Imaging an EFI system with Windows 8 and Symantec Ghost.
Requirements:
- 16/32 GB USB flash drive
- Ghost version 11.5 (tested), possibly other versions also.
- Windows 8 ADK/Windows 8 Installation Media
- Time & Patience
First let me preface this post by saying the information I have gathered is specific to my experience and may provide a means for one to accomplish Imaging an EFI system natively with versions of Ghost that are currently “unaware” or incompatible with EFI/UEFI. This guide explains how to Image a system with Windows 8 in native EFI/UEFI mode using ghost.
A system running in EFI mode REQUIRES a GPT Partition Table. Natively the EFI system is not compatible with a legacy MBR partition table. When performing a clean installation of Windows 8 on an EFI system it creates a total of 4 partitions. I felt this many partitions was ridiculous and unnecessary so I removed the additional partitions and found that the minimum requirement is only 2 partitions.
The first partition is a 100 MB FAT32 EFI system partition which is where the boot files will reside. The rest of the drive will be formatted as an NTFS partition and will contain the Windows installation.
Ghost version 11/12 is unable to interpret the 100MB FAT32 EFI partition so if an Image of an entire GPT Windows disk is captured and then applied to another system, it will not be bootable regardless of the ghost switches specified.
The advantage to using ghost to capture and apply the images is because it can split the files as it creates them. This is especially useful in this case because in order to boot an EFI system to a bootable USB drive, the drive MUST be formatted as FAT32. As you may know FAT32 suffers from a single file size limitation of 4GB so if your image is larger than 4GB a separate drive formatted as NTFS would have to be used to store the image. The result of following this guide is to have the ability to image an EFI system natively using ghost from a single USB drive.
Since ghost is unable to handle the EFI partition, we leverage DiskPart for the creation of a fresh EFI partition along with a fresh NTFS partition. Once the GPT partition table has been created on the target system, we can use ghost to apply ONLY the Windows partition to the target system. The last and most important step is to copy the boot files from the Windows partition to the EFI system partition and viola the system now boots into Windows correctly.
EFI Systems intended to run Windows 8 require WinPE 4.0 which can be extracted from the Windows 8 ADK.
1. Create a bootable Windows 8 Installation/WinPE 4.0 flash drive. (FAT32 set as active)
2. Install Windows as GPT creating only 2 partitions - the 100MB EFI System Partition and NTFS Windows.
3. Capture the entire drive using Ghost splitting the image into < 4GB sections (I used a 2GB split).
Example: Entire Disk Capture (Disk 1 Partitions 1 & 2)
%PEBootRamdiskSourceDrive%\ghost32.exe -clone,mode=create,src=1,DST=%PEBootRamdiskSourceDrive%\images\entiredisk.gho -split=2000 -z2 –sure
4. Using DiskPart, partition the target system as GTP with 100MB EFI Partition and the rest as NTFS Windows.
Example: DiskPart Scripted Commands
diskpart /s %PEBootRamdiskSourceDrive%\createpartitions.txt
Example: Contents of createpartitions.txt:
rem Create GPT Disk Structure...
select disk 0
clean
convert gpt
rem Prepare System Partition...
create partition efi size=100
format quick fs=fat32 label="System"
assign letter=S
rem Prepare Windows Partition...
create partition primary
format quick fs=ntfs label="Windows"
assign letter=W
list volume
exit
5. Using ghost with partition switch (prestore), apply ONLY the second partition (NTFS Windows) of the captured disk Image to the second partition (NTFS) of the target disk (Think Disk 1 Partition 2, to Disk 2 Partition 2).
Example: Single Partition Restore (Disk Image containing 2 Partitions, Applying Partition 2 Only)
%PEBootRamdiskSourceDrive%\ghost32.exe - clone,mode=prestore,src=%PEBootRamdiskSourceDrive%\images\entiredisk.gho:2,dst=1:2 -sure
6. Using BCDBoot, Copy Boot files to 100MB system partition.
Example: BCD Boot Command
W:\Windows\System32\bcdboot W:\Windows /s S:
I know the W: and S: drive letters look weird but don’t worry, The Windows partition assigned as W: in the PE will be assigned C: upon booting into the operating system and the System partition will not receive a drive letter once the system has booted into windows.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
The following information is an attempt to account for different configurations that may exist in the wild.
7. If for whatever reason you wish to retain the additional partitions or capture an image of a system in its current state containing more than 2 partitions, you may do so but make sure you specify the correct target partition when applying it.
Example: Entire Disk Capture (Disk 1 containing 4 Partitions)
%PEBootRamdiskSourceDrive%\ghost32.exe -clone,mode=create,src=1,DST=%PEBootRamdiskSourceDrive%\images\entiredisk.gho -split=2000 -z2 –sure
Example: Single Partition Restore (Restore only the 4th Partition)
%PEBootRamdiskSourceDrive%\ghost32.exe - clone,mode=prestore,src=%PEBootRamdiskSourceDrive%\images\entiredisk.gho:4,dst=1:4 -sure
8. As an alternative if you wish to simply capture a single partition this can be accomplished by the following:
Example: Single Partition Capture (Drive 1 Partition 2)
%PEBootRamdiskSourceDrive%\ghost32.exe -clone,mode=pcreate,src=1:2,DST=%PEBootRamdiskSourceDrive%\images\partition2.gho -split=2000 -z2 –sure
Example: Single Partition Restore (Specify the captured Image consisting of only 1 partition, and apply it to the 4th partition of the target disk)
%PEBootRamdiskSourceDrive%\ghost32.exe - clone,mode=prestore,src=%PEBootRamdiskSourceDrive%\images\partition2.gho:1,dst=1:4 -sure
9. Please understand this is an outline and your actual drive/partition numbers may be different depending on the number of disks and partitions present on those disks at the time of capturing/applying the images.
10. Additionaly, the capture and application of entire disk images or single partitions appears to be fully functional from the ghost interface as well.
I hope this all makes sense, enjoy! 