# Guide: Making a better diag drive



## Solaris17 (Nov 17, 2018)

Hi everyone! Cranked a redbull and some coffee and with end of the year projects coming to a close for me or progress waiting on co-op from other departments I thought it was high time to cover this in a tech forum. As some of you know I work in the IT industry. On the other side I am still on that masters grind in digital forensics. I moonlight as a general tech enthusiast and love to break things in my homelab.

Today however I will be writing about diagnostic drives, specifically USB drives. I want to cover a specific technique I use personally. Before we move on its important to note, like all of my other guides.

I do NOT

Represent any specific company
Stand by any specific product
or
Represent Techpowerup as staff or otherwise

in any official capacity when I post guides. I am doing this because I'm a nerd that thinks you may benefit from the information.

*Introduction*​I honestly hate the complexity of todays drives. Not only do I find it frustrating to follow some open source solutions and the various forms they take such as *UBCD*, *Hirens*, Random linux distributions like *Knoppix*. I also dont like the pseudo windows PE environments either. Like the old school BartPE or the new flavors of win8 and *win10SE*. Those of course are the two primary types.

Windows and Linux

Once you get past that though you enter the world of building the drive itself which is generally frustrating. You have people all over making guides telling you to use *Clover*, *Grub4Dos*, *LiLi*, *rufus* or others to help facilitate drive creation and boot.

Of course if you know what you are doing this probably isn't the hardest thing you have ever done. I don't even mind these pieces of software. I am however always irritated that I have to double check compatibility with a certain linux version, or I need to find the new tool edition to build the PE. Sometimes the guides vary wildly because the changes aren't persistent enough through builds.

Mind you even if you make it this far there are people out there that don't have a great grasp on linux or windows PE environments. This means that potentially after you have jumped through the hoops, created your drive and booted it. You still have a hard time using the tooling!

The final straw for me generally is I still cant do what I want easily. While possible, others aren't going to have a simple time. Even further if I want to use a specific tool in say the Windows SE environments those environments have serious hardware level restrictions making it difficult to say stress test outside your OS and get temps.

I started to think to myself what did I want in a diagnostic drive? What kind of things was I after? A few things came to mind.

I wanted it to be simple
I wanted it to speak to my hardware
I wanted good compatibility
I wanted to take it with me
I crunched this for about a week. I then came to a conclusion. What I wanted was windows and I wanted it tuned to my tastes and portable. This lead me to *Windows2Go* a function provided to windows Pro Users and up that allows you to create a portable windows environment using education or enterprise ISO/WIM images. These environments allow you to boot off of W2G certified USB drives (basically SSDs on a stick) and take your OS with you. Functionally this sounded like what I wanted. After a lot of trial and error over months of time I came up with a system that got me what I wanted. Granted there are plenty of other ways to go about making the drive, but I wanted to stable. I initially and over time ran into a lot of failures but settled on a technique that worked for the best.

Microsoft redtape aside I started to notice Windows 10 not only works great on a multitude of old and new PCs but 10 in itself was a godsend in cross system configuration. Meaning every time I plugged in my drive it would act like a fresh install, re-configuring drivers and services. Unlike the old windows 8 and 7 days disk jumping worked pretty well. Combined with hardware level driver support this meant I could literally run any program under the sun on the host machine and performance like anything was only ever limited to the speed of the drive and to an extent the hardware itself.

It was time to put the shopping list together.

*Preparing the Tools*​
*Primer*

*W2G Certified drives* are expensive and kind of ugly. However realistically the only requirement for windows or W2G in general is that they show up as fixed disks. For this a special flag is set in the FW of the device. Now while a few non-certified drives do this I have yet to find a single SSD controller powered drive that does not. I have tried several different types of drives many non-certified to even a W2G certified drive like the *SuperTalent R4* However I finally settled on the diamond in the rough. I legit ran it over personally with 3 different cars to test its sturdiness. Even back when it retailed for a little over $100USD, thankfully they are much cheaper now.

The drive we will be using is non other than the *Corsair Voyager GTX* it is an SSD on a stick, its quite fast, supports TRIM and more importantly is detected as a fixed disk.

Now that we have our drive we need to prepare a few other things. Namely our staging environment. For this guide we will be using *Hyper-V* which can be enabled on Windows Pro and up builds. If you are on Home or lower you may be able to use something like *virtualbox*. We will be using the VHD/X formats to work with our image. This is what we will prepare our drive with.

Now that virtualization is out of the way while it isn't "required" for this exercise it is useful to have something like *Paragon*, *Aomei*, *Acronis*, *Macrium Reflect*, etc to mange clones and images, some even come free from your drive manufacturer like WD, samsung etc! give it a look! This will allow us to backup our master so that we can re-apply it when a drive breaks or we feel like making improvements.

For this guide I will be using Paragon. I will briefly mention how to work with the raw drive itself, but I will be expecting you to know how to use your particular brand of backup/image software. I will also be making the assumption that this guide is being followed on windows 10 Pro.

Now we have our drive and Virtualization software of choice installed lets get a copy of windows. For this example we are going to be using Windows 10 Pro build 1809.

This build is a little problematic in that even after the November RTM release the build is bugged when sysprepping. We will be working around it. If you don't want any kind of trouble you can use Build 1803.

In either case @Drone maintains a fantastic list of Windows 10 Builds and the methods you need to use to convert the ESDs. You will NEED to do this ONLY if you want to go with my recommendation of using Pro or up. Otherwise Windows 10 Home will be used by default in some of the commands. You can find that thread *here*.

Now that you have your ISO and a WIM image (utilizing the instructions in post 1 of the thread I just linked) Lets get down to business!

*Creating your VMs*

In this Section we will create Two virtual machines (VMs) to use to test and build our image. Most of the work will be done in these.



Spoiler: Creating VMs



Open Hyper-V and go to "Virtual Switch Manager" lets make a network bridge so our VM can talk to the network.

*
*

Highlight "External" and press "Create Virtual Switch"

**

Change the name to whatever you wish and utilize the rest of the settings in the screen shot. Take note that your adapter will be named differently. You may lose connection temporarily after hitting Apply as windows creates the bridge.



In Hyper-V lets make 2 VMs. You can name them whatever you wish. We will be making two VMs, one will be a Generation 1 VM (Legacy/CSM) and the Other will be Generation 2 (UEFI). We are doing this so we can test in both a UEFI and non-UEFI environment.

Click "New" followed by "Virtual Machine" In my case I will be naming the VMs "Test(CSM)" and "Test(UEFI)"



Be sure to select your generations accordingly. Generation 1 for non-UEFI and Generation 2 for UEFI.



Hit "Next" until you come across the screen to configure your network. Select your adapter from the drop down and hit next again.

Lastly, do not create a drive during the setup. Simply choose to attach one later.



Click "Finish", now just duplicate the process and select "Generation 2" to create your UEFI compatible VM.

Not bad huh! Its kinda simple once you do it once or twice.



*Creating your VHD files*

Now that w have made our VMs we need to make a virtual disk. This disk will be the pot that we cook in. We will be applying our OS to this drive and working with our WIM and ISO file to make the OS we will boot from later.



Spoiler: Creating VHDX



On the right hand side of Hyper-V hit "New" again, but this time we will click "Hard Disk" from the list.

The default is VHDX and thats fine. Go ahead and leave it and click next.



The next screen takes us to type and the default is "Dynamically Expanding" leave this as is and move on.



Finally set the name and location of your VHDX and hit "Next"

Now we will be asked to set the size of the drive. The minimum for windows is 20GB, in our case lets set it to 30GB since we will be installing things. This can be adjusted later.



Now click "Next" followed by "Finish". It will save your VHD to the location of your choosing and now we can use it!



Now that you have made a VHD make a second one (like 7-8GB) using the same steps! This time name it "WIM" I will show you what we will do with it later!

*Configuring your VMs*

Now that we have created our VMs and VHDs lets get our two VMs configured the same. This will make sure we have no silly accidents that make us start over.



Spoiler: Configure VMs



Right click on any of the two VMs you just made and click "Settings". We will be making the same changes to both so it doesn't matter which we start with.

Scroll down the left panel until you reach the section labeled "Management"

Make the following changes to the sections.

Integration Services: Check all boxes
Checkpoints: Uncheck "Enable Checkpoints" so they are now fully disabled
Automatic Start Action: Change to "nothing"
Automatic Stop Action: Change to "Shut down the guest operating system"

At this point lets scroll up and modify our processor settings. Select Processor and change the amount of virtual cores the VM can use. I generally select 4, but it will depend on your hardware.

Hit apply your all done configuring the performance of your VM! Now go make the same changes to your other one!

Now that you have configured performance, lets go back to settings and mount our drives and ISOs. Depending on the VM the HDD controller will be different. For Generation 1 (CSM) VMs it is called "IDE Controller" for Generation 2 (UEFI) VMs it is called "SCSI Controller".

Lets modify the CSM VM first. That is the one we will be working with.

Select "IDE Controller 0" and on the right hand side select "Hard Drive" and click "Add"

It will now ask us to browse for our VM we made earlier. Go and find the 30GB VM I had you make first. Click browse, once you find the VM click on it and press "Open"

Now select "IDE Controller 0" again and add the "WIM" drive you made last.

Finally, you should see "IDE" Controller 1" it should automatically have an DVD drive mounted. Click on it and check "Image File".

Now click "Browse" and select and open your windows ISO image.

Last click on "BIOS" at the top left of your settings panel. On the right select "CD" and press the "Move Up" button on the right hand side.

This will let it boot the ISO first like a CD.

Click Apply and your all done!

For the UEFI VM do the same only this time its much easier. We only need to connect the first VHD we made! We don't need to connect the WIM VHD or mount the ISO!

They should look like this when done!





Ok here we go! good job so far wasn't bad right? I know I can be a little verbose. I am trying really hard though I promise. Like I said before we are going to be using the CSM VM to build our drive. We have one last step though. Remember that WIM you extracted using the instructions in the thread I posted earlier? Well its time to prepare that for usage.

*Prepping your WIM VHD*



Spoiler: Copy our source



First though we gotta go find that WIM VHD you made. Lets right click on your start button and select "Disk Management".

Now select the "Action" tab at the top and click "Attach VHD"



Now browse for your WIM VHD I had you make and click "Open"

It will bring you back to the browse window. Now just click "OK"

Now we have our VHD but we need to use it. Lets Initilize the disk so we can format it. We are going to be copying our .wim image too it.

Right click on the square on the left of the drive and select "Initialize Disk"



Cool right?

you will get a box that pops up. Check "MBR (Master Boot Record)" and click "OK".

Now right click on the space itself the section next to the box you were just working with.

From here select "New Simple Volume".

Just hit Next a bunch of times. You can name it if you would like if you want too.

After you click "Finish" it will format the VHD. This allows us to use it like a thumb drive. Now lets copy our .wim to it!



Alright! you did it!

After its done right click on your disk once again. This time we will be clicking "Detach".

That hands control back over to our VM so now we can use it.



*Seeding our VM*​
Now that we have prepared our tools its time to start the creative process. Get your paint brushes out people.

As I said previously we will be using the Generation 1 (CSM) drive for the initial config. Thanks for following along thus far. As I am sure you realized everything up until this point only takes a few minutes. Unlike this guide for example which iv already spent countless hours on /cryface.

So lets get too it.

*Booting our VM*

To start off, right click on your CSM VM and select "Connect" this will give us our "monitor" so we can see what we are doing.

After you have done that click the green "Start" button in the tool bar. Just like reinstalling windows, its going to ask us to press any key to boot from CD. Make sure the window is highlighted and press a key to boot off the CD to start the installer.

After the ISO finishes loading we are greeted with the setup window.



At this point press "SHIFT+F10" on your keyboard. Hold on to your butts.



Spoiler: Cooking a VM



Afterwards type notepad so we will be able to access a "browse" function, which will allow us to more easily check drive letters etc.



Now we will use diskpart to select and work with our drive.



The first step is to find and select the disk. Start by using

```
list disk
```
Then after you have identified the disk we will be using select it using

```
sel disk x (Where X is the drive number)
```

Now we must clean the disk, to do this type

```
clean
```
We must convert the disk to MBR to use it with both CSM and UEFI.

```
convert mbr
```
Lets make the partition that will store our boot code

```
create partition primary size=350
```
Format the partition we just made using a file system that is compatible with both UEFI and CSM. We will call this partition "system" since that's what the Os expects.

```
format fs=fat32 quick label="system"
```
Mark the partition as active so the BIOS knows who it needs to speak to first.

```
active
```
Assign it a drive letter so we can work with it and add the UEFI files.

```
assign letter="s"
```
Now lets use the rest of the space for our windows partition. We can do this by not specifying a size.

```
create partition primary
```
We will need to prepare this one for use as well.

```
format fs=ntfs quick label="OS"
```
Assign this a letter as well so we can work with it.

```
assign letter="o"
```
At this point we browse using notepad to find the drive letter and name of our WIM. In this case the drive letter of the VHD containing the WIM that we added is C:



Let's write the .wim file to the partition we just created for the OS. Remember we assigned this partition a letter of o: we can check this in notepad to make it easy.

Be sure to exit diskpart

```
exit
```
To write the wim to the partition we need to explain where it is coming from and where it is going. Pay attention to drive letters.

```
Dism /apply-image /imagefile:C:\1809x64.wim /index:1 /ApplyDir:o:\
```

HINT: If you didn't separate the specific home/pro/ent image from the wim and only managed to convert the .esd to a .wim you can change the index number to the index number corresponding to the version you want to right. You can check by running this command PRIOR to running the command above.

```
Dism /Get-WimInfo /WimFile:C:\1809x64.wim
```



Now that our image has been written. We need to copy the UEFI files contained in the OS by default to the partition that UEFI will attempt to access. These files of course are only now available because we have written the image to the partition thus exposing them.

To copy them we will be using bcdboot for this we will need to remember our partition drive letters. In this case "system" S: and the "OS" O:.

```
bcdboot o:\Windows /s s: /f ALL
```

You can check the presence using notepads browse function if you wish.





Damn fine job! At this point select the white button in your hyper-v toolbar labeled "Turn Off" your done! Now its time to boot our UEFI VM to make sure it attempts to start and finish configuring our OS.

Same thing as before right click on your UEFI VM and click connect.

After the window has loaded press "Start". (Remember we linked the VHD to this VM ahead of time)

Cool right?! Your booting a UEFI VM using a VHD you just created! Let Windows go through the initial configuration "Getting Ready", "Starting Services" etc.

Until you come to the first welcome Window.



At this point we are going to enter "Audit Mode" audit mode is a technician mode generally used by system administrators to make configuration options to the OS prior to an actual deployment.

Things you should know about audit mode.


Don't use it like a permanent OS
Things are unavailable, missing or disabled
Certain actions can break your install
Locking/Sleeping will force you to restart the process
Don't activate the OS it will simply de-provision.
Now thats out of the way.

Press CTRL+SHIFT+F3 at the above Window. Making modifications during OOBE will disable the ability to enter audit mode after a certain point. It is best to just do it immediately.

After you will be greeted with the "Just a Moment/Welcome/Logon" screen.

At which point the system will log you into the built in Administrator account.

Select "Yes" to trust your network and Click "Cancel" on the Sysprep window.

Congrats you are in audit mode! Shutting down and restarting are permitted in this mode.



Now for the deep dive. Lets see how deep the rabbit hole goes.

*Architecting your OS*​


Spoiler: Configuring your OS



Start by attempting windows updates. You should be connected to the internet. If not check your virtual switch configuration I mentioned in the beginning.

Now that we are in the OS and your updates done. Lets start configuring the OS. At this point I generally make the changes I need to help assist sysprep or make sure that I'm not going to run into issues on a new machine. One of these things is disabling the auto checkdisk feature.

I do this because if I find myself booting on a system with a bad hard drive. If fast boot is enabled the keyboard doesn't always respond. To do this I modify the registry entry responsible for the check.

To modify this entry or the others I will be suggesting you can simply run the batch script I have included attached to this post. If you would like to do it manually it is this.
Open registry editor and navigate too

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
```
Now Modify the entry labeled

```
BootExecute
```
Change the value too

```
autocheck autochk /k:abcdefghijklmnopqrstuvwxyz *
```

This should automatically skip disk checking on all drive letters.

Next lets prime the services sysprep will need to run. In command prompt type the following two commands.

```
sc config dmwappushservice start= delayed-auto
```
Followed by starting it manually

```
sc start dmwappushservice
```

Now that that is complete lets disable driver compression. This can help with the current 1809 bug it could also _possibly_ prevent issues in the future.


```
c:\windows\system32\compact.exe /U c:\windows\system32\drivers\*.sys
```
Followed by

```
fsutil behavior set DisableCompression 1
```

Go ahead and reboot at this point.

After you have rebooted lets replace the system file that is causing issues with 1809 I have attached the 1803 build of the file to this post. You can add this to the "WIM" vhd to access it like a second drive, but you will need to shot down the VM first. Otherwise you can follow the same directions I posted earlier. Alternatively you could navigate to this thread from your VM and just download all the tools connected to this post 

It goes without saying if you are following this guide and building 1803 or a future edition of windows 10 that doesn't have this issue then feel free to ignore this step altogether.

Anyway the file we want is called "WppRecorder.sys" it is located in C:\Windows\System32\Drivers.

We need to get permissions to delete it from this directory, so once you find it right click on it and select "properties"

Select the "Security" tab from the top and then click "Advanced".

At the top change the default owner to "Everyone", then hit "OK".

Now click the "Add" button and click "Select Principle" type "Everyone" again, then hit "OK".

Now check the box that says "Full Control", hit "OK" after to close the box.

Now click the "Administrators" group and click the "Edit" button.

Check the box like you did in the last step that says "Full Control".

Now hit "OK" and then "Apply"

You can now delete the file! Afterwards just copy the downloaded file to the same directory!

HINT: If at any point edit does not show up make sure permissions aren't inherited. If they are click "Disable Inheritance", which will show up next to the Add/Delete buttons.



*Installing Tools*​



Spoiler: Installing Tools"



This is pretty self explanatory. Install all the tools you would like to use. A few of the ones I personally include.

LinPack Xtreme from our own member @Regeneration
MemTest64 from TPU itself
OCCT
3dmark
Unigine bechmarks
coretemp
Crystal disk info
Recuva


etc etc, you get it.

I also throw in things like .net 3.5 which you can install via add and remove features. and directX 9.

After you are done installing updating a customizing the programs and tools you want its time to wrap it all up.



*Sysprep*

Now that we have the system configured the way we like its time to sysprep. I feel I should mention we haven't even begun to scratch the surface of what you can do to customize your image. From the ADK to unattend.xmls the world is your oyster for windows configuration. Alas its out of scope for this guide.

To begin sysprep its important to know a few things.


We will be imaging the VHD after
Windows knows when OOBE has been interrupted
With that out of the way its easier to explain. During sysprep we are going to tell windows to shutdown when its done. after the VM shuts down the VHD, the image itself is safe to touch. By default sysprep is set to "Restart" but we don't want that. Windows is a fickle beast and knows when OOBE has been interrupted. If we accidentally let it reboot and try to shut the VM down manually we contaminate the image. When we try to boot it after such an incident we will get a dreaded message explaining that "windows did not finish setup correctly and it must be restarted". If we get to that point the image is hosed, and we must start all over from step 1.

Enough of the scary stuff lets get to it!

We can either reboot the machine to invoke sysprep again. Or we can navigate to it manually.

the path of sysprep is

```
C:\Windows\System32\Sysprep
```

Click on sysprep.exe to start the wizard.

We will now select the generalize box followed by changing "Reboot" to "Shutdown" in the drop down.



Now just hit "OK" and sysprep will begin the modifications to your system and shutdown when complete.



Magic right? Now that the VM is shut down we are ready for imaging! Unlike a clone I urge you to make a proper image. This will give you a sysprepped ready for anything image with all of your software installed you can re-write at any time.

Now with the VM off, following the instructions earlier mount the VHD in Disk Management. Its important to note do NOT modify or touch the files on the drive at this point. It will ruin it.

After the VHD has been mounted and set to "Online/Initialized" Open your favorite image software. Like I said in the beginning mine is paragon.

At this point we will be taking an "image" of the entire VHD. This gets the little UEFI partition we made and the OS partition.



After you have taken your image feel free to offline and detach your VHD we got what we wanted. At the same time you can now stuff your USB stick in your machine and write the image you just took to it.

*After a hard days work you should get something like this.*​




Ahhh feel that hard work all pay off. And really other then slow reading was it that hard? think you would do it again in under 30min minus program install time? I think you could.


----------



## Solaris17 (Nov 18, 2018)

*Using non-fixed drives*​Lets get right to the point. Using a corsair GTX or a W2G certified drive is expensive when you have offerings like this Adata that happens to be like $6. I'm going to break from the usual professionalism in my other guides because I feel I need too. This option is total garbage and you shouldn't do it. Here are a few reasons why not spending $45 on a proper drive are going to make you want to suck start a .45.


These don't use the same type of memory or controller.
They are not fixed disks
They are slow as shit
They wear out and break very fast
Windows breaks alot
Now that's clear for you I heard you still want to do it. Fine but I wont go into detail and you are going to lose the ability to boot on UEFI devices.

Get yourself a tool like Aomei, or Rufus like I linked in the first post. Those pieces of software have a "Windows to go creator" that allows you to take a wim or ISO as source and write to a non-fixed drive, overriding the protections. This is a trash method and you should feel bad doing it. I would say more things to make you feel bad about doing it, but you will feel bad soon enough.


*Pitfalls*​So, unlike Linux and winSE environments are their pitfalls to this?

*Absolutely*

Occasionally (looking at you toshiba) you run into systems that utilize or offer special features on their USB ports. This sometimes puts the USB controller itself behind the chip that controls the %coolnewfeature% this can be problematic if windows does not understand how to talk to the device prior to driver installation. Generally the problems show up immediately. The drive will "disconnect" and OOBE will fail, forcing you to re-write the drive. Thankfully when this happens most systems have other USB ports that are on a different controller (usually indicated by different colored ports) that you can generally get a successful boot from. So after re-writing just try again in a different port. It will probably work out.


Incompatible systems (odd UEFI or hardware)

Some systems like HP folio and HP elitebooks have a hybrid firmware system. These absolutely trash engineering ideas totally break the drive. They generally load some UEFI functionality like say the ability to enable secure boot, but completely strip it of other things. This tricks the drive into thinking the platform is UEFI compliant when in reality its a bastardized version of some basic UEFI modules. When this happens the drive will generally totally shit itself.

In these situations you can get around it by force configuring the system for Legacy/CSM this sometimes offloads the crap interfaces and allows the drive to boot. Unfortunately a lot of the HP business line laptops do this. The normal consumer line tend to work fine.


I hope this guide helped you like it helped me. My drive installs drivers runs 3dmark I can fix machines and diagnose whats wrong with a arsenal of everyday programs I already know how to use. I know this is by no means conventional but if anything at least you got a sneak peek into WIMs, virtualization and audit mode.

It took a long time to write this but hope it was worth it thanks!



Solaris17 said:


> However I finally settled on the diamond in the rough. I legit ran it over personally with 3 different cars to test its sturdiness.



I'm for real not lying though. HD2500 pickup, Volvo S60, Toyota Camry. That was like 2 years ago and she is still going strong.


----------



## bogmali (Nov 18, 2018)

SolarisCD worthy here   

Stickied


----------



## Solaris17 (Nov 18, 2018)

Thank you!

Afterthoughts: This might even be good for the folders! its portable and has all the tools installed already.


----------

