9

Recently, I've moved from a Mac to a PC laptop. I already used Windows on the MacBook with Parallels. Because it was a virtual machine, I could make a complete backup by just copying the virtual machine file. When I needed to restore a previous version of the machine, I just had to paste the old file on the same place.

This was very convenient, because, as a software developer, it's always a hassle to configure a new environment; usually I lose days doing things such installing apps, configure, personalizing and so on.

Is there an effective way to make full image of the SSD, so if I need to restore it in the future, I just restore the image? This would mean to restore the exact settings, apps, data, everything, just like I used to do on Parallels, but on a regular Windows laptop.

nobody
  • 663
  • Windows natively supports this via WIMs by booting to WinPE/WinRE and using Dism to capture or apply the image (WIMs provide parity to ensure there's no data corruption between capturing the image and applying the image). To do so, see Imaging numbers 1 for Capturing, 2 for Applying (prior to applying an OS WIM, the OS partition would be formatted via DiskPart). Provided the WIM is being applied to a machine with a bootable Windows boot partition, the only other step before rebooting is BootRec /FixMBR && BootRec /RebuildBCD – JW0914 Nov 15 '23 at 12:51
  • 1
    @JW0914 It is preferred to create an answer instead of providing an answer in the comments section. – End Anti-Semitic Hate Nov 16 '23 at 02:03
  • @PeterMortensen "Desktop for Mac" is not a thing anybody says. The VM product for macOS is called "Parallels", as the OP correctly wrote in the first place. Please do not edit things you don't understand. – nobody Nov 18 '23 at 13:44
  • @EndAnti-SemiticHate The answer was linked to in my comment – JW0914 Nov 18 '23 at 14:11
  • @nobody Parallels (the company) has several products, one of which is Parallels Desktop for Mac. Calling it "Parallels" alone is like saying that you use "Microsoft". Granted, Desktop is probably the single most widely used Parallels product, but there are others: https://www.parallels.com/products/ – Steve Rindsberg Nov 19 '23 at 17:07
  • @SteveRindsberg The point is, the original "Parallels" reference in context was perfectly clear. The edit that reworded the post to just "Desktop for Mac" (removing the mention of "Parallels" entirely) just made the post confusing. Nobody uses the phrasing "Desktop for Mac" to refer to the virtualization product. "Parallels Desktop" perhaps, but not "Desktop for Mac". – nobody Nov 22 '23 at 14:15
  • @nobody OK, understood and sold. Though it might have been better to say "Desktop for Mac without mentioning Parallels is not a thing anybody says". But now we know. – Steve Rindsberg Nov 22 '23 at 22:05

6 Answers6

7

u1686_grawity's answer is good. You can also use a tool like CloneZilla to make images and restore them to both VM's and bare metal.

Keltari
  • 73,243
7

I use a tool called Macrium Reflect. It can copy disks/SSDs and partitions. Also, it resizes partitions for when you get a larger disk/SSD.

I am not associated with them in any way (just a customer).

Zagrev
  • 171
  • 3
    There is a free and paid version. Even though the free version is frozen (and no longer updated) at v8.0 it's got all the features you reasonably need. – Richard Nov 15 '23 at 15:17
5

Windows has the "System Restore" function which uses filesystem snapshots and lets you revert the entire OS to an earlier state from the same disk (or to extract old files) – as long as the OS is still functioning.

If you want to store the images on an external disk, Windows doesn't have good tools for that1, but there are many third-party products for full system backup as well as disk cloning.

It depends on whether you need one-off or continuous backups – a cloning/imaging program will create simple disk images but will take longer to create a full image every time, whereas a backup program will typically use a custom archive format that only it can extract but the advantage is that it can keep track of what changed leading to much faster backup times (so that you could have daily or even hourly past versions if needed). Usually both kinds have a bootable environment for restoring onto an empty system.


1 As far as built-in tools go, Windows does come with the "Backup and Restore (Windows 7)" app but as the name implies it's not really supported anymore except for restoring old backups. Ignore the new "Windows Backup" app which is basically OneDrive in disguise.

Sysinternals Disk2vhd could be used to manually create a whole-disk image in the .vhdx format (the same as used by Hyper-V, so in theory it could be booted as a VM); unfortunately there's no easy tool for restoring such images back to a physical disk – as far as I know, the only option you have is a Linux live USB with qemu-img or qemu-nbd on it.

A Windows install USB could be used to create .wim format images (file-based archives) using DISM – it's the official tool that's used to install Windows as well as make preconfigured OS images – but it's a bit slow when you want to image a well-used system that's in the hundreds of gigabytes... and it's file-based so restoring it is quite tedious. (I'm also not 100% sure whether it reproduces certain NTFS attributes.)

u1686_grawity
  • 452,512
  • 1
    You can boot VHDs off the windows bootloader directly as well – Journeyman Geek Nov 14 '23 at 12:41
  • @JourneymanGeek: I've heard of VHD boot but I thought it was mostly for read-only usage? (sort of like squashfs on Linux live systems?) – u1686_grawity Nov 14 '23 at 12:42
  • 1
    They're read write - I've abused them a few times – Journeyman Geek Nov 14 '23 at 12:45
  • "If you want to store the images on an external disk, Windows doesn't have good tools for that1, but there are many third-party products for full system backup as well as disk cloning." Windows has supported this natively since Windows XP via ImageX and Windows 8 via Dism, and is the backbone of how Windows is mass deployed via LTI or ZTI Task Sequences. Please see What is the most efficient, native way to image a Windows partition?. – JW0914 Nov 15 '23 at 12:50
  • @JW0914: The question was not about mass deployment of fresh systems – it was about imaging a single non-empty system to a single target. I've used DISM many times to image a single system and it's nowhere near what I would call efficient (having multiple times taken several times longer than a block clone to image a non-empty OS with large user profiles), and especially not anywhere close to "single image" that OP is asking about, given that it only images the partition and leaves it up to the user to create the partitions, to install the bootloader, to set up the recovery, and so on. – u1686_grawity Nov 15 '23 at 13:03
  • @u1686_grawity My point was this is how Windows is designed to be imaged - WIMs are what Windows is based around (WinPE/WinRE boot.wim, install.<esd||wim>, etc.). Capturing and applying a WIM takes longer than directly cloning a drive because parity is built into the WIM and ESD smart compression image formats - all files are hash verified during both the capture and apply of the image (this is why /CheckIntegrity and /Verify should always be used since they guarantee the data in the WIM/ESD can never be corrupted). – JW0914 Nov 15 '23 at 13:11
  • @u1686_grawity (Cont'd) Since the OP is asking how to do so on a machine Windows is already installed on [PC laptop], it's a three step process: (1) Format the OS partition; (2) Apply the WIM; (3) Reboot after: BootRec /FixMBR && BootRec /RebuildBCD. These steps could even be saved in a simple .bat, and if desiring one single disk image, an FFU image could be captured and applied (FFU route would be inefficient compared to a WIM of the OS partition). – JW0914 Nov 15 '23 at 13:20
  • @JW0914: No, it's how Windows was designed to be deployed in manufacturing and corporate environments, where the images are small and contain no user files – there's nothing special about WIM format otherwise that another tool could not replicate. (It doesn't even preserve EAs.) I'd kind of buy the checksum explanation if /CheckIntegrity had been enabled, but even then calculating a SHA1 hash of a file is basically a rounding error on any modern CPU – to the extent that some filesystems offer to do it for all files on the fly – so it still wouldn't be an excuse for being inefficient. – u1686_grawity Nov 15 '23 at 14:30
1

I've used Acronis True Image successfully for a long while. It does scheduled backups, incremental backups, backup of the running system, and restore from a network drive; it's all there, but all Windows backup software should have that, actually.

One thing's missing, though (that's present for any sensible virtual machine backup software): booting and running the system directly from the backup without having to go through the time-consuming restoration process first.

Haukinger
  • 119
  • You should switch to Macrium Reflect, the free version has this feature - it's saved my ass this year more times than I count. – Hashim Aziz Nov 15 '23 at 19:38
1

Microsoft considers this tool deprecated in the client versions of Windows, so use at your own risk, but I have used this many times to create and restore full system disk images (usually to move from an old, slow SSD to a newer, bigger and faster SSD):

Create the image

  1. Start/Search for "Control Panel".
  2. "Backup and Restore (Windows 7)".
  3. "Create a system image" (in the left-hand menu).

Restore the image

  1. Boot from a Windows installation USB stick (created with Rufus and a Windows ISO).
  2. Select language, time format and keyboard/Next
  3. "Repair your PC" (small link in the lower left-hand corner)
  4. Troubleshoot
  5. System Image Recovery

The backup will be stored as a vhd image, so, as an additional bonus, you can recover individual files easily without having to perform a full restore.

Heinzi
  • 3,814
1

If Windows isn't being run within a VM, full disk images are ill-advised because they're literally not needed unless deploying to multiple machines specifically via FFU images; outside of that, there's literally no use case for partition-level or disk-level images within Windows since Win ≥ XP uses NTFS as the default filesystem (specific to this question, the OS partition is the only partition needing to be imaged).

Due to this, and excluding FFU images, a conventional partition-level or disk-level image containing offset, alignment, block size, etc. isn't required in Windows, and they:

  • lack native Windows support and therefore require third-party programs and non-standard Windows boot media
  • often lack compression and parity, the main advantages of the Windows Image file format
    • WIMs/ESDs can contain multiple images within a relatively small single image file, with data impossible to corrupt provided /CheckIntegrity and /Verify are always used
  • lock the image to that specific partition or drive layout (offset, alignment, block size, etc.)
  • often have no data verification, therefore are subject to data corruption


Imaging

PowerShell Mapping | Win ≥ 8: Dism | Win ≤ 7: ImageX

The initial base WIM/ESD does take longer to capture than third-party cloning because parity is built-in to the WIM/ESD file format; after the base image, subsequent appended images take less time. A WIM/ESD can contain multiple images within a relatively small single image file, with data impossible to corrupt provided /CheckIntegrity and /Verify are always used

  • WIMs (Windows IMage) can capture an entire partition or individual folders/files
  • ESDs (Electronic Software Distribution) can only capture an OS partition and must use /Compress:Recovery (algorithm is ~33% more efficient than /Compress:Max)
    • Windows ≥ 10: Can only be used for PBR [Push-Button Reset] exported images
    • Windows ≤ 8.1: Can be used on a bootable Windows install or a PBR image

  • Specify exclusions or exceptions by creating a WimScript.ini config file, with /ScratchDir being required in WinPE since it only has 32MB of scratch [temp] space by default
    • To negate the need of /ScratchDir, see section WinPE/WinRE Customizations

  • Even though /CheckIntegrity (ImageX: /Check) and /Verify do extend the image processing time, they should always be used since they prevent data corruption from occurring within the WIM/ESD


Prerequisites

  1. Boot to WinRE: (OS partition can only be captured from WinPE)
    1. Open an Admin terminal: WinKey+ROpen: powershellCtrl+Shift+OK
      shutdown /r /o /f /t 00
      
    2. TroubleshootAdvanced optionsCommand Prompt

  2. Identify the mount point of the offline OS partition: (it's likely not C:)
    1. DiskPart → either:

Capture Image OR Append Image

  1. Either:
    1. Capture a base image:
      # Mount Points:
        # C: offline OS partition
        # Z: partition WIM is being saved to
      

      Windows ≥8: DISM

      Dism /Capture-Image /ImageFile:"Z:\Base.wim" /CaptureDir:"C:" /Name:"Windows Backup" /Description:"Base Image 2023.11.17 @ 12:00" /Compress:Max /CheckIntegrity /Verify /ScratchDir:"Z:"

      Windows XP ≤ 7: ImageX

      ImageX /Capture "C:" "Z:\Base.esd" "Windows Backup" "Base Image 2023.11.17 @ 12:00" /Compress:Recovery /Check /Verify /ScratchDir:"Z:&quot;

      • Mechanical HDD: since compression takes longer if using /Compress:<Max||Recovery>, if time's an issue, it's more efficient to use /Compress:Fast, exporting the index later using Max or Recovery

    2. Append an image to an existing WIM:
      # Mount Points
        # C: offline OS partition
        # Z: partition containing the WIM
      

      Windows ≥8: DISM

      Dism /Append-Image /ImageFile:"Z:\Base.wim" /CaptureDir:"C:" /Name:"Windows Backup" /Description:"Appended Image 2023.11.17 @ 12:00" /CheckIntegrity /Verify /ScratchDir:"Z:"

      Windows XP ≤ 7: ImageX

      ImageX /Append "C:" "Z:\Base.esd" "Windows Backup" "Appended Image 2023.11.17 @ 12:00" /Compress:Recovery /Check /Verify /ScratchDir:"Z:&quot;

      • Compression is locked to the value set when the base image was captured
      • Individual indexes can be deleted via /Delete-Image or exported to their own WIM/ESD via /Export-Image


Apply Image

  1. Format the offline OS partition:
    1. DiskPartlis dissel dis #lis parsel par #
    2. Verify correct partition selected: det par
    3. format fs=ntfs quick label=OSdet par
    4. If mount point [Ltr] still exists → exit; if not: assign letter=Oexit
        Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
        ----------  ---  -----------  -----  ----------  -------  ---------  --------
      * Volume 8     O   OS           NTFS   Partition    300 GB  Healthy    Boot
      

  2. /Get-ImageInfo to ensure correct index [image] is being applied:
    # Windows ≥8: DISM
      Dism /Get-ImageInfo /ImageFile:"Z:\Base.wim"
    

    Windows XP ≤ 7: ImageX

    ImageX /Info "Z:\Base.wim"


  3. Apply image to the offline OS partition:
      # Mount Points
        # C: offline OS partition image is being applied to
        # Z: partition containing the WIM
    

    Windows ≥8: DISM

    Dism /Apply-Image /ImageFile:"Z:\Base.wim" /Index:1 /ApplyDir:"C:" /CheckIntegrity /Verify /ScratchDir:"Z:"

    Windows XP ≤ 7: ImageX

    ImageX /Apply "Z:\Base.wim" 1 "C:" /Check /Verify /ScratchDir:"Z:&quot;


  4. BootRec must be run prior to exiting WinPE/WinRE:
    • BIOS:
      BootRec /FixMBR && BootRec /FixBoot && BootRec /RebuildBCD
      
    • UEFI:
      ::# With existing bootable EFI partition:
          BootRec /FixMBR && BootRec /RebuildBCD
      

      ::# Without existing bootable EFI partition: ::# Create EFI directories and enter: MkDir "Y:\EFI\Microsoft\Boot" Cd /d "Y:\EFI\Microsoft\Boot"

      ::# Create EFI boot structure:
          BootRec /Fixboot
      
          ::# If Access Denied error occurs (C: is applied image):
              BcdBoot C:\Windows /s Y: /f UEFI
      
      ::# Resolve any other boot issues:
          BootRec /FixMBR &amp;&amp; BootRec /RebuildBCD
      




Appended WIM Example

PS $  ls -file "Z:\WIM"

Directory: Z:\WIM

Mode                LastWriteTime            Length  Name
----                -------------            ------  ----
-a----        2023.09.05 00:33:46   40,193,295,546B  Base.wim
-a----        2023.09.05 00:07:12              568B  Dism.cmd
-a----        2023.09.05 00:09:51               97B  WimScript.ini


PS $ Dism /Get-ImageInfo /ImageFile:"Z:\WIM\base.wim"

Deployment Image Servicing and Management tool Version: 10.0.22621.1

Details for image : Z:\WIM\base.wim

  Index : 1
    Name : Alienware 18: Windows 11
    Description : v22H2: Base (Drivers &amp; Updates Only)
    Size : 48,259,986,179 bytes

  Index : 2
    Name : Alienware 18: Windows 11
    Description : v22H2: Programs Installed (Customizations Applied)
    Size : 74,666,504,006 bytes

PS $ Dism /Get-ImageInfo /ImageFile:"Z:\WIM\base.wim" /Index:1

  Deployment Image Servicing and Management tool
  Version: 10.0.22621.1

    Details for image : Z:\WIM\base.wim

      Index : 1
        Name : Alienware 18: Windows 11
        Description : v22H2: Base (Drivers & Updates Only)
        Size : 48,259,986,179 bytes
        WIM Bootable : No
        Architecture : x64
        Hal : COMPUTER\Generic
        Version : 10.0.22621
        ServicePack Build : 2215
        ServicePack Level : 0
        Edition : Professional
        Installation : Client
        ProductType : WinNT
        ProductSuite : Terminal Server
        System Root : WINDOWS
        Directories : 48508
        Files : 195745
        Created : 2023.08.28 - 22:09:33
        Modified : 2023.08.28 - 22:09:34
        Languages : en-US (Default)


PS $  Dism /Get-ImageInfo /ImageFile:"Z:\WIM\base.wim" /Index:2

  Deployment Image Servicing and Management tool
  Version: 10.0.22621.1

    Details for image : Z:\WIM\base.wim

      Index : 2
        Name : Alienware 18: Windows 11
        Description : v22H2: Programs Installed (Customizations Applied)
        Size : 74,666,504,006 bytes
        WIM Bootable : No
        Architecture : x64
        Hal : COMPUTER\Generic
        Version : 10.0.22621
        ServicePack Build : 2215
        ServicePack Level : 0
        Edition : Professional
        Installation : Client
        ProductType : WinNT
        ProductSuite : Terminal Server
        System Root : WINDOWS
        Directories : 60460
        Files : 275154
        Created : 2023.09.04 - 23:30:09
        Modified : 2023.09.04 - 23:30:10
        Languages : en-US (Default)



Configure New Drive

  1. DiskPart:
    ::# List disks:
        Lis Dis
    

    ::# Select OS drive # WIM is being applied to: Sel Dis #

    ::# Wipe partition table (assumes no data on drive is being preserved) Clean

    UEFI:
    Convert Gpt
    

  2. Create boot partition:
    • BIOS:
      Cre Par Pri Offset=1024 Size=100
      Format Quick Fs=NTFS Label=Boot
      Active
      
    • UEFI:
      Cre Par EFI Offset=1024 Size=100
      Format Quick Fs=FAT32 Label=EFI
      Assign Letter=Y
      Cre Par Msr Size=16
      

  3. Create System partition:
    • Rest of the drive as the System partition:
      If C: can't be assigned, change 3 & 5 to another letter
      • BIOS:
        Cre Par Pri
        Format Quick Fs=NTFS Label=System
        Exit
        
      • UEFI:
        Cre Par Pri Id=ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
        Format Quick Fs=NTFS Label=System
        Assign Letter=C
        Exit
        
    • Additional partitions after the [200GB] System partition:
      If storing User Data directories on a partition other than C:\ (recommended), max size required is ~300GB (multiply size wanted by 1024: 200*1024=204800)
      • BIOS:
        Cre Par Pri Size=204800
        Format Quick Fs=NTFS Label=System
        Exit
        
      • UEFI:
        Cre Par Pri Size=204800 Id=ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
        Format Quick Fs=NTFS Label=System
        Assign Letter=C
        Exit
        

  4. Create WinRE partition: (should have 320MB free to allow for future WIM size increases)
    • BIOS:
      Shrink Desired=665 Minimum=650 
      Cre Par Pri id=27
      Format Quick Fs=NTFS Label=WinRE
      
    • UEFI:
      Shrink Desired=665 Minimum=650
      Cre Par Pri Id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
      Format Quick Fs=NTFS Label=WinRE
      Gpt Attributes=0x8000000000000001
      

  5. Resolve any boot issues: (once WIM has been applied)
    • BIOS:
      BootRec /FixMBR && BootRec /FixBoot && BootRec /RebuildBCD
      
    • UEFI:
      ::# With existing bootable EFI partition:
          BootRec /FixMBR && BootRec /RebuildBCD
      

      ::# Without existing bootable EFI partition: ::# Create EFI directories and enter: MkDir "Y:\EFI\Microsoft\Boot" Cd /d "Y:\EFI\Microsoft\Boot"

      ::# Create EFI boot structure: BootRec /Fixboot

        ::# If Access Denied error occurs (C: is applied image):
            BcdBoot C:\Windows /s Y: /f UEFI
      
      

      ::# Resolve any other boot issues: BootRec /FixMBR && BootRec /RebuildBCD


  6. Remove EFI mountpoint and Reboot:
    DiskPart
    

    Sel Vol Y Remove Exit




WinPE/WinRE Customizations

To increase the temp space available in WinPE/WinRE, negating the need for /ScratchDir:

WinPE

  1. Open an Admin terminal: WinKey+ROpen: powershellCtrl+Shift+OK
  2. ## <InstallUSB>: drive letter for the Install USB ##
    

    Create working directory:

    MkDir "C:\Mount"

    Get correct image index (Windows Setup is usually #2):

    Dism /Get-ImageInfo /ImageFile:"<InstallUSB>:\sources\boot.wim"

    Mount WinPE Windows Setup WIM:

    Dism /Mount-Image /ImageFile:"<InstallUSB>:\sources\boot.wim" /Index:2 /MountDir:"C:\Mount"

    Load WinPE SYSTEM hive:

    Reg Load HKLM\WinPE "C:\Mount\Windows\System32\config\SYSTEM"

    Show hidden files:

    Reg Add HKLM\WinPE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 1
    Reg Add HKLM\WinPE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1
    
    

    Show file extensions:

    Reg Add HKLM\WinPE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 0
    
    

    Unload Hive:

    Reg Unload HKLM\WinPE
    
    

    Set WinPE default temp space to 512MB:

    Dism /Set-ScratchSpace:512 /Image:"C:\Mount"

    Unmount WinPE Windows Setup WIM:

    Dism /Unmount-Image /MountDir:"C:\Mount" /Commit

    Cleanup:

    RmDir /s /q "C:\Mount"

WinRE

  1. Open an Admin terminal: WinKey+ROpen: powershellCtrl+Shift+OK
  2. Mount WinRE partition:
    DiskPartlis volsel vol #det volassign letter=Wexit
  3. # Create working directory:
      MkDir "C:\Mount"
    

    Mount WinRE WIM:

    Dism /Mount-Image /ImageFile:"W:\Recovery\WindowsRE\winre.wim" /Index:1 /MountDir:"C:\Mount"

    Load WinRE SYSTEM hive:

    Reg Load HKLM\WinRE "C:\Mount\Windows\System32\config\SYSTEM"

    Show hidden files:

    Reg Add HKLM\WinRE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 1
    Reg Add HKLM\WinRE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1
    
    

    Show file extensions:

    Reg Add HKLM\WinRE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 0
    
    

    Unload Hive:

    Reg Unload HKLM\WinRE
    
    

    Set WinRE default temp space to 512MB:

    Dism /Set-ScratchSpace:512 /Image:"C:\Mount"

    Unmount WinRE WIM:

    Dism /Unmount-Image /MountDir:"C:\Mount" /Commit

    Cleanup:

    RmDir /s /q "C:\Mount"

  4. Unmount WinRE partition: DiskPartsel vol Wremoveexit
JW0914
  • 7,865
  • The main use case for me would be a system crash or moving to a new machine. I would have to reinstall and configure the entire environment again, and thats what i"m trying to avoid. – delphirules Nov 18 '23 at 19:14
  • 1
    @delphirules Once a WIM is captured, all you'd need to do is boot to WinRE (or boot a Windows install USB and Shift+F10 once the GUI loads to open a terminal) and perform Steps 4 - 7 to get up and running again (for an OS drive with ~200GB of data, the image takes ~30 - 45min to apply with an SSD, most of which is hash verification to ensure corrupted files aren't being extracted from the WIM index). Short of hardware damage, it's highly unlikely the EFI or WinRE partitions would be corrupted, which is why the OS partition is the only one that needs to be done. – JW0914 Nov 18 '23 at 20:53