image 2020.08.29 @ 11:30" /Compress:Max /CheckIntegrity /Verify /ScratchDir:"Z:"

      Windows XP ≤ 7: ImageX
      

      ImageX /Capture "C:" "Z:\Base.esd" "Windows Backup" "Base Image 2020.08.29 @ 11:30" /Compress:Recovery /Check /Verify /ScratchDir:"Z:&quot;
      • If saving the image to a mechanical HDD, compression takes longer, so if wanting to use /Compress:Max or /Compress:Recovery and time is an issue, it'll be more efficient to use /Compress:Fast, exporting the image later using Max or Recovery
      • For managing size constraints, images can be split into multiple read-only .swm files via /Split-Image

    • Append Image: 
      # Windows ≥8: DISM
  Dism /Append-Image /ImageFile:"Z:\Base.wim" /CaptureDir:"C:" /Name:"Windows Backup" /Description:"Base Image 2020.08.29 @ 11:30" /CheckIntegrity /Verify /ScratchDir:"Z:"

      Windows XP ≤ 7: ImageX
      

      ImageX /Append "C:" "Z:\Base.esd" "Windows Backup" "Base Image 2020.08.29 @ 11:30" /Compress:Recovery /Check /Verify /ScratchDir:"Z:&quot;
      • Compression is locked to the value set when the base image was captured
      • Individual indexes can be deleted via /Delete-Image or exported to their own image via /Export-Image

  2. Apply Image: 
    # Windows ≥8: DISM
  Dism /Apply-Image /ImageFile:"Z:\Base.wim" /Index:1 /ApplyDir:"C:" /CheckIntegrity /Verify /ScratchDir:"Z:"

    Windows XP ≤ 7: ImageX
    

    ImageX /Apply "Z:\Base.wim" 1 "C:" /Check /Verify /ScratchDir:"Z:&quot;
    • Prior to applying, get Image Info, ensuring correct index [image] is being applied: 
      Dism /Get-ImageInfo /ImageFile:"Z:\Base.wim"
    • If applying an OS image, the following must be run prior to exiting WinPE/WinRE:
      • BIOS: 
        BootRec /FixMBR && BootRec /FixBoot && BootRec /RebuildBCD
      • UEFI: 
        ::# With existing bootable EFI partition:
    BootRec /FixMBR && BootRec /RebuildBCD

        ::# Without existing bootable EFI partition:
    ::# Create EFI directories and enter:
        MkDir "Y:\EFI\Microsoft\Boot"
        Cd /d "Y:\EFI\Microsoft\Boot"
        

        ::# Create EFI boot structure:
    BootRec /Fixboot

    ::# If Access Denied error occurs (C: is applied image):
        BcdBoot C:\Windows /s Y: /f UEFI

::# Resolve any other boot issues:
    BootRec /FixMBR &amp;&amp; BootRec /RebuildBCD

Accessing data within a WIM or ESD

  1. Read-only:
    1. Mount Image: (as /ReadOnly) 
      # Windows ≥8: DISM
  Dism /Mount-Image /ImageFile:"Z:\Base.wim" /Index:2 /MountDir:"C:\Mount" /Optimize /CheckIntegrity /ReadOnly

      Windows XP ≤ 7: ImageX
      

      ImageX /Mount "Z:\Base.wim" 2 "C:\Mount" /Check
      • In lieu of this, I prefer opening the .wim/.esd within the 7zip GUI
    2. Unmount Image: (/discard changes) 
      # Windows ≥8: DISM
  Dism /Unmount-Image /MountDir:"C:\Mount" /CheckIntegrity /Discard

      Windows XP ≤ 7: ImageX
      

      ImageX /Unmount "C:\Mount"

  2. Make changes, or add data, to an image [index]:
    1. Mount Image: 
      # Windows ≥8: DISM
  Dism /Mount-Image /ImageFile:"Z:\Base.wim" /Index:2 /MountDir:"C:\Mount" /Optimize /CheckIntegrity

      Windows XP ≤ 7: ImageX
      

      ImageX /MountRW "Z:\Base.wim" 2 "C:\Mount" /Check
    2. Unmount Image: (/Commit changes) 
      # Windows ≥8: DISM
  Dism /Unmount-Image /MountDir:"C:\Mount" /CheckIntegrity /Commit

      Windows XP ≤ 7: ImageX
      

      ImageX /Unmount "C:\Mount" /Commit
      • If using DISM, to save changes as a new appended image, add /Append

Is the native method generally the best method for most users?

  • With the native method [WIMs/ESDs], no additional imaging tools or boot media is required since support is natively built-in to WinPE and Windows
  • Its impossible for WIMs/ESDs to become corrupted, provided /CheckIntegrity (ImageX: /Check) & /Verify are always used
  • Capturing and applying a .wim/.esd is not the best solution for all imaging [cloning] use cases, but is for most:
    • Capturing a .wim/.esd requires a storage medium to house the captured image (partition not being imaged, USB drive, network share, etc.), serving the dual purpose of also being an actual backup base image
    • Additional backups of the same partition can be appended to the base image with minimal [relative] file size increase, and while data from multiple partitions can be appended to the same base image, the smart compression feature benefits WIMs provide would be lost

  • WIMs/ESDs are smart compression image formats and therefore storage efficient:

    • Only changed files are added to a .wim/.esd when a new image [index] is appended to it; newly appended images utilize the same copy of unchanged files already contained within the image from the previous image(s) (hash verified), allowing for an image to remain small in relation to the data within

      Appended image example:

      # Note Base.wim size compared to each index and sum of all data therein:

      PS $  ls -File
      

      Length           Name
---------------  -------------
95,019,530,773B  Base.wim
           568B  Dism.cmd
            97B  WimScript.ini



      

      PS $  Dism /Get-ImageInfo /ImageFile:Base.wim
      

      Details for image : Base.wim

Index : 1
  Name : Alienware 18: Windows 10
  Description : v1803: Base (Drivers Only)
  Size : 22,710,283,446 bytes

Index : 2
  Name : Alienware 18: Windows 10
  Description : v1803: Software Installed (No Customizations)
  Size : 45,591,850,754 bytes

Index : 3
  Name : Alienware 18: Windows 10
  Description : v1803: Software Installed (Customized)
  Size : 94,958,267,312 bytes

Index : 4
  Name : Alienware 18: Windows 10
  Description : v1809: Updated Applications
  Size : 114,959,954,040 bytes

      


      PS $  Dism /Get-ImageInfo /ImageFile:Base.wim /Index:1

      Details for image : Base.wim
      

      Index : 1
Name : Alienware 18: Windows 10
Description : v1803: Base (Drivers Only)
Size : 22,710,283,446 bytes
WIM Bootable : No
Architecture : x64
Hal : acpiapic
Version : 10.0.17134
ServicePack Build : 1
ServicePack Level : 1
Edition : Professional
Installation : Client
ProductType : WinNT
ProductSuite : Terminal Server
System Root : WINDOWS
Directories : 24288
Files : 112665
Created : 2018.05.05 - 13:56:47
Modified : 2018.05.05 - 13:56:47
Languages : en-US (Default)



      

      PS $  Dism /Get-ImageInfo /ImageFile:Base.wim /Index:2
      

      Details for image : Base.wim
      

      Index : 2
Name : Alienware 18: Windows 10
Description : v1803: Software Installed (No Customizations)
Size : 45,591,850,754 bytes
WIM Bootable : No
Architecture : x64
Hal : acpiapic
Version : 10.0.17134
ServicePack Build : 1
ServicePack Level : 1
Edition : Professional
Installation : Client
ProductType : WinNT
ProductSuite : Terminal Server
System Root : WINDOWS
Directories : 45803
Files : 203058
Created : 2018.05.06 - 01:55:47
Modified : 2018.05.06 - 01:55:48
Languages : en-US (Default)



      

      PS $  Dism /Get-ImageInfo /ImageFile:Base.wim /Index:3
      

      Details for image : Base.wim
      

      Index : 3
Name : Alienware 18: Windows 10
Description : v1803: Software Installed (Customized)
Size : 94,958,267,312 bytes
WIM Bootable : No
Architecture : x64
Hal : acpiapic
Version : 10.0.17134
ServicePack Build : 1
ServicePack Level : 81
Edition : Professional
Installation : Client
ProductType : WinNT
ProductSuite : Terminal Server
System Root : WINDOWS
Directories : 62409
Files : 350446
Created : 2018.06.01 - 19:09:51
Modified : 2018.06.19 - 21:26:18
Languages : en-US (Default)



      

      PS $  Dism /Get-ImageInfo /ImageFile:Base.wim /Index:4
      

      Details for image : Base.wim
      

      Index : 4
Name : Alienware 18: Windows 10
Description : v1809: Updated Applications
Size : 114,959,954,040 bytes
WIM Bootable : No
Architecture : x64
Hal : acpiapic
Version : 10.0.17763
ServicePack Build : 195
ServicePack Level : 0
Edition : Professional
Installation : Client
ProductType : WinNT
ProductSuite : Terminal Server
System Root : WINDOWS
Directories : 87659
Files : 452028
Created : 2018.12.24 - 04:27:13
Modified : 2018.12.24 - 04:27:15
Languages : en-US (Default)

  • In contrast to WIMs/ESDs, Windows Image Backup and Backup and Restore (Windows 7) create a VHD image while booted to the OS using the Volume Shadow Copy Service [VSS], being no different than creating a VHD and using RoboCopy to copy all data, maintaining ACLs, to the VHD from the OS partition, and has:
    • little to no compression (storage inefficient)
    • no parity (lacks data verification)
    • total reliance on a myriad of external config, catalog, and binary files residing outside of the VHD to work correctly (in contrast to a self-contained WIM/ESD image), and if these become corrupted/modified or moved/deleted, a restore isn't possible and will fail: 
      # VM: EFI boot with clean install of Windows 11
  # Note VHD size versus ESD/WIM images of the same VM:
    # VHD (20.76GB)
    # WIM (9.23GB)
    # ESD (6.92GB)

      PS $ ls -file
      

      Length           Name
      

      

      20,761,804,800B  87a69c87-81dd-4b7f-95a1-1bff3144b638.vhdx
  6,921,506,902B   vm.esd
  9,238,800,695B   vm.wim
      

      PS $ tree -f
      

      | MediaID.bin
  | vm.esd
  | vm.wim
  |
  └─VM
    │ MediaID.bin
    |
    └─Backup Set 2024-03-19 060426
      ├─Backup Files 2024-03-19 060426
      │  Backup files 1.zip
      │  Backup files 2.zip
      │  Backup files 3.zip
      │  Backup files 4.zip
      │  Backup files 5.zip
      │  Backup files 6.zip
      │  Backup files 7.zip
      │  Backup files 8.zip
      │  Backup files 9.zip
      │  Backup files 10.zip
      │  Backup files 11.zip
      │  Backup files 12.zip
      │  Backup files 13.zip
      │  Backup files 14.zip
      │  Backup files 15.zip
      │  Backup files 16.zip
      │  Backup files 17.zip
      │  Backup files 18.zip
      │  Backup files 19.zip
      │  Backup files 20.zip
      │  Backup files 21.zip
      │  Backup files 22.zip
      │  Backup files 23.zip
      │  Backup files 24.zip
      │  Backup files 25.zip
      │  Backup files 26.zip
      │  Backup files 27.zip
      │  Backup files 28.zip
      │  Backup files 29.zip
      │  Backup files 30.zip
      |
      ├─Catalogs
      │  GlobalCatalog.wbcat
  |
  └─WindowsImageBackup
    └─VM
      │ MediaId
      |
      ├─Backup 2024-03-19 130431
      │  127dbd44-5431-4b1c-9500-426293266794.vhdx
      │  87a69c87-81dd-4b7f-95a1-1bff3144b638.vhdx
      │  BackupSpecs.xml
      │  Esp.vhdx
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Components.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_RegistryExcludes.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Writer4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Writercd3f2362-8bef-46c7-9181-d62844cdc0b2.xml
      │  f714635b-5a6a-4163-9695-33ae3fa712a6_Writere8132975-6f93-4464-a53e-1050253ae220.xml
      |
      ├─Catalog
      │  BackupGlobalCatalog
      │  GlobalCatalog
      |
      ├─Logs
      |
      ├─SPPMetadataCache
      │  {f714635b-5a6a-4163-9695-33ae3fa712a6}

How does the native method differ from conventional cloning?

The vast majority of Windows users have no need for partition-level or disk-level images:

  • A conventional partition-level or disk-level image (contains offset, alignment, block size, etc.):
    • Lacks native Windows support and therefore requires non-standard boot media (boot media that's not WinPE/WinRE) and third-party programs
    • Often lacks compression by default, one of the main advantages of the WIM/ESD smart compression image format
    • Locks the user to that specific partition or drive layout (offset, alignment, block size, etc.)
    • Often has no data verification and is therefore subject to data corruption

  • DISM/ImageX creates a filesystem image, not a partition partition-level or disk-level image:
    (Win ≥ XP uses NTFS as the default filesystem)
    • When pointed at the root of a partition [C:\], DISM/ImageX captures an image of all data on that partition, but not the structure of the partition/drive itself (offset, alignment, block size, etc.), bypassing the inconvenience a conventional partition/drive image creates, as only filesystem data is contained within a .wim/.esd, allowing it to be applied to any partition, regardless of size difference or whether there is existing data on the partition.

What are the pros and cons of native versus 3rd party?

Third-party tools will almost always fall into one of two categories, Linux-based or Windows-based via DISM/ImageX/Powershell, with many resulting in configuration issues, and the latter sometimes encompassing developers who use proprietary image file formats and custom boot environments (many of which are Linux-based).

  • There's a minute number of posts on StackExchange (or Spiceworks) regarding imaging issues arising from using Windows' native DISM (Win XP ≤ 7: ImageX), however thousands of questions, answers, and comments exist for issues arising from third-party imaging tools:
  • I have the perspective it's unacceptable for a Windows user to receive advice to use Linux tools to image Windows, as that's inefficient, forcing the user to rely on not only a non-native boot environment unsupported by Windows, but also on an image format unsupported by Windows, both of which over-complicate imaging.

    Ever come across advice telling a BSD or Linux user to boot to Windows or use Wine to back up their data? For example, ntfsclone (part of ntfs-3g) is a popular Linux utility, with the following from it's man page:

    Windows Cloning

    If you want to copy, move or restore a system or boot partition to another computer, to a different disk, partition... or to a different disk sector offset, then you will need to take extra care.

    Usually, Windows will not be able to boot, unless you copy, move or restore NTFS to the same partition which starts at the same sector on the same type of disk having the same BIOS legacy cylinder setting as the original partition and disk had.

    The ntfsclone utility guarantees to make an exact copy of NTFS, but it won't deal with booting issues. This is by design: ntfsclone is a filesystem, not system utility; its aim is only NTFS cloning, not Windows cloning. Hereby ntfsclone can be used as a very fast and reliable build block for Windows cloning but [it] itself it's not enough.

WIMs/ESDs don't have these issues since they only contain filesystem information (files and directories), not partition/drive level data, allowing them to be applied to any partition, regardless of size difference or whether there is existing data.

Native Pros

  • WIMs/ESDs are natively supported by all Windows editions ≥ XP
    • WIMs/ESDs are versatile and can be captured, applied, or modified when booted to WinPE (Windows install media), WinRE (Windows Recovery), or the OS
    • WIMs/ESDs do not require additional tools or boot media since all required tools are built-in to all three environments
  • WIMs/ESDs are smart compression image formats, able to contain multiple images, backups or otherwise, within a relatively small single image file
  • Its impossible for WIMs/ESDs to become corrupted, provided /CheckIntegrity (ImageX: /Check) & /Verify are always used
  • WIMs/ESDs can be deployed remotely via PXE, even to a machine without an OS installed

Native Cons

  • Requires a storage medium for the captured image (another partition, USB drive, network share, etc.)
    • If saving the image to a mechanical HDD, compression takes longer, so if wanting to use /Compress:Max or /Compress:Recovery, it's more efficient to use /Compress:Fast, exporting the image later using Max or Recovery
  • Capturing, Appending, Applying, or Exporting an image is resource-intensive
    • Even though /CheckIntegrity (ImageX: /Check) and Verify do extend the image processing time, they should always be used

How do I configure system partitions on a new drive for applying an image?

  1. Use DiskPart: 
    DiskPart

    ::# List disks:
    Lis Dis
    

    ::# Select OS drive # the image is being applied to:
    Sel Dis #
    

    ::# Wipe partition table (assumes no data on drive is being preserved)
    Clean
    UEFI: 
    Convert gpt

  2. Create boot partition:
    • BIOS: 
      Cre Par Pri Offset=1024 Size=100
Format Quick Fs=NTFS Label="Boot"
Active
    • UEFI: 
      Cre Par EFI Offset=1024 Size=100
Format Quick Fs=FAT32 Label="EFI"
Assign Letter=Y
Cre Par Msr Size=16

  3. Create OS partition:
    • Rest of the drive as the OS partition:
      If C: can't be assigned, change 3 & 5 to another letter
      BIOS: 
      Cre Par Pri
Format Quick Fs=NTFS Label="System"
      UEFI: 
      Cre Par Pri Id=ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Format Quick Fs=NTFS Label="System"
Assign Letter=C
    • Additional partitions after the [200GB] OS partition:
      If storing User Data directories on a partition other than C:\ (recommended), max size required is ~300GB (multiply size wanted by 1024: 200*1024=204800)
      BIOS: 
      Cre Par Pri Size=204800
Format Quick Fs=NTFS Label="System"
      UEFI: 
      Cre Par Pri Size=204800 Id=ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Format Quick Fs=NTFS Label="System"
Assign Letter=C

  4. Create WinRE partition: (should have 320MB free to allow for future WIM size increases)
    • BIOS: 
      Shrink Desired=665 Minimum=650
Cre Par Pri id=27
Format Quick Fs=NTFS Label="WinRE"
    • UEFI: 
      Shrink Desired=665 Minimum=650
Cre Par Pri Id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
Format Quick Fs=NTFS Label="WinRE"
Gpt Attributes=0x8000000000000001

  5. Resolve any boot issues: (once system image has been applied)
    • BIOS: 
      BootRec /FixMBR && BootRec /FixBoot && BootRec /RebuildBCD
    • UEFI: 
      ::# With existing bootable EFI partition:
    BootRec /FixMBR && BootRec /RebuildBCD

      ::# Without existing bootable EFI partition:
  ::# Create EFI directories and enter:
      MkDir "Y:\EFI\Microsoft\Boot"
      Cd /d "Y:\EFI\Microsoft\Boot"
      

      ::# Create EFI boot structure:
      BootRec /Fixboot
      

        ::# If Access Denied error occurs (C: is applied image):
      BcdBoot C:\Windows /s Y: /f UEFI


      

      ::# Resolve any other boot issues:
      BootRec /FixMBR && BootRec /RebuildBCD

  6. Remove EFI mountpoint (if applicable) and Reboot
    UEFI:     
    DiskPart

    Sel Vol Y
  Remove
  Exit
JW0914
  • 7,865
  • 10
    "Windows has always natively supported imaging of partitions or individual directories" is vast hyperbole. Windows was around long before Longhorn/Vista (which introduced ImageX, the predecessor to dism). Further, neither ImageX nor dismmeets the Question's demand for a "native way to image a Windows partition", since both image the filesystem on a partition. This is not merely semantics. – Eric Towers Aug 31 '20 at 01:51
  • @EricTowers Thing is, many Windows users tend to say "partition" when they actually mean "filesystem", which stems from lots of Windows software and documentation confusing the two terms in many places. – TooTea Aug 31 '20 at 08:39
  • @EricTowers How is that hyperbole? You do know Windows is installed via a WIM or ESD image, as well as deployed via MDT or SCCM right? (Did you by chance check out the linked to whitepaper explaining the technical aspects of the WIM format?) ImageX isn't a predecessor to DISM in the normal sense, as they're OS-specific (ImageX cannot be used to image a system partition on Win ≥8 and DISM cannot be used to image on Win ≤7). If a WIM or ESD is not a "native way to image a Windows partition", then what exactly do you believe it is (please reference the appended image example above)? – JW0914 Aug 31 '20 at 11:51
  • 2
    @JW0914 : "always", emphasis mine, is incorrect, as is your claim "Windows is installed via a WIM or ESD image". Windows 1, 2, 3.0-WfW 3.12, NT 3.5.0-4.1, 95, 98, 98SE all precede WIM, ESD, ImageX, and dism. I still install Win98SE from time to time; it, like many of the Windows I listed, is installed from CAB files. The WIM/ESD/ImageX/dism ecosystem didn't exist prior to Longhorn/Vista and I note that the Question doesn't specify a version or range of versions of Windows in text or in tags, so you have, at best, given a partial answer, incorrectly claiming universal scope. – Eric Towers Aug 31 '20 at 12:01
  • @EricTowers Why would an answer in 2020 address OS versions more than two decades old? ImageX is included in all Windows versions ≥XP (which is specified in the answer, however I do understand your point and will edit accordingly), with all versions ≥7 using an install.esd/install.wim. Too many have confused what imaging a partition on BSD/Linux is versus natively imaging a partition on Windows, as these are not the same. For the majority of Windows users, imaging data at the partition-level or disk-level serves zero purpose, introducing several inconveniences along the way. – JW0914 Aug 31 '20 at 12:16
  • I think you have the HDD vs. SSD compression thing backwards. On HDDs the disk becomes a bottleneck, so you could want to increase compression: the less data to write, the sooner it will be done and you have extra CPU time anyway due to disk's slowness. For SSDs faster compression could be preferred, otherwise the CPU may not keep up with delivering data to write. In the end it's a matter of balancing CPU vs. disk usage to keep them both as busy as possible, but the faster the disk, the faster compression you need if you want to optimize for fastest imaging. – gronostaj Aug 31 '20 at 13:38
  • 1
    "Why would an answer in 2020 address OS versions more than two decades old?" - you don't have to address them. Just don't pretend they don't exist. Facts don't expire, and "always" implies there are no exceptions. – gronostaj Aug 31 '20 at 13:45
  • @gronostaj I understood the point Eric was making and edited accordingly. /Compress:Fast was recommended if time is a constraint when saving the captured image to a mechanical HDD, lessening the time it takes for image capturing - /Compress:Max|/Compress:Recovery for a100GB+ system partition often takes several hours versus the 30m - 60m with a SATA III SSD. I recommend Max||Recovery for all use cases, however if a user doesn't have several hours to wait in WinPE/WinRE, using /Compress:Fast, then exporting to Compress:Max [WIM] or /Compress:Recovery [ESD], would be recommended. – JW0914 Aug 31 '20 at 13:56
  • 2
    It seems pretty misleading to call the stuff described in this answer an "image" at all. It's a file archive created by means of copying the files into a completely different filesystem, and nothing is ever imaged. – hobbs Aug 31 '20 at 18:47
  • @hobbs If you have an issue with the nomenclature, take it up with Microsoft, as this is how you image Windows and has been the way for ~20yrs. Might I suggest actually reading at least a few of the 24 source links, of which explain in more detail, however this is not a Q and A about what any one person's opinion of what constitutes an "image" is, but how to capture partition images natively in Windows... the commands used should imply this, considering they have the word image in them after all, but hey, I only linked to Microsoft Docs and technical articles 21 times, so what do I know. – JW0914 Aug 31 '20 at 19:23
  • 2
    MS being flat out wrong in word usage is definitely nothing new, and goes back more than 20 years :) – hobbs Aug 31 '20 at 21:50
  • WIM is indeed not a disk image in the traditional sense, even if Microsoft insists on calling it so. A "disk image" usually means a sector-by-sector dump or a sparse equivalent, where "sparse" means lacking sectors that don't contain useful data according to FS. WIM is, as admitted by Microsoft file-based, so it's not an image in this traditional sense. This is confirmed by ability to create a WIM only from selected path or to exclude certain files, which would not be possible with an image. – gronostaj Nov 28 '20 at 19:59
  • 1
    @gronostaj Per Microsoft Docs (Microsoft's man pages), which I reference >20x with source links, a WIM/ESD is an image. As stated above, if users take issue with the nomenclature, take it up with Microsoft, as I'm not here to debate what users consider the definition of a partition image to be. Microsoft is the developer of Windows and they've referred to WIMs/ESDs as images for over two decades,since Win XP (the definition of an image is not the same between Windows and BSD/Linux). Perhaps users could take a portion of the 30hrs I spent on this answer and actually read the source links. – JW0914 Nov 28 '20 at 21:59
  • I don't think it's okay to incorrectly call it an image because Microsoft has been incorrectly calling it an image for years. It's still not an image and calling it so will only cause confusion. Microsoft is wrong when they use this term for WIMs and we are wrong when we're repeating after them. I appreciate your effort - I have this question bookmarked for future use and I've linked it in my answers - but linking to 30 articles that use nomenclature that we've established is misleading doesn't justify repeating that mistake. – gronostaj Nov 29 '20 at 07:51
  • 2
    @gronostaj I understand the point you're making, however for Windows "image" is the correct terminology per the developer. If I was to arbitrarily and individually change the nomenclature that would only sow more confusion when referencing Microsoft Docs. It's not up to an individual to change a developer's nomenclature, incorrect as it may be, as that has to come from the developer (it's more than just Windows, as MDT and SCCM / MECM are built upon Microsoft's "image" nomenclature). – JW0914 Nov 29 '20 at 12:53
  • @gronostaj While I can't definitively point to any specific Windows documentation/whitepaper, Microsoft's "image" nomenclature likely comes from how Windows is referred to from a servicing standpoint, which is as an "image" (i.e. online image servicing, referring to servicing the %SystemDrive% while booted to it, whereas offline image servicing refers to servicing a non-booted to %SystemDrive%, such as from WinPE/WinRE, and is why DISM has the /Online and /Image parameters - e.g. Dism /Online /Cleanup-Image /RestoreHealth or Dism /Image:D:\Windows /Cleanup-Image /RestoreHealth) – JW0914 Nov 29 '20 at 16:03
  • @JW0914 - Great write up.. I read a lot of that for few months in 2016 and wish your answer had been available at the time :) . PS: Quick question - Do any 3rd party tools/ companies also use/ support WIM format? Since VHD (sector based) is commonly supported by most. – Alex S Mar 07 '22 at 16:15
  • @AlexS Since the WIM format was developed by Microsoft, the code is likely proprietary, so I've never come across a third-party that uses the format outside of using it with Dism/ImageX within WinPE. – JW0914 Mar 07 '22 at 20:08
  • Hmm. I’d think some tools would support format under its management framework given they can be zip opened. Are there any other non sector / file based formats other than WIM? – Alex S Mar 07 '22 at 23:06
  • 1
    @AlexS WIMs/ESDs can't be zip opened, but can via 7zip since they're an archive file format, however they can't be modified in 7zip (modifying a WIM/ESD without using Dism/ImageX would cause irreparable image corruption). This technical whitepaper explains the WIM/ESD format, as they are complex with built-in parity; AFAIK, no 3rd-party uses them except for imaging Windows partitions, but you may want to ask that on Spiceworks since Microsoft has vendor reps that monitor the forum. – JW0914 Mar 07 '22 at 23:41
  • @JW0914 - True. Long time since posting on SW - will ask over there :) – Alex S Mar 08 '22 at 09:59
  • 3
    @AlexS: wimlib allow read/write access to WIM —and probably ESD— archives since about 2013; interoperability with Microsoft ("native") tools is not perfect, so as always please backup first, but it can achieve useful things. – AntoineL Mar 09 '22 at 12:54
  • 1
    @AntoineL Image management is one function of Dism, with Dism having multiple additional functions off topic to this question and answer (e.g. I cover another functionality of Dism here). The acronym stands for Deployment Image Servicing and Management and is how Windows is serviced online or offline. – JW0914 Mar 10 '22 at 00:45
  • @AntoineL Dism is for imaging Windows ≥8, whereas ImageX is required for imaging Windows XP ≤ 7, as Dism gained that feature when Microsoft depreciated ImageX in Windows 8 (prior to this, it was used for servicing the OS) - ImageX cannot be used to image Windows in ≥8 and Dism can't be used to image in XP ≤ 7. Both tools are included in the WinPE/WinRE images of the respective OS version. Standalone Dism/ImageX version can be gotten from the Windows ADK or AIK if Windows 7. – JW0914 Mar 15 '22 at 14:37
  • @AntoineL I'm reading them, but from your comment it appears I'm misunderstanding them (I apologize for that)? There isn't a "hot debate" - when I first posted the question and answer in 2020, a few folks took issue with the "image" nomenclature, which is why I added the two annotation sections to the top of the question and answer (there can't be a debate about facts, as facts are facts and, except for the portions in italics which are my opinions, everything in this answer are facts pulled directly from Microsoft Docs [Windows Man Pages]). – JW0914 Mar 16 '22 at 10:50
  • 1
    WinPE version 1 (in OPK, 2001-2005, suitable for Win XP & 2003) did not include any "imaging" utility, so no ImageX; it came later with Longhorn (2005) and WinPE 2 (Vista era) albeit it works very well with XP. You can also use Dism from e.g. WinPE 10.x to image anything NTFS-based, probably as early as NT 3.x. What does not (usually) work is to use a lower version of WinPE than the corresponding OS. So the last WinPE (or WinRE) installed on a USB drive will perform anywhere. – AntoineL Mar 16 '22 at 13:42
  • If you get an Access Denied error when trying to apply-image, you can perform a quick format of the partition you're applying to. You're going to wipe the data with the /apply-image and it's just causing NTFS permission errors. – duct_tape_coder Aug 22 '22 at 20:19
  • 1
    When fixing the EFI partition, you have it mounted on Y. The BCDBoot command needs to copy to Y: also. As written it'll copy to the main c drive. BcdBoot C:\Windows /s Y: /f UEFI vs BcdBoot C:\Windows /s C: /f UEFI – curlyhairedgenius Aug 29 '22 at 17:38
  • cannot find bootrec in Win11 anymore – Falco Alexander Jan 10 '23 at 20:11
  • WARNING Do not use this method for moving windows partition into other drive! It does not perform it correctly. I've tried it multiple times in virtual machine, it always had errors https://superuser.com/q/1775992/1133411 – megapro17 Apr 04 '23 at 06:50
  • @megapro17 Nothing in this answer is factually inaccurate, with all info collated directly from Microsoft Docs with man page links all thoughout. Were you able to replicate this on a clean install per zoomzoom's comment in the question you linked to? If so, did you file a bug report with Microsoft? I've never encountered the issue you're running into on StackExchange or SpiceWorks - there are Microsoft [vendor] employees who monitor SpiceWorks daily and interact with users, so if you are able to replicate this on a clean install, I would also recommend posting the same on there. Cont'd... – JW0914 Jul 10 '23 at 20:50
  • @megapro17 Cont'd... What you're experiencing is very odd behavior and would imply there's something wonky configured with the OS being imaged (I have no idea what though, only that what you're experiencing is very abnormal since DISM is literally the backbone of Windows, which makes this even more odd since wonky things tend to not occur with DISM due to how critical it is). If unable to replicate on a clean install, it's something with the OS being imaged; if able to replicate, install the ADK and use the DISM version that comes with that to rule out the version within WinPE's WIM – JW0914 Jul 10 '23 at 20:56
14

What is the most efficient, native way to image a Windows partition?

There isn't one any more since Windows Backup is being phased out (probably because this was a bad product to start with).

Only DISM is left, but it only does file backup, not partition image backup. Its new Full Flash Update (FFU) images takes a sector-by-sector image of the entire disk, which unfortunately also includes unused sectors, so not at all efficient.

Why is the native method generally the best method for most users?

It isn't for Windows, as above. Microsoft has left the field in favor of third-party products.

How does the native method differ from conventional cloning?

DISM does not do cloning at all.

What are the pros and cons of native versus third-party tools?

The pros of third-party tools is that they work well and efficiently. Most are also free to use.

Example products are AOMEI Backupper, Clonezilla, Macrium Reflect, EaseUS ToDo BackUp. YMMV.

Historical note: DISM was conceived by Microsoft decades ago in an ancient version of Windows (Vista), using the Windows Imaging Format (WIM), which is a file-based disk image format, used mostly for software distribution. For backup, Microsoft has created Windows Backup, of which a limited version is still available in Windows 10 as "Back up and Restore (Windows 7)", but without its problematic image backup feature. The use of DISM as a backup utility is very strongly not recommended.

harrymc
  • 480,290
  • Comments are not for extended discussion; this conversation has been moved to chat. – DavidPostill Sep 02 '20 at 07:48
  • This answer would have been useful if it actually explained the pitfalls of using DISM for partition imaging/cloning purposes, instead of just opinionating against its use. I have one reason for not relying on DISM for partition cloning: it can't handle not-downloaded OneDrive file pointers. Otherwise, it always did it's job for an off-the-shelf tool. – Davor Josipovic Jul 08 '23 at 14:28