WindowsImageBackup Restore

Topic

New Reply

I have a Dell PC and was using the Microsoft Backup to backup the PC, including an image backup (to a network share).  The PC’s HD totally crashed, no way to get any data back.  I installed the HD from a different Dell, and got the system running again.  While I can do a “file restore”, I cannot get the image backup to restore.

When I start the restore, the system restarts to a Window PE (I assume).  I can get as far as “Restore from a Network Share”, then it asks for user name as password.  However, it does not accept any logins, even if I use IP address instead of NetBios name.  After putzing around for a while, I concluded that I did not have a network connection! (It could have said that, but didn’t!).  So, I spent a while finding Dell’s PE driver CAB with hundreds of network drivers, and the one I need was on it (RT640x64) assuming that PE is 64 bit.  So, I choose the option to “load a driver” and get the driver to load.  However, after loading I still have no connection.  Am I missing something to get the Tcp/ip stack to load?  Is there some other driver needed?

When I look on the internet, I get people customizing PE images, or SCCM or Win ADK, etc.  I don’t really want to mess around with all these things, I just want to restore an image that I know is on my network.

Any help appreciated.

Steve Lutz

Reply | Quote

Replies

I would get a USD disk and copy the image to it, then connect it to the machine you need to restore. Saves mucking around with internet connections and passwords.

cheers, Paul

Reply | Quote

If the machine is in UEFI mode then the BIOS should supply that driver (so check the BIOS settings). If it’s really not working then you can export the OEM drivers from a working Windows install with pnputil (best export the lot and fish out the right ones.. all commands here in an elevated command prompt.. but do the lot so you might need to use a larger media or remove chunky ones..)

Then you can mount the boot.wim on the recovery media and add the driver to that and commit the changes and hopefully that should get networking active. You can build a PE without a network stack but it’s not something which just happens..

for example, assuming the folder names are not a problem and your PE is on a USB key currently drive E and has the usual structure, and you’re running on the target hardware on which the network card is working, as you indicate..

md “c:\pedrivers”

pnputil /export-driver * c:\pedrivers

md c:\media

attrib -r e:\sources\boot.wim

dism /mount-wim /wimfile:e:\sources\boot.wim  /mountdir:c:\media /index:1

Dism /Image:c:\media /Add-Driver /Driver:c:\pedrivers /Recurse

dism /unmount-wim  /mountdir:c:\media /commit

Now try again.. doesn’t matter what else was added, if you have a working driver it should get you on the network from the PE, and if not make another recovery drive and try the drivers you downloaded from Dell.. from this standpoint it seems unlikely anything from Dell isn’t 64 bit – I haven’t seen that supplied by Dell for business desktop use in some time and they like to have a single deployment to manage..

background on the technique used is at

https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-and-remove-drivers-to-an-offline-windows-image?view=windows-11

You haven’t mentioned what the image holds. The good news is if you haven’t  Windows 8 / 10 machine and you’re working at Windows 7 you can still use the Windows 10 version of DISM, and the Windows 10 media to get to the device (though negotiating the login with net use won’t be fun.. not all devices will do that..) but if you image your Windows 7 media from the DVD to a WIM and apply that WIM to a USB key you can use the same technique on that key, which should boot (especially if you have UEFI enabled).

1 user thanked author for this post.

oldfry

Reply | Quote

oldguy wrote:

If the machine is in UEFI mode then the BIOS should supply that driver

How can the BIOS supply a driver, it is not a software store?

cheers, Paul

Reply | Quote

Unfortunately it is literally a software store. The decision as to which driver is made by Windows in accordance with its usual methods.. in PE, setup or at desktop..

Here’s some info..

https://uefi.org/sites/default/files/resources/Driver%20Development%20with%20EDKII_Final.pdf

pages 9, 10, specifically.

If you have UEFI turned on in the BIOS you often don’t need to start messing with boot time drivers (even with Windows 7 as EFI is a subset of UEFI and Windows 7 definitely supports that as that’s how I got Windows 10 digital entitlement in UEFI mode on the heap I’m typing this post on. No disk needed.

Steve – if you are using Windows 7 and need to make a USB just post back and I’ll flesh that out if you can’t figure it.. the image will of course replace the disk content so how you attain the imaging process is irrlevant so the change to UEFI mode to get to the imaging (if you need to) can be reverted post imaging..

 

 

1 user thanked author for this post.

oldfry

Reply | Quote

That is PXE/DXE where you get a basic driver to allow booting over the network / from disk.
The OS loads it’s own drivers after it boots and doesn’t get them from UEFI.

cheers, Paul

Reply | Quote

The DXI environment doesn’t disappear (or moonbounce malware wouldn’t have worked, for one..) – it remains in memory as the firmware is extensible – Windows drivers loaded in installation do not need to initialise the hardware or load more software from the disk unless a newer version is in the installation, so Windows loading is faster, also in part as the drivers in memory do not need to have signing checks before they are adopted as the BIOS SMM / secureboot / Boot guard has already checked them.

You can prove this for yourself with a UEFI capable machine with a UEFI supported adapter (which usually means integrated graphics; cards often have an “option rom”..) and a Windows 7 or Vista DVD. The graphics and functionality in setup will usually be closer to  desktop experience with UEFI mode on, than off.

 

Reply | Quote

This is generally easy to observe. Take a system for Windows 8 or better, disconnect the hard disk(s) and Boot a Windows 7 DVD (which has basic awareness of firmware drivers but pretty poor driver support for this decade) on a system with an IGP in UEFI mode (which ensures as best you can a driver is presented; a lot of add in cards don’t have the relevant firmware, having an option rom instead (page 22)). Note the display quality – it’s likely 32 bit and 1024×768 (monitor capacity dependant). Turn off UEFI in the BIOS, and try again. The display will likely be VGA mode (or worse) unless the port has a WHQL driver in the DVD. Windows vista is also good for this. Windows 10 handles that by assuming the device is VESA compatible and refusing to do much without a suitably recent driver.

With UEFI Windows doesn’t need to “Load” the drivers – the drivers are preconfigured in memory so they are already running such that the OS need not manipulate the hardware which speeds up the boot process. If Windows has newer drivers it just upgrades old components in memory on the fly. That’s what the “extensible” is about.. which is why various malware is trying to get into the BIOS chips now.

Should you be concerned ?/, Lenovo lest week, HP this – including POS systems potentially handling your credit cards at the mall..

https://www.bleepingcomputer.com/news/security/hp-fixes-bug-letting-attackers-overwrite-firmware-in-over-200-models/

(No, I haven’t posted that in code red .. have had some “how does that apply to askwoody?” on previous posts to which my reply is “how can I answer that question without knowing who’s reading?”. Some of us are technically nosey..)

Or rolling back to pre-UEFI days, remember the “building DMI pool information” bit which used to foul the POST but could usually be resolved by resetting the CMOS if there wasn’t a hardware fault? That was the hardware information passed to Windows which was why a lot of older activation hacks involved a little loader which loaded an image there before hooking the boot sector..

The BIOS information / code doesn’t disappear into nothingness when Windows loads as if it did things would work at POST and in the BIOS screen but not in Windows if the driver wasn’t present (making building a new image somewhat challenging).

If it did, as a specifically DXE hosted issue, moonbounce malware wouldn’t be an issue:

https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/

That said, I still went there with the mousepad on a early 2020 HP laptop while crowbarring the customer’s 1803 LSE onto it, as 1803 was convinced the mousepad was a “radio control” and the drivers needed were Microsoft out of box from version 1903. In the end we had to in place upversion that Windows install to 1909, which meant we needed to upgrade the drives on the DC to accommodate the growth in the Windows update store needed to support the extra OS.. but that’s on fail of determine cause in probably into the hundreds of platforms..

 

1 user thanked author for this post.

oldfry

Reply | Quote