Use DISM to make old school Ghost like imaging!!!

As probably a lot of other goodies, the news passed under the radar, but yes, you can do old-school Ghost like imaging since release 1709 of windows 10 and ADK.

Why did Microsoft came back to a sector-based capture technology? Speed!!!

As you can guess, they didn’t say more about it or even provide any metrics, so I thought that it could be interesting to see if old new technology is valuable or not.

Introducing FFU(Full Flash Update)

As WIM file format was for file-based image capture, FFU is all about sector-based.

With WIM image you capture partition, with FFU you are capturing disk (one at a time).

With WIM image you append files to a formatted partition, with FFU you overwrite and clean the whole disk (You’ve been warned!!).

FFU can be used from Windows starting with 1709 or from WinPE 10 starting with 1803 and above.

FFU images are natively compressed but are way bigger than what you are used to with WIM. My first attempt was done on my own windows installation, Original disk size was 47.76 GB, Captured FFU file ended up at  36.95 GB.

I need to mention that the test capture was done without much preparation: I avoided sysprep (don’t do that, this is part of how you should use FFU !). I didn’t cleaned Windows from swap file and hibernation which should be a good starting point to decrease image size.

FFU images can be split if and only they are saved uncompressed. (Add /Compress:None parameter to your DISM’s capture command line). Split parts are saved under SFU extension.

Destination disk must at least be sized equal to source disk capture.

Bitlocked and Shadow copy enabled disk are not supported (Be aware that I wrote ‘not supported’ which doesn’t mean that it doesn’t works… but I had no time to test, try on your own and please report…)

FFU images can be generated using command line tool DISM or using WICD.

How to

First you need to login to the machine you want to capture and sysprep it is using command %windir%\system32\sysprep\sysprep.exe /generalize /oobe /Shutdown

Note that this step could end up being unnecessary, If you simply  want to backup a computer with users account and associated settings. If you need a cleaned up from profil computer, go syprep! Simple as that!

After shutdown, plug in a USB stick loaded with a bootable Windows PE and start up the machine. If you are using an MDT boot image press F8 when the wizard appears to launch a command prompt.

The FFU capture is done by using the following command: Dism /Capture-ffu /imagefile=F:\Win10.ffu /capturedrive=\\.\PhysicalDrive0 /name:Disk0-Win10 /description:”Win 10 FFU Test”. Just take care that the destination disk have enough space to host the FFU image!

Once the capture is done you can wipe your disk or whatever…

The restoration is as simple, using the command: Dism /Apply-ffu /ImageFile=W:\Win10.ffu /ApplyDrive:\\.\PhysicalDrive0. No need to prepare disk before applying image, as formatting is embedded in the FFU file.

Also remember the limitation of the technology: if the disk size is larger than the size of the FFU, the remaining space will stay unallocated and unformatted !

How much

So now that you know how to use it, let’s raise THE question: Is it faster or what?

Before going forward, a few words about the test’s environment: everything was deployed over a crossed LAN cable to a fast Latitude 7490 laptop (512 GB NVMe drive, 8th Gen Core I7 with 8 logical cores, 16 GB RAM). Tests With release 1903 were done using a bare metal OS with a sysprep. so, the deployment time includes the Oobe pass. Tests on 1803 custom images where done without sysprep on my own production machine (this is the reason why i didn’t used sysprep). The OS is backed with a few apps like SCCM client, Office 365, 7zip and Notepad++.

Of couse, you should stick to the Windows release number to if you want make valuable comparisons.

Some MDT scripts were modified to enable FFU support, they will be made available in my next blog post I hope...

Enough blabla… numbers:

Conclusion

Oh boy… that was fast… i’m really amazed by this new toy. Even if the testing was not done at scale, I can say with confidence that it’s faster than WIM format (Yeeahh)!

Now it’s up to you to find meaningful use cases. It can of course be used if speed is a concern, but it can also be used as a free backup solution! Just keep in mind that FFU is a bit more than just a Ghost solution: With the help of MDT, you can “Ghost” with sysprep, you can add drivers, packages or application on the fly, you can run scripts… it’s really the best of both world!

If you want to ear more about the MDT integration, come back shortly as it should not be long before I release the MDT addons to support FFU.

References:

https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/capture-and-apply-windows-system-and-recovery-partitions

https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/wim-vs-ffu-image-file-formats

https://docs.microsoft.com/fr-fr/windows-hardware/manufacture/desktop/deploy-windows-using-full-flash-update--ffu