Questions from IFW trial session

[Peabody]

I installed the trial version of IFW, v3.34.0.0, on my new Thinkpad running Windows 10 Pro, created the RE thumb drive, and have some questions:

1. I will be imaging and restoring the C partition, but don't know whether I need to image the three small partitions more than once in the beginning:

System (EFI System) 260 MB
Microsoft Reserved 16 MB (TBI View can't mount this. I can't tell what it is.)
WinRE_DRV 1000 MB

Do the contents of these partitions ever change? Are they typically imaged along with C, or is C enough?

2. I will be imaging and restoring exclusively by booting to the RE thumb drive. I don't trust VSS or Phylock. But apparently I installed Phylock as part of the trial version installation. Is there a way to uninstall Phylock? If I completely uninstall the trial version, will that uninstall Phylock?

3. I use a bluetooth mouse, which doesn't seem to work booting to the RE thumb drive. Is that intended or am I doing something wrong?

4. In the backup options list, keyboard input is not recognized in selecting items. For example, Validate doesn't respond to any form of the underscored "V". Actually, the same is true running IFW from within Windows.

5. I see the option to omit backing up the $Usn.Jrnl Data is selected by default. If I am always using the RE thumb drive, is there any reason not to back up this data? It seems it would be needed to restore the partition fully.

6. Again, always imaging and restoring using the RE thumb drive, what would be the desired Disable TRIM option? Why is it not selected by default?

Thanks for any help with these.

[TeraByte Support(PP)]

Peabody wrote:
> I installed the trial version of IFW, v3.34.0.0, on my new Thinkpad running
> Windows 10 Pro, created the RE thumb drive, and have some questions:
>
> 1. I will be imaging and restoring the C partition, but don't know
> whether I need to image the three small partitions more than once in the
> beginning:
>
> System (EFI System) 260 MB
> Microsoft Reserved 16 MB (TBI View can't mount this. I can't tell
> what it is.)
> WinRE_DRV 1000 MB
>
> Do the contents of these partitions ever change? Are they typically imaged
> along with C, or is C enough?

Data on those partitions does change. The EFI System holds the booting files. The WinRE partition is normally updated or replaced on a major Windows update. In any case, those partitions are small so including them doesn’t waste much time or space. Generally, you would just select the checkbox for the entire drive (assuming there’s not an additional data partition you want separate).

> 2. I will be imaging and restoring exclusively by booting to the RE thumb
> drive. I don't trust VSS or Phylock. But apparently I installed Phylock
> as part of the trial version installation. Is there a way to uninstall
> Phylock? If I completely uninstall the trial version, will that uninstall
> Phylock?

Uninstalling IFW will also uninstall PHYLock. If you reinstall you can pick the “Traditional” option and then unselect the PHYLock option on the “Select Components” step if you don't want it installed.

> 3. I use a bluetooth mouse, which doesn't seem to work booting to the RE
> thumb drive. Is that intended or am I doing something wrong?

It may be a driver issue. However, I don’t think Bluetooth is supported in WinPE/RE. Even if you add the driver it may still not work.

> 4. In the backup options list, keyboard input is not recognized in
> selecting items. For example, Validate doesn't respond to any form of the
> underscored "V". Actually, the same is true running IFW from
> within Windows.

Press Alt-O first to give focus to the options list. Then press V (or whatever highlighted key). Spacebar will toggle.

> 5. I see the option to omit backing up the $Usn.Jrnl Data is selected by
> default. If I am always using the RE thumb drive, is there any reason not
> to back up this data? It seems it would be needed to restore the partition
> fully.

You can include the file if you want to. VSS isn’t being used so it wouldn’t cause a validation error.

> 6. Again, always imaging and restoring using the RE thumb drive, what
> would be the desired Disable TRIM option? Why is it not selected by
> default?

The default setting should be fine. The partition is not active at the time of the backup. However, disabling it isn’t going to hurt anything either.

[Peabody]

Thanks very much for your excellent response. One more question.

My understanding is that if I enable BitLocker on any partition I'll be imaging, I have to boot into the RE version. And if I use Veracrypt, the IFL thumb drive would have to be used. But if I don't do either, would an IFL thumb drive and a WinRE thumb drive work the same? Is there any reason to prefer one over the other? What I'm told by a friend is that after booting into IFL, all of it has been loaded into memory and I can remove the thumb drive and replace it with the wireless dongle for my mouse (I'm assuming the IFL boot disk won't support bluetooth either). I don't know if the RE thumb drive can be similarly removed. Anyway, even aside from that, I'm just not clear about WinRE vs IFL thumb drives so long as I'm not encrypting.

Edit: I'm new to Windows 10, UEFI and SecureBoot. Can you please explain what IFU is, and under what circumstances it would be used (as opposed to the IFL or WinRE boot disc).

[TeraByte Support(PP)]

Correct. If using BitLocker you would need to use TBWinRE. However, it's usually easier to create the backups in Windows using VSS. IFL GUI supports working with VeraCrypt partitions. Since creating and restoring images when encryption is in use is more complex, it's highly recommended to test out any procedure you'll be using to ensure it works properly on the system and you're familiar with all the steps. For example, you might create a full drive backup prior to encrypting that you can restore and start over if needed. Then proceed with encrypting, creating the backup(s), and restoring the backup(s). Prior to doing any of that, it would also be helpful to be familiar with backing up and restoring unencrypted drives/partitions.

The normal TBWinRE flash drive can be removed after booting -- it's also running from RAM. The only case where you'd need to keep it plugged in is if you created a custom build that needed to access files on the drive. You can also use the BootWIM feature of TBWinPE/RE Builder and boot directly to a TBWinRE WIM without needing to use any boot media (this requires a working Windows, of course).

Without encryption involved, it's more a matter of personal preference which to use. Some people prefer a more Windows like environment (TBWinRE), while others prefer Linux. IFL may also be faster than TBWinRE. Both create images compatible with each other. Also, if you want to create custom builds, you may find one works better or is easier, depending on what you're trying to accomplish.

I assume you've already read the following KB articles, but linking here just in case:

Using BitLocker with TeraByte's Imaging Programs
https://www.terabyteunlimited.com/kb/article.php?id=616

Using VeraCrypt/TrueCrypt with TeraByte’s Imaging Programs
https://www.terabyteunlimited.com/kb/article.php?id=462

[Bob Coleman]

IFU (Image for UEFI) is another alternative for backing up and restoring not much different than IFL in operation.

It comes with BootIt UEFI, also known as BIU, which is a boot manager and partition manager. One might have BIU (including IFU) and not have either IFW or IFL. In that case, one might use IFU for backing up and restoring. I'm not sure if one can obtain IFU without BIU, but I can't think of any reason to prefer IFU over IFL or TBWinRE in the absence of BIU.

[Peabody]

I made it official this morning. It think IFW is going to work very well for me.

But I'm still not clear about the $Usnjrnl Data files. I don't really understand what's in these files, but Google tells me they have something to do with logging changes to files, and are associated with the File History function in Windows. It just seems including these files in the backup would be needed to restore the partition to the exact state when the image was created, with the exception of the paging and hibernation files. But then that wouldn't explain why a byte for byte validation wouldn't work. Does the process of restoring the sectors itself cause the journal files to be changed? Well, can someone please go on at length about this so I can understand? Thanks very much for any clarification. Basically I just need to know if there's any possible benefit to including these files in the backup.

[TeraByte Support(PP)]

Go ahead and include the file (disable the option to omit it). You're not backing up from live Windows so there isn't going to be any problem with VSS byte-for-byte validation failing. Even in Windows you can include the file. You just need to be aware that it may cause a validation failure even though the backup is fine (in which case you would ignore the error). The validation failure occurs because VSS doesn't properly protect the file when the backup is created (if the file changes during the backup the compare will fail).

[Peabody]

Ok, I understand. One final issue and I'll leave you alone. When booting from the RE or IFL thumb drives, I need everything to be larger on the display. The display is actually 1920x1080, but normally in Windows I set the DPI to 150 so I can see stuff. Can this be adjusted when building the thumb drives, or even during boot? In IFL I see three display dimensions listed at the very beginning of boot, but don't know how to choose one. I cursored to the bottom one and hit Enter, but nothing seemed to change.

[TeraByte Support(PP)]

For IFL, you would need to either highlight the selected item and press Enter (GRUB menu) or enter a number (1, 2, 3, etc.) and press Enter, depending on the menu type used. 1024x768, 800x600, and 640x480 are available to select.

In TBWinPE/RE you can select a custom DPI setting to use. It's in Settings, "Build Options" tab, Screen section. You can also select a resolution to use, though some are not available once booted. If you look in TBLauncher's resolution options (Tools | Screen Resolution...) when booted to TBWinPE/RE you can see what's actually available on the system (varies by system, boot mode, and WinPE/RE version).

[Peabody]

TeraByte Support(PP) wrote:
> For IFL, you would need to either highlight the selected item and press
> Enter (GRUB menu) or enter a number (1, 2, 3, etc.) and press Enter,
> depending on the menu type used. 1024x768, 800x600, and 640x480 are
> available to select.
>
> In TBWinPE/RE you can select a custom DPI setting to use. It's in Settings,
> "Build Options" tab, Screen section. You can also select a
> resolution to use, though some are not available once booted. If you look
> in TBLauncher's resolution options (Tools | Screen Resolution...) when
> booted to TBWinPE/RE you can see what's actually available on the system
> (varies by system, boot mode, and WinPE/RE version).

The IFL selection doesn't work. All three options produce the same resolution.

I'll have to test RE later.