1025 replies to this topic

[alacran]

Only for the record not really-really (on NTFS).

If they are below 700 bytes or so (it depends on their filename , that usually is very loong for those files) they will take no storage clusters on a 512 bytes/sector disk, as they will be resident in the $MFT, JFYI:

https://www.forensic...-resident-data/

 

https://www.forensic...a/#post-6565939

 

On a 4 K disk the limit is around 3700 bytes.

 

Wonko

 

Yes, you are right, I already knew some little files are stored directly on $MFT, but not the approximate size limit for this.

 

approximate because as I read in your links, different tools report different size limit.

 

alacran

[alacran]

But thinking a little more about the previous comments:

 

Assuming for a moment those little files are stored on $MFT:

 

Does $MFT shrink if the little files are deleted? If not, there is no sense in delete them.

 

alacran

[Wonko the Sane]

No, approximate because the amount of characters in the file name is part of the available space.

 

The most that can be stored in a "normal" 1024 bytes $MFT (on 512 bytes/sector) is EXACTLY 744 bytes with a filename consisting of a single character and no extension, I posted a formula to calculate this exactly in the given link.

 

Additionally, the exact way the file is created may (or may not) lower the limit by 8 bytes. 

 

Same goes for 4K $MFT records (on 4 KB/sector) the EXACT maximum is 3776 bytes, but it will be normally a little less.

 

The $MFT won't shrink, of course, its size is pre-determined when you create (format) the NTFS filesystem and is usually (largely) enough.

 

But it will grow if needed, so, if you create on purpose a smallish $MFT, then fill it with a zillion little files (no matter if they become $MFT resident) and you later delete them the $MFT will grow and remain larger.

 

If you want to have the smallest possible NTFS, you can create a very small volume, enlarge it to the desired size, then copy to it all the files from a volume where they were already pruned/deleted.

 

Like it is done to have a contiguous-contiguous filesystem extent for large files:

http://reboot.pro/to...disk-emulation/

 

This way the pre-created $MFT won't be large enough to index all the files (resident or not resident) and it will grow little by little to the "minimum needed" size.

 

Depending on the overall size of the volume, this may well result in a noticeable difference in the available space, but most probably also compression will be (slightly) better.

 

Wonko

[antonino61]

then it is 6 of 1 and a 1/2 dozen of the other

[wimb]

Dear Wimb, 

it works fine, but for 2 pieces of software, for which I have to restore the original manifests subfolder. I think I have already posted this minor perplexity weeks ago. I still don't know which files from the original manifests the system needs in order for the software to work back again, otherwise I would add only those files. is there anyway to determine that before copying back the whole manifests subfolder?

 

What are these 2 pieces of Software and can you give Download Links  ?

[antonino61]

FireStorm_V3.0.0.011E.exe and fifa15.exe - i guess it has to do with directx api

[alacran]

First is and optional program to overclock GForce graphic cards, the second is a game from 2015, none of them are critical software.

 

I hope your App to make hotcakes on your PC loads fine. If not I will be very worry.

 

alacran

[antonino61]

temps are fine here, no hotcakes. the software is not only for overclocking, but also for cooling, by pushing fans up to max.

[wimb]

Update Manual VHD_WIMBOOT.pdf regarding use of Firewall App Blocker and WinSxS_Reduce_Trusted

 

Manual:

[antonino61]

any integration from the brute-force-shrinking department? I have been implementing it quite extensively in the past few weeks, and have done so on practically all vhd's I have been able to find lying here and there on my drives. it has proven effective in terms of speed, not so much in terms of saved space, probably because of the limitations wonko and alacrán are disclosing.

[wimb]

any integration from the brute-force-shrinking department?

 

No, since by removal of SysWOW64 Or Microsoft.NET folders Or Reduced DriverStore

 

which really could save space but we would loose functionality .....

 

It was decided to use Full Install of Win10x64 without any chopping and

 

to use Optionally WinSxS_Reduce_Trusted as a sepate tool to reduce the WinSxS folder in case of VHD used as FILEDISK.

[antonino61]

so I am going on alone until otherwise decided. what else can I do? btw, why winreduce only if using vhd as filedisk? I also winreduce for using vhd as ramdisk, as wimboot, as everything.

[alacran]

That's why WinSxS_Reduce_Trusted is a sepate tool, you can decide when and where use it, the reduction process can be applied on any installation you want, of course it is good to apply it before the Wimboot mode re-capture to reduce the WIM file size, especially if you latter will make a Wimboot mode installation, but on Normal or Compact installed systems can be used after the installation for testing pourposes or if the user wants to keep his WIM not reduced (just in case).

 

Wimboot mode capture or re-capture makes also a reduction which can be controled by the user by means of editing the WimBootCompress.ini [ExclusionList].

 

Then any files/folders added by the user to [ExclusionList] section will not be included on the new WIM file (no matter the consequences), edit it wisely to avoid future troubles after apply the new WIM on a new installation.

 

In fact it is as a chopping by brute force.

 

During Wimboot mode capture almost if not all log files created by the OS itself, are also excluded always, by means of wimlib-imagex and WimBootCompress.ini [ExclusionList].

As a example all *.evtx files on C:\Windows\System32\winevt\Logs are not captured.

Finally and to simplify:

When you re-apply (in any mode) from a Wimboot mode captured WIM. The OS will be installed without all old logs and it will create new logs as on a first brand new installation.

 

EDIT: I think it is not a bad idea to start a new topic to share our test made chopping the OS by means of WimBootCompress.ini [ExclusionList] or any other tool.

 

EDIT2: See new topic: http://reboot.pro/to...-oss-footprint/

 

alacran

[wimb]

 

Update VHD_WIMBOOT Version 3.4

 

- Improved - determine needed Free Size for Capture of WIM file by using UsedSize of VHD file

- create always Grub4dos menu for VHD located on MBR partition for booting  from RAMDISK using SVBus driver

 

 

Download: from GitHub VHD_WIMBOOT-34  

 

 

[antonino61]

thanx wimb, I will try this out too.

[alacran]

@ wimb

 

Maybe is not a bad idea if you intoduce an optional pause check box on the program, before unmounting the VHD. Or to just let the VHD mounted, and allow the program to finish.

 

This will allow the user to copy some additional files/folders or run a command using Win_Reduce_Trusted.

 

I know this can be missused, and some non advanced users may try to make a full reduction before finish the first installation booting from the VHD, but a tool tip with a warning in big RED LETTERS may solve this potential cause of troubles.

 

Hope you like the idea my friend as I think it could be very useful.

 

alacran

[antonino61]

 

 

Update VHD_WIMBOOT Version 3.4

 

- Improved - determine needed Free Size for Capture of WIM file by using UsedSize of VHD file

 

What does it mean? What was it like before and what is it like now?

[wimb]

Update VHD_WIMBOOT Version 3.8

 

Download:  from GitHub VHD_WIMBOOT-38 and Win_Reduce_Trusted-38 to make Mini 7/8/10 x64 in VHD with UsedSize about 2 GB

 

Manual:  VHD_WIMBOOT.pdf

 

- Modified  base_winsxs_2.cmd of cdob  so that hardlinks are created for \Windows\WinSxS\*_microsoft-windows-servicingstack*
  sevicingstack is needed for support of Adding Drivers by means of Dism.exe
- Add Drivers 7/8/10 in Offline Windows by using Dism.exe -  Not suitable to Install SVBus Driver for booting from RAMDISK

 

  Boot in MBR mode for Install of SVBus driver - use R-mouse menu to Run as admin file instx64.exe of SVBus bin folder

 

== 

[antonino61]

thanx wimb, now trying them all, will let u know in due course.

[antonino61]

My dear wimb, 

u must be a phenomenon!!!  u have managed to shrink even windows 7 by 1gb I mean, even though wimboot_38 says no (not enough space etc.). it works fine. now let us see if I can strip off anymore thru winreduce. will let u know in a bit.

[antonino61]

windows 7 ok, both as full vhd (shrunk) and as wimboot combo (wim+vhd) - not so much gained in the latter case, though. other experiment results will follow.

[wimb]

VHD_WIMBOOT and Win_Reduce_Trusted  -  Capture LZX WIM and Apply Compact LZX in VHD

 

Mini 7x64 in VHD            Mini 8x64 in VHD          Mini 10x64 in VHD

UsedSize = 1.82 GB        UsedSize = 2.35 GB       UsedSize = 1.79 GB

WIM = 1.23 GB                WIM = 1.51 GB                WIM = 1.19 GB

 

   ===      ===   

 

and UEFI Grub2 Or UEFI Grub4dos booting Mini 7/8/10 x64 in VHD MBR(Active FAT32 100 MB + NTFS)  booting from RAMDISK using signed SVBus driver

 

  ===     ===    == == ==

 

 

How to make Compact and Mini 7/8/10 VHD

 

1. WinNTSetup - Fresh Install in 25 GB VHD using Win10x64 ISO from TechBench

2. VHD_WIMBOOT - Capture WimBoot LZX and Apply in Compact LZX mode in VHD 

3. Mount VHD with doubble-click and use Win_Reduce_Trusted on Offline Windows

- Reduce in 1 minute gives Mini 10x64 VHD UsedSize = 1.79 GB

- Capture WimBoot LZX WIM = 1.19 GB and Apply Compact LZX in 3.9 GB VHD

4. Boot with 3.9 GB VHD - Always use the supplied Firewall App Blocker and Enable WhiteList to Allow Internet Browser only

- This is the easiest way to block unwanted internet traffic including Windows Update and prevents the growth of Used Size inside VHD

 

Win 7/8 requires to install wofadk.sys driver as done by WinNTSetup using mode Compact:NONE - Win7 use Enable native USB Boot

Boot - USB Fix 7/8 in makebt\registry_tweaks gives USB Controller Service setting Start=0 and BootFlags=4 and Group=System Bus Extender

WinNTSetup - Add missing Windows 7 USB Controller Services in Tools\Win7USBBoot.ini

More Info given by cdob and info to get USB3 drivers

 

Manual:  VHD_WIMBOOT.pdf

 

[antonino61]

which is what I am doing, I am still at win7; trying win81, and then win10. what I find hard to understand is the add drivers kinda thing, unless u meant to confine it to win10 only. pls allow for my having other stuff to keep working, so they can never be mini in the square sense of the word in my case. 

My win7 so far is 3.9gb (full vhd, lz4'd to 2.6gb) and/or 2.5gb wim + 1gb vhd (139mb .gz, which I am typing from). 

your win8.1 values are proportional to what mine will be, I figure.

[antonino61]

no problem from the win81 department either, the only difference being my smaller figures in terms of wim(2.5gb)+vhd(235mb used space) combo (which I can bake ok even with the win10 wimbootcompress.ini. it boots fine and works like a charm. win7 wanted your last wimbootcompress.ini to boot (bigger wim and used space on the vhd some 600megs (about 3 times as much)) now trying windows10. will let u know in a bit. 

[wimb]

Update VHD_WIMBOOT Version 4.0

 

Download:  from GitHub VHD_WIMBOOT-40 and Win_Reduce_Trusted-40 to make Mini 7/8/10 x64 in VHD with UsedSize about 2 GB

 

Manual:  VHD_WIMBOOT.pdf

 

- Update USB 7/8 Fix - Scan Offline Registry for USB3 Services as listed in file makebt\USB_78_Tweaks\Win78_USB3_Boot.ini

  When Service for Installed USB3 driver is found then make USB Controller Service setting Start=0 and BootFlags=4 and Group=System Bus Extender

  In this way more hardware is supported for booting Win 7/8 VHD from USB

 

More Info on booting Win7/8 from USB given by cdob and info on how to get USB3 drivers

 

Win78_USB3_Boot.ini

 

Spoiler

[comments]
credits=cdob
topic=http://reboot.pro/topic/21231-can-w7-be-booted-from-usb30-port/#entry200511
USB3_drivers=https://www.win-raid.com/t834f25-USB-Drivers-original-and-modded.html

[options]
Bootflags=1
boot_zero=1

[services]
amdxhc
amdhub30
amdhub31
amdxhc31
asmtxhci
asmthub3
EtronHUB3
EtronSTOR
EtronXHCI
FLxHCIh
FLxHCIc
iusb3hcs
iusb3xhc
iusb3hub
iusb3adp
nusb3hub
nusb3xhc
rusb3hub
rusb3xhc
tihub3
tixhci
VUSB3HUB
xhcdrv
USBHUB3
USBXHCI
UCX01000
UASPStor