3 ms·

Just a note, ImageX is superceded by DISM, and both of them utterly fail at keeping extended attributes (despite the command line flags). So what you restore wo

Just a note, ImageX is superceded by DISM, and both of them utterly fail at keeping extended attributes (despite the command line flags). So what you restore won't be the same thing as what you backed up. (I don't know of any tool that handles all of EAs, reparse points, etc. correctly.)

acqq 8y ago
Do you have any examples of failures? I’d like to know what specifically is not working.
- mehrdadn 8y ago
  Extended attributes? That is the specific example. Create a file with EAs and see if you can back up and restore it with the same EAs.
  - acqq 8y ago
    Where are the NTFS EA used, if that's what you're writing about? I can't find anything except: https://flatcap.org/linux-ntfs/ntfs/attributes/ea.html https://flatcap.org/linux-ntfs/ntfs/attributes/ea.html "Used to implement the HPFS extended attribute under NTFS." Is your complaint is that the tools that are used to make the image of the installation files of the Windows don't include that? I assume that $EA entries don't exist in the installation files of Windows, for which the DSIM tool is used (and it's surely not an universal backup tool). And how do you read or write these? And what do you use them for? I was able to find only ZwSetEaFile and ZwQueryEaFile which are documented for kernel-mode drivers? Are there any plain user-level API's? https://attack.mitre.org/techniques/T1096/ https://attack.mitre.org/techniques/T1096/ I also find: "it may (be) worth noting that Windows does not contain any api that can be used to remove extended attributes."
    - mehrdadn 8y ago
      WSL uses them for one (so good luck backing up WSL installations) https://blogs.msdn.microsoft.com/wsl/2016/06/15/wsl-file-system-support/ https://blogs.msdn.microsoft.com/wsl/2016/06/15/wsl-file-sys... Other stuff does too, e.g. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/kernel-extended-attributes https://docs.microsoft.com/en-us/windows-hardware/drivers/if... Those are user-level APIs as well, though usually called via NtQueryEaFile and NtSetEaFile. And (part of) my complaint is that DISM's /EA flag is broken.

acqq 8y ago

Do you have any examples of failures? I’d like to know what specifically is not working.

mehrdadn 8y ago
Extended attributes? That is the specific example. Create a file with EAs and see if you can back up and restore it with the same EAs.
- acqq 8y ago
  Where are the NTFS EA used, if that's what you're writing about? I can't find anything except: https://flatcap.org/linux-ntfs/ntfs/attributes/ea.html https://flatcap.org/linux-ntfs/ntfs/attributes/ea.html "Used to implement the HPFS extended attribute under NTFS." Is your complaint is that the tools that are used to make the image of the installation files of the Windows don't include that? I assume that $EA entries don't exist in the installation files of Windows, for which the DSIM tool is used (and it's surely not an universal backup tool). And how do you read or write these? And what do you use them for? I was able to find only ZwSetEaFile and ZwQueryEaFile which are documented for kernel-mode drivers? Are there any plain user-level API's? https://attack.mitre.org/techniques/T1096/ https://attack.mitre.org/techniques/T1096/ I also find: "it may (be) worth noting that Windows does not contain any api that can be used to remove extended attributes."
  - mehrdadn 8y ago
    WSL uses them for one (so good luck backing up WSL installations) https://blogs.msdn.microsoft.com/wsl/2016/06/15/wsl-file-system-support/ https://blogs.msdn.microsoft.com/wsl/2016/06/15/wsl-file-sys... Other stuff does too, e.g. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/kernel-extended-attributes https://docs.microsoft.com/en-us/windows-hardware/drivers/if... Those are user-level APIs as well, though usually called via NtQueryEaFile and NtSetEaFile. And (part of) my complaint is that DISM's /EA flag is broken.