ImageX - Welcome to the Imaging X-Zone

X = ?

The perennial symbol of the unknown variable.

There was Racer X from Speed Racer.

There was Chemical X that professor mixed in when created the Power Puff Girls.

There were those pesky X-Files causing havoc in the FBI for Mulder and Scully.

The search for Planet X has and still causes consternation for some astronomers.

There was that "Man from Planet X."

Now Microsoft enters the realm of "X"....with ImageX.

ImageX = Cool

As I have just posted ( GSD: Drive Imaging and Cloning Solutions ) at our shop we primarily use Ghost as our image/cloning platform.  It is solid and does a good job.  However image captures on our drives can take one to two hours (depending on compression and image placement location). Placing an image on a target pc can take anywhere from thirty-minutes or longer in some cases.  We needed something fast (at least on the deployment side) yet pretty flexible and easy to use.

So we have been playing with Clonezilla which is indeed both fast and flexible.  Image captures take about ten minutes or less for multi-Gig drive.  Image deployments take even less; approximately five minutes or so in some cases.  The reason for the speed is that Clonezilla (unlike Ghost) does only a copy of the drives sectors and data blocks that are actively in use. That means a faster capture time and restoration time.  Good for smaller image files and efficiency, but not so good for forensic work.

So when I recently stumbled upon Microsoft's ImageX utility that has shipped with Vista (and Windows PE 2.0 via the Windows Automated Installation Kit (Windows AIK) I decided to see just how useful this free utility could be in the imaging process.

What is ImageX?

ImageX is a command-line tool that enables original equipment manufacturers (OEMs) and corporations to capture, modify, and apply file-based disk images for rapid deployment. ImageX works with Windows image (.wim) files for copying to a network, or it can work with other technologies that use .wim images, such as Windows Setup, Windows Deployment Services (Windows DS), and the System Management Server (SMS) Operating System Feature Deployment Pack.

What is ImageX? - Microsoft TechNet Reference

What makes ImageX really neat is that it is not a sector-based image method, but copies the source system's partition in a file/structure based format. So image sizes are radically smaller as you don't have all those unused sector blocks.  Also, it "single-instances" the files, so that one file is stored apart from it's multiple location pointers.  That means one file is imaged even though it may exist in multiple locations. When the image is redeployed, the single file is restored to the multiple locations again. 

It is "non-destructive." This is important to consider. When Ghost and other products put their image on the target drive, they destroy the data that currently exists on it.  ImageX just "overlays" the existing data.  That means that to do a truly "fresh" reimage, you must first ensure your disk/partition has been formatted before putting your ImageX image back. In some cases there might be benefits to not doing a format first and just putting the image back.

ImageX supports three compression formats; Fast, Normal (none), and Maximum. As with most compressions of images, time to capture an image increases as compression is higher.

Finally, you can mount an ImageX image file, add and remove files from it, and (with Vista) even inject drives and patch updates directly into the image.

That last thing is really cool!  Currently with most all imaging solutions, you build a "source" pc, load the patches, install your software, tweak it out, run Sysprep then capture an image.  If you need to go back and add more system updates or drivers, you then have to rebuild your source pc with the updates, re-run Sysprep and recapture the image.  With ImageX (for Vista images) you can just work with the image file and continue to maintain it without going back to the source computer. Neat!

It excludes certain system files from the image automatically: recycler, system volume information, pagefile, hiberfile...etc.

You can "span" an ImageX image file across several CD's.

And it is free..assuming you have included it on a copy of a Windows PE 2.0 boot-disk.

Limitations of ImageX

It's not a perfect solution.

You can only use Microsoft's Windows Image (.wim) files with ImageX.

You can only "mount" images in Windows ImageX from XP SP2, Server 2003 and Vista systems. To read/write them you must mount them on an NTFS formatted partition.

You can captures and apply images for any version of Vista, Server 2003, XP, or 2000 Pro system.

You must first use Diskpart and Format utilities to prep a drive/partition prior to restoring an image and if you use Sysprep first, the image must be deployed to the same volume location as the the original.

It is command line based. (We will get around that in a just a bit with the introduction of GImageX.)

Getting ImageX

To get ImageX you must first build a WinPE 2.0 disk.

I've covered the process, ITsVISTA has covered the process, and Svrops has covered the process.

Basically, download the WAIK and install it on your XP or Vista system. Then run the special command-line tool.  Copy the needed source files to the build-folder on your NTFS partition, copy the ImageX utility to your build-folder, make your boot-image with the Oscdimg tool included, then burn the resulting ISO to CD.  It's a bit more detailed than that, but not by much. 

Go read the posts referenced and it should be pretty easy to do.

Using ImageX - Capture Basics

Prep your target Windows machine first by getting it patched and set up just the way you want it.  Delete any unneeded files/folders, run a defrag session, empty the browser cache and any temp folder contents, etc.  I recommend running Sysprep first to tuck your source station into bed.

Next decide where you plan to capture your image to.  This could be a network share, a USB external drive, or maybe another drive/partition on the same system.

Boot the system with your Win PE 2.0 boot disk.

Once up, type:  net use <drive letter to map>  \\Servername\location

With the specifics entered for your server if you are attempting to map a network drive then image to a network share.

If you are using a portable external drive, you can skip that step.  Just be sure you have correctly identified what drive letter the device is mapped to. Win PE 2.0 seems to be very good about picking up and mounting USB storage devices.

To capture the image, type: imagex /compress maximum /capture c:\ z:\images\image.wim "image name"

You can leave off the "/compress maximum" if you want the image at "normal" level or use "/compress fast" for a larger, but faster image capture process.

You must specify the specific full capture drive letter and path to where you want to put the image. I used "z:\images\" as my example, yours will differ.

You can also add the /check and/or /verify switches as well, though these will increase image capture times.

You can name the .wim file whatever you want.

The final part "image name" (with quotation marks) identifies this particular image file in the image.wim image file.  Does that make sense?  See, one .wim file can actually contain multiple images!  How cool is that?

Please review these excellent posts for more examples and details on the ImageX capture process:

• Shell Blog : Part 3 Dr. Unattend: Sysprep and ImageX or how to capture an image by its toe

• The Lazy Admin : Capturing a custom Image using ImageX and a Generic WinPE Disk

• Redmond | Column: The ImageX X-Files - Contains an ImageX cheat sheet.

• Newsletter #61 February 2007 (ImageX and WIM files) - Mark Minasi's Windows Networking Tech Page

Using ImageX - Deployment Basics 

First you must be sure your target drive/partition is prepped.

Here is a "gotcha" for image deployments for ImageX. 

With Ghost, you (usually) just perform a disk-to-disk copy (all) or maybe a partition-to-partition copy and move on. You don't normally think about formatting the disk and/or the partitions.  With ImageX you must, as it overlays the image on the drive/partition.  If stuff is already there and not removed, the image overlays it and leave all the non-matching original remnants behind.

Likewise, you can't take a "naked" and unformatted drive/partition and just put the ImageX image back on it.

So, boot your target system with your Win PE 2.0 disk.

Next, either partition the drive accordingly (if "naked") or format the boot partition.

A basic command would be something like this example: format c: /fs:ntfs

I've seen several mentions that say a "/q" quick format will work fine, and others that say you must do a full format after creating it with diskpart.

• Microsoft Windows XP - DiskPart - Microsoft

• Download details: DiskPart.exe - Microsoft

• A Description of the Diskpart Command-Line Utility - Microsoft

• DiskPart Command-Line Options - Microsoft

• PC Today Article - Diskpart

• Microsoft Windows XP - Format - Microsoft

Once your target drive and partition have been prepped, put the image back down.

Map to the network drive just like we previously covered, or use your external USB drive or disk media.

Run the following command: imagex /apply z:\images\image.wim 1 c:

You may want to add the extra option /verify at the end to verify your image laydown...just remember that that adds time to the deployment.

Note the "1" we used.  This means to use the 1st image in the .wim file.  If you have multiple images in a single .wim file you will need to know which "index number" image you want and use that number accordingly.

Once done, remove the Win PE 2.0 disk, reboot the system, and your new image should appear.

Because of the imaging technique, the image restoration to the target pc should be much faster than Ghost or many other sector-based imaging applications. This will depend on the hardware and image size so your results may vary.

Here are some more fantastic posts that provide great examples and details on the ImageX image deployment process:

• The Lazy Admin : Capturing a custom Image using ImageX and a Generic WinPE Disk
• Deploying Vista with Sysprep and Imagex - Svrops

• PC Deployment with ImageX - O'REILLY WindowsDevCenter

• HowTo: Using Windows PE 2.0 and Image X to deploy Windows XP Embedded - Brad Combs eMVP

• Deploying A WIM Image With ImageX - User Suck blog

Using ImageX - Advanced WIM Manipulations

As I alluded to earlier, you can do some cool things with ImageX .wim files.  I'm still a bit unclear after reading all the material.  Some seem to suggest you can mount and change XP, Server 2003, Vista, and Windows 2000 Pro .wim and modify them, other places seem to restrict the mounting and modifications to just Vista .wim images. Some sources suggest that only on a Vista system can you mount .wim files, others that  XP, Server 2003, Vista can handle it (assuming the ImageX .wim filter driver is loaded on the system).

I think I have some experimenting to do... the meantime here are some advanced tips.

A single .WIM file can actually contain multiple images in it.

• How to mount a WIM image with ImageX in Windows Vista - 4sysops

You can add/remove files to certain .WIM images. (...but not actually "install/remove" programs and configuration settings.)

You can inject drivers into a .WIM image file.

• Newsletter #59 January 2007 (Meet Windows PE) - Mark Minasi's Windows Networking Tech Page

You can install "hotfix patches" into a Vista .WIM image file.

• Newsletter #65 September2007: Adding Hotfixes to Images The Easy (and Free) Way - Mark Minasi's Windows Networking Tech Page

Welcome to GImageX - a GUI Front-End

GImageX is a freeware tool that places a GUI front-end on the command-line utility that ImageX is.

This makes it much easier for non command-line folks to use the tool to capture your WIM images, mount the images, and deploy the images.

Just be sure to copy GImageX.exe and the ImageX files (from WAIK) into a directory during your WinPE 2.0 building process.  That way it will be ready to use. 

Then run GImageX and have at it!

ImageX Command Line Basics

There are a wealth of options that come with ImageX.  However, like most command line tools, they are hard to identify without seeing them all broken down first.  I found the following link useful in understanding the features and options ImageX operates under. ImageX Command-Line Options - TechNet

The following points from that article are important to consider:

To modify your volume images, you must install the Windows Imaging File System Filter (WIM FS Filter) driver on a computer running Windows XP with Service Pack 2 (SP2), Windows Server 2003 with Service Pack 1 (SP1), or Windows Vista. Installing the WIM FS Filter driver enables you to mount a .wim file as if it were a directory and to browse, copy, paste, and edit the volume images from a file management tool, such as Windows Explorer, without extracting or recreating the image.

imagex /apply - Applies a volume image to a specified drive.

Important: You must include the parent directory for the /apply option. Otherwise, when the image is applied, it will overwrite everything in that location. For example, if you apply the image to drive C, the /apply option overwrites everything that exists in drive C with your image files.

/check

Checks the integrity of the .wim file. If not provided, existing checks are removed.

/verify

Enables file resource verification by checking for errors and file duplication.

imagex /capture - Captures a volume image from a drive to a new .wim file. Captured directories include all subfolders and data. You cannot capture an empty directory. A directory must contain at least one file.

/compress [maximum | fast | none]

Specifies the type of compression used for the initial capture operation. The maximum option provides the best compression but takes the longest time to capture the image. The fast option provides faster image compression but the resulting files are larger than those compressed using maximum. This is also the default compression type, used if you leave this parameter blank. The none option does not compress the captured image at all.

While the compression type that you choose affects the capture time, it only slightly affects the apply time.

/verify

Enables file resource verification by checking for errors and file duplication.

The /verify option will affect the overall capture time. During a capture operation, the progress bar indicates the status of the capture operation only, not the verify operation. When the capture is complete, the verify process begins. This process takes time even though the progress bar shows 100 percent.

imagex /mount - Mounts a .wim file from Microsoft Windows XP with Service Pack 2 (SP2), Microsoft Windows Server 2003 with Service Pack 1 (SP1), or Windows Vista with read-only permission to a specified directory.

imagex /mountrw - Mounts a .wim file from Microsoft Windows XP with Service Pack 2 (SP2), Microsoft Windows Server 2003 with Service Pack 1 (SP1), or Windows Vista with read/write permission to a specified directory.
Once the file is mounted, you can view and modify all the information contained in the directory.

imagex /unmount - Unmounts the mounted image from a specified directory. If you use the /unmount option without the /commit option, your changes will be discarded. To be able to save your changes, you must mount the image by using the /mountrw option and use the /commit option when unmounting the image.

Quality Linkage for ImageX

• Free disk cloning for Windows OS: Microsoft AIK and ImageX - Geeks Are Sexy 

• Windows Vista Disk Imaging with ImageX and Windows Imaging Format (WIM) - TechNet

• Off Campus : Use ImageX without installing WAIK

• How ImageX Works - TechNet

• The Desktop Files: The Power User's Guide to WIM and ImageX -- TechNet Magazine, October 2007

• Newsletter #62 Late February 2007 (Sysprep and Sysprep Answer Files) - Mark Minasi's Windows Networking Tech Page

• Part 4 Dr. Unattend: Programmatically manipulating unattend answer files - Shell Blog

Good luck and maybe Microsoft's X-Zone utility known as ImageX may help you in your image deployments.

--Claus