±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35503
New Yesterday: 0 Visitors: 176

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Creating WinPE Disk for Windows Tablet

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

4Rensics
Senior Member
 

Creating WinPE Disk for Windows Tablet

Post Posted: May 23, 17 11:34

Hi,

I'm wondering if anybody has successfully run done this tutorial:

winfe.files.wordpress....winfe1.pdf

I'm trying to do some R&D on a Windows 10 LINX 8 tablet (32Bit) and this was recommended as the go to tutorial for creating a bootable USB to take an image of it (with it locked). However, I am suck at the following point:

[quote]
diskpart
list disk
select <disk number>
clean

rem === Create the Windows PE partition. ===

create partition primary size=2000
format quick fs=fat32 label="Windows PE"
assign letter=P
active

rem === Create a data partition. ===

create partition primary
format fs=ntfs quick label="Other files"
assign letter=O
list vol
exit
[quote]

The bit in bold, where its creating a 2nd partition. Well, its failing because I have just created a fat32 partition and the rest of the drive is now unallocated and I can not access it. I'm guessing this a windows issue and possibly something to maybe do with it not being UEFI. Any pointers if something has done this would be much appreciated.

Thanks.
4R  
 
  

jaclaz
Senior Member
 

Re: Creating WinPE Disk for Windows Tablet

Post Posted: May 23, 17 15:37

Why it is failing is to be seen, it is strange, as that is the "normal" way to partition a disk.

What OS are you using?

Windows 10? Shocked

Which device is it (and how big in size)?

Maybe *somehow* *something* is hooking the device or possibly you are creating (inadvertedly) a GPT stye disk?

Exit diskpart, reboot and try again.
Use normal Disk Management instead of this part, or however check that the disk is MBR and not GPT.
You should already have the first FAT32 partition and you should be able to create another one :
diskpart
list disk
select <disk number>
create partition primary
format fs=ntfs quick label="Other files"
assign letter=O
list vol
exit

If you are using a non-windows10 AND the device is seen as "removable" Windows will only see first partition, maybe that is the issue?


Anyway you would be probably "better served" by using a dedicated project, such as the excellent WinFE by Misty:
reboot.pro/topic/19036-mini-winfe/
mistyprojects.co.uk/do.../winfe.htm
but - just like the tutorial you referenced - it is not (yet) applicable to Windows 10 source, I believe.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

4Rensics
Senior Member
 

Re: Creating WinPE Disk for Windows Tablet

Post Posted: May 23, 17 18:04

Thanks for the response.

Yes, its Windows 10. But i'm using the diskpart utility.

I am currently testing on a 64GB USB Stick (it did say try a 1TB, but as assume it should work?
The original script says to create a 2GB Fat32 Partition.

create partition primary size=2000

However, I'm then presented with a USB that is being seen solely as a 2GB Stick. The rest (57GB) is just unallocated. I'm getting errors trying it in diskpart and I can't do it in Windows Disk Management (probably some GPT/EFI issue)

I think I came across the WinFE but didn't look into it properly yet.  
 
  

jaclaz
Senior Member
 

Re: Creating WinPE Disk for Windows Tablet

Post Posted: May 23, 17 18:54

- 4Rensics
Thanks for the response.

Yes, its Windows 10. But i'm using the diskpart utility.

I am currently testing on a 64GB USB Stick (it did say try a 1TB, but as assume it should work?

...
However, I'm then presented with a USB that is being seen solely as a 2GB Stick. The rest (57GB) is just unallocated. I'm getting errors trying it in diskpart and I can't do it in Windows Disk Management (probably some GPT/EFI issue)


Nothing connected to GPT/EFI, simply your stick is "removable" (and you are not running the latest-latest Windows 10 or the good MS guys have reverted to previous way of working Confused ).

Very likely the issue is that *any* Windows (with the ONLY exception of the latest "Creators Update" of Windows 10) simply CANNOT access more than one partition (actually more than that the partition that is written in the first slot of the partition table) if the device is seen as "removable".

This is (was) by design.

And - now that everyone in the world (Ok, with you as an exception Wink ) has managed to learn about this "queer" decision - they lately reverted it, having the newest Windows 10 mount *any* partition, JFYI:
reboot.pro/topic/21473...sb-drives/

So if you need or simply want two partitions (which are not actually *needed* for a PE) you must use either a device that is seen as "fixed" (like 100% of USB hard disks or one of the few USB sticks that are set in factory as "fixed" or alternatively "flip the bit" of *any* USB stick for which you have found the needed "Manufacturer's Tool) or use a Filter Driver (that may - or may not - work in Windows 10) BOTH in the OS you use to prepare the stick AND in the bootable PE.

Since you are trying to make a WinFE, it's main (actually ONLY) scope would be to image the computer internal hard disk/SSD and for this you need some storage space, hence the original talking of a 1 Tb disk, the Author of the referenced tutorial most probably didn't think about the "Removable" vs. "Fixed" issue since *any* 1 Tb device is "Fixed" anyway.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

c.wawrentowicz
Member
 

Re: Creating WinPE Disk for Windows Tablet

Post Posted: May 28, 17 02:54

Recently I had got Acer Aspire SWITCH 10 (Win 10) to examine. It can work only in UEFI mode (no option to set legacy BIOS mode). Live linux like CAINE or DEFT not boot from this device. I prepared boot pendrive with WinPE 32bit (using Rufus) and copied FTK command imager on it. I booted Acer from pendrive (pandrive has to plug in “tablet” part no keyboard part !!!) and made image using FTK.  
 
  

jaclaz
Senior Member
 

Re: Creating WinPE Disk for Windows Tablet

Post Posted: May 28, 17 20:22

- c.wawrentowicz
Recently I had got Acer Aspire SWITCH 10 (Win 10) to examine. It can work only in UEFI mode (no option to set legacy BIOS mode). Live linux like CAINE or DEFT not boot from this device. I prepared boot pendrive with WinPE 32bit (using Rufus) and copied FTK command imager on it. I booted Acer from pendrive (pandrive has to plug in “tablet” part no keyboard part !!!) and made image using FTK.

And where did you store the image? Question

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

c.wawrentowicz
Member
 

Re: Creating WinPE Disk for Windows Tablet

Post Posted: May 28, 17 22:22

I used USB adapter with few ports. I pluged in pendrive with WinPE and portable USB harddrive. After booting I launched CMD console and used FTK imager command line to make image on portable USB harddrive.  
 

Page 1 of 2
Page 1, 2  Next