Notes on installing Windows

  1. Programs to examine registry hive files:

    • Perl Parse::Win32Registry module and regdump.pl (Debian: libparse-win32registry-perl).

    • hivex (Debian: libhivex-bin)

  2. Moving an NTFS partition:

    • Tools available on Ubuntu LiveCD and on GParted LiveCD

    • Steps:

      1. Shrink filesystem within partition with ntfsresize (−s to specify size in bytes which will be rounded down to cluster size).

      2. Create new partition (type 7).

        • sfdisk can:

          • edit a single partition (−N2);

          • align partition to sectors (−uS) or cylinders (−uC);

          • write CHS address using given geometry (−C and −H).

        • Should align to 128 sectors (64 kB).

      3. Copy filesystem data with dd or ntfsclone.

      4. Enlarge filesystem within partition with ntfsresize (no −s to use entire partition, −f to run even though a check is scheduled by the previous resizing).

      5. The sector address of the partition is recorded in its first sector in little-endian 4 bytes at offset 0x1c. This can be patched:

        • by gparted automatically when it is doing these steps;

        • by hand (dd if=/dev/sda2 count=1 | xxd >sector; vi sector; xxd -r sector >/dev/sda2);

        • by ms-sys automatically:

          • patch src/main.c to remove call to write_partition_physical_disk_drive_id because it overwrites something important;

          • compile with make on Ubuntu LiveCD;

          • bin/ms-sys -p /dev/sda2

        • by TestDisk (download Linux binary) using its boot sector recovery feature (also replaces MFT addresses by scanning the filesystem).

  3. Booting a moved Vista partition:

    • The boot sector loads some more sectors (\$Boot), which then loads \bootmgr, which uses Boot Configuration Data in \Boot\BCD.

    • BCD must be updated after a partition move, otherwise booting results in an instant system reboot.

      • If the sector address of the partition still points to the old location of the partition, booting instead stops on file \Boot\BCD with status 0xc0000225.

      • Running chkdsk from Windows doesn't help (but it does update the backup boot sector).

    • Updating the BCD:

      • The startup repair feature of a Vista installation disc (any version) fixes it.

      • Manually editing:

        • The BCD file is in registry hive format.

        • Objects\{*}\Elements\11000001 binary values contain pointers to the partition. The byte address of the partition is in little-endian 8 bytes (maybe more or fewer) is at offset 0x20 of these values.

          • The values also contain other information identifying the partition, such as the 4-byte disk signature from MBR offset 0x1b8. This shouldn't change if the partition is simply moved on the disk.

        • Replace all instances (e.g. 6 instances, aligned to 4 mod 8 bytes) of the old byte address with the new byte address.

        • Check that the correct values, and all values, were replaced (diff output of regdump.pl -r -v).

  4. Booting with GRUB:

    • GRUB 2 can find \bootmgr, but cannot chainload it (“invalid signature”). Forcing chainloading results in a system hang.

    • chainload +1 works, even if the partition is at the end of the disk.