Frank Slootweg wrote:
> ...winston <winstonmvp@gmail.com> wrote:
>> Frank Slootweg wrote:
>>> ...winston <winstonmvp@gmail.com> wrote:
>>>> Paul wrote:
>>>>> and I'd already
>>>>> done my Patch Tuesday ceremonies.
>>>>>
>>>>>    Paul
>>>>>
>>>>
>>>> p.s.
>>>>
>>>> w/r to Patch Tuesday(May updates)
>>>> Update your boot or Iso media after applying the May updates.
>>>> Update your backup images
>>>> - necessary due to staged implementation(May, June, 1st QTR 2024) of
>>>> Secure Boot mitigation/revocations
>>>>
>>>> See CVE-2023-24932 and KB5025885
>>>>
>>>> Windows 11 Software Download site for MCT(for creating USB/DVD/ISO) and
>>>> the optional ISO file option all provide current media with Windows
>>>> update released on May 9(i.e. May's Patch Tuesday updates)
>>>>
>>>> Once the revocations for Secure Boot mitigation are pushed/deployed,
>>>> media and images created earlier than the current available(with the May
>>>> updates) will no longer function.
>>>
>>> <rewind_repeat>
>>>
>>>> Update your backup images
>>>
>>> </rewind_repeat>
>>>
>>> "backup images" like those made by Macrium Reflect (Free), etc.?
>>>
>>> If so, backup images of *which* partition(s)? C: or the non-C:
>>> partitions or both? (I have only C:, no other partitions with drive
>>> letters.)
>>>
>>
>> Yes, images created prior to installing the May 2023 Update on Windows
>> 11(10) 22H2, 21H2 need to be updated.
>>
>> Which partition?
>> The general rule when backing up Win11/Win10 on UEFI systems with GPT
>> created partitions:
>> - Image should contain the Four(4) GPT partitions(System[aka EFI],
>> MSR, Windows, Recovery)
>>
>> All my devices(Win11 Pro 22H2 and Win10 Pro 22H2) use Macrium Reflect
>> and Acronis 2020(perpetual) for image creation.
>> e.g. when loading Macrium on a UEFI GPT device, all 4 of the partitions
>> are shown in the Macrium UI - thus I image all four(4).
>>
>> The reason for all 4, especially for this specific case, is once the
>> revocations are in-place(3rd phase/stage) the final impact will affect
>> 3 partitions(System(EFI), Windows, and Recovery)
>> - At this time, only the System and Windows is affected
>
> Thanks!
>
> I backed up the three non-C: partitions (System, MSR and Recovery)
> only once, under the assumption they wouldn't change over time.
>
> Apparently that assumption was wrong, so I will back them up again and
> at the next Full image backup, I will backup all four and keep it that
> way.
>
> BTW, my 'Recovery' partition - partition 4, the last one - has no
> label (like 'Recovery'). Is that normal? (Partition 1 has label 'SYSTEM'
> (uppercase), partition 2 has no label because it's 'Unformatted' and
> Partition 3 has label 'Windows'.)
>
There have been a couple of changes in the Win10/11 era where the System
and Recovery Partition were updated....more so with the latter, because
by design the Recovery partition has a unique characteristic in Windows
- Windows can increase it's size by carving out space from the Windows
partition(Note: this only applies when the Recovery partition is
right-adjacent to the Windows partition, if not rt-adjacent Windows will
recreate a new Recovery partition rt adjacent to the Windows partition
rendering the old Recovery partition useless and still present)
- Recovery partition is updated with each and every feature upgrade[1]

If looking in Disk Management, Recovery partition does not normally show
drive label or even letter(that's normal)

A label(if desired) can be added using 3rd party software(even free
versions) - like MiniTool Partition Wizard or EaseUS Partition Master.
Once a label is added, it will show up in Macrium and other imaging
software(and the partition software). It will, still, not show up in
Disk Management.
- Note: For free versions => install the free version of these, if
desired, not the trial version. I prefer MiniTool 12.8 and EaseUS PM
15.8 b/c I like the UI in those version vs. the later, more graphical,
more bloated available free versions.

One can use an admin Powershell or Command prompt to load Diskpart and
look at the disk(not drive) partitions.
In Diskpart you can use these commands
list disk
sel disk
list part
list vol

list disk shows all connected disks
sel disk selects the desired disk(0,1, etc)
- the System, MSR, Windows, Recovery is normally always on Disk 0(or
in some OEM and byo systems with multiple disks as Disk 1)
list part displays the partitions on the 'selected disk'
- one needs to select the disk for 'list part' to display partitions
- shows the type(not label) of partitions(e.g. Recovery)
List vol displays all volumes, drive letters(if assigned) and the labels

[1]Whenever I clean install Windows(11 or 10) I use diskpart to create
and size the partitions and specifically size the Recovery as 1 GB vs
the normal 500 GB - this imo, ensures it has enough space to
grow(increase size) without the need to carve out space from the o/s
partition. It also ensures the partitions are created in the correct
order(at one time Windows media did not locate the Recovery after the
Windows, that was fixed some time ago for both MCT and ISO current, and
freely available Win10/11 created media)

--
....w¡ñ§±¤ñ

[Context kept because of age. Please skip to the end.]

On May 19, ...winston <winstonmvp@gmail.com> wrote:
> Frank Slootweg wrote:
> > ...winston <winstonmvp@gmail.com> wrote:
> >> Frank Slootweg wrote:
> >>> ...winston <winstonmvp@gmail.com> wrote:
> >>>> Paul wrote:
> >>>>> and I'd already
> >>>>> done my Patch Tuesday ceremonies.
> >>>>>
> >>>>>    Paul
> >>>>>
> >>>>
> >>>> p.s.
> >>>>
> >>>> w/r to Patch Tuesday(May updates)
> >>>> Update your boot or Iso media after applying the May updates.
> >>>> Update your backup images
> >>>> - necessary due to staged implementation(May, June, 1st QTR 2024) of
> >>>> Secure Boot mitigation/revocations
> >>>>
> >>>> See CVE-2023-24932 and KB5025885
> >>>>
> >>>> Windows 11 Software Download site for MCT(for creating USB/DVD/ISO) and
> >>>> the optional ISO file option all provide current media with Windows
> >>>> update released on May 9(i.e. May's Patch Tuesday updates)
> >>>>
> >>>> Once the revocations for Secure Boot mitigation are pushed/deployed,
> >>>> media and images created earlier than the current available(with the May
> >>>> updates) will no longer function.
> >>>
> >>> <rewind_repeat>
> >>>
> >>>> Update your backup images
> >>>
> >>> </rewind_repeat>
> >>>
> >>> "backup images" like those made by Macrium Reflect (Free), etc.?
> >>>
> >>> If so, backup images of *which* partition(s)? C: or the non-C:
> >>> partitions or both? (I have only C:, no other partitions with drive
> >>> letters.)
> >>>
> >>
> >> Yes, images created prior to installing the May 2023 Update on Windows
> >> 11(10) 22H2, 21H2 need to be updated.
> >>
> >> Which partition?
> >> The general rule when backing up Win11/Win10 on UEFI systems with GPT
> >> created partitions:
> >> - Image should contain the Four(4) GPT partitions(System[aka EFI],
> >> MSR, Windows, Recovery)
> >>
> >> All my devices(Win11 Pro 22H2 and Win10 Pro 22H2) use Macrium Reflect
> >> and Acronis 2020(perpetual) for image creation.
> >> e.g. when loading Macrium on a UEFI GPT device, all 4 of the partitions
> >> are shown in the Macrium UI - thus I image all four(4).
> >>
> >> The reason for all 4, especially for this specific case, is once the
> >> revocations are in-place(3rd phase/stage) the final impact will affect
> >> 3 partitions(System(EFI), Windows, and Recovery)
> >> - At this time, only the System and Windows is affected
> >
> > Thanks!
> >
> > I backed up the three non-C: partitions (System, MSR and Recovery)
> > only once, under the assumption they wouldn't change over time.
> >
> > Apparently that assumption was wrong, so I will back them up again and
> > at the next Full image backup, I will backup all four and keep it that
> > way.
> >
> > BTW, my 'Recovery' partition - partition 4, the last one - has no
> > label (like 'Recovery'). Is that normal? (Partition 1 has label 'SYSTEM'
> > (uppercase), partition 2 has no label because it's 'Unformatted' and
> > Partition 3 has label 'Windows'.)
> >
> There have been a couple of changes in the Win10/11 era where the System
> and Recovery Partition were updated....more so with the latter, because
> by design the Recovery partition has a unique characteristic in Windows
> - Windows can increase it's size by carving out space from the Windows
> partition(Note: this only applies when the Recovery partition is
> right-adjacent to the Windows partition, if not rt-adjacent Windows will
> recreate a new Recovery partition rt adjacent to the Windows partition
> rendering the old Recovery partition useless and still present)
> - Recovery partition is updated with each and every feature upgrade[1]

I finally re-made the (Macrium Reflect Free) Image backup of the three
non-C: partitions.

I noticed that now the (image of the) Recovery Partition is (seems to
be?) completely empty, i.e. I can mount it, but File Explorer, DIR and
ATTRIB show no files or folders.

If my (02AUG2022, i.e pre-MAY2023) notes are correct, it used to
contain a single folder 'Recovery' with a single 3-byte file _CNBRP.FLG.

Why the difference and why is the partition empty/nearly-empty?

Should I worry?

FTR, Macrium says this about the partition:

4 - (None) Primary - NTFS 603.5 MB 693.0 MB

The others (non-C:) are:

1 - SYSTEM (None) Primary - FAT (LBA) 71.0 MB 260.0 MB
(Contains folder 'EFI' with subfolders.)

2 - (None) Primary - Unformatted 16.0 MB 16.0 MB

[...]

On 6/9/2023 2:01 PM, Frank Slootweg wrote:
> [Context kept because of age. Please skip to the end.]
>
> On May 19, ...winston <winstonmvp@gmail.com> wrote:
>> Frank Slootweg wrote:
>>> ...winston <winstonmvp@gmail.com> wrote:
>>>> Frank Slootweg wrote:
>>>>> ...winston <winstonmvp@gmail.com> wrote:
>>>>>> Paul wrote:
>>>>>>> and I'd already
>>>>>>> done my Patch Tuesday ceremonies.
>>>>>>>
>>>>>>>    Paul
>>>>>>>
>>>>>>
>>>>>> p.s.
>>>>>>
>>>>>> w/r to Patch Tuesday(May updates)
>>>>>> Update your boot or Iso media after applying the May updates.
>>>>>> Update your backup images
>>>>>> - necessary due to staged implementation(May, June, 1st QTR 2024) of
>>>>>> Secure Boot mitigation/revocations
>>>>>>
>>>>>> See CVE-2023-24932 and KB5025885
>>>>>>
>>>>>> Windows 11 Software Download site for MCT(for creating USB/DVD/ISO) and
>>>>>> the optional ISO file option all provide current media with Windows
>>>>>> update released on May 9(i.e. May's Patch Tuesday updates)
>>>>>>
>>>>>> Once the revocations for Secure Boot mitigation are pushed/deployed,
>>>>>> media and images created earlier than the current available(with the May
>>>>>> updates) will no longer function.
>>>>>
>>>>> <rewind_repeat>
>>>>>
>>>>>> Update your backup images
>>>>>
>>>>> </rewind_repeat>
>>>>>
>>>>> "backup images" like those made by Macrium Reflect (Free), etc.?
>>>>>
>>>>> If so, backup images of *which* partition(s)? C: or the non-C:
>>>>> partitions or both? (I have only C:, no other partitions with drive
>>>>> letters.)
>>>>>
>>>>
>>>> Yes, images created prior to installing the May 2023 Update on Windows
>>>> 11(10) 22H2, 21H2 need to be updated.
>>>>
>>>> Which partition?
>>>> The general rule when backing up Win11/Win10 on UEFI systems with GPT
>>>> created partitions:
>>>> - Image should contain the Four(4) GPT partitions(System[aka EFI],
>>>> MSR, Windows, Recovery)
>>>>
>>>> All my devices(Win11 Pro 22H2 and Win10 Pro 22H2) use Macrium Reflect
>>>> and Acronis 2020(perpetual) for image creation.
>>>> e.g. when loading Macrium on a UEFI GPT device, all 4 of the partitions
>>>> are shown in the Macrium UI - thus I image all four(4).
>>>>
>>>> The reason for all 4, especially for this specific case, is once the
>>>> revocations are in-place(3rd phase/stage) the final impact will affect
>>>> 3 partitions(System(EFI), Windows, and Recovery)
>>>> - At this time, only the System and Windows is affected
>>>
>>> Thanks!
>>>
>>> I backed up the three non-C: partitions (System, MSR and Recovery)
>>> only once, under the assumption they wouldn't change over time.
>>>
>>> Apparently that assumption was wrong, so I will back them up again and
>>> at the next Full image backup, I will backup all four and keep it that
>>> way.
>>>
>>> BTW, my 'Recovery' partition - partition 4, the last one - has no
>>> label (like 'Recovery'). Is that normal? (Partition 1 has label 'SYSTEM'
>>> (uppercase), partition 2 has no label because it's 'Unformatted' and
>>> Partition 3 has label 'Windows'.)
>>>
>> There have been a couple of changes in the Win10/11 era where the System
>> and Recovery Partition were updated....more so with the latter, because
>> by design the Recovery partition has a unique characteristic in Windows
>> - Windows can increase it's size by carving out space from the Windows
>> partition(Note: this only applies when the Recovery partition is
>> right-adjacent to the Windows partition, if not rt-adjacent Windows will
>> recreate a new Recovery partition rt adjacent to the Windows partition
>> rendering the old Recovery partition useless and still present)
>> - Recovery partition is updated with each and every feature upgrade[1]
>
> I finally re-made the (Macrium Reflect Free) Image backup of the three
> non-C: partitions.
>
> I noticed that now the (image of the) Recovery Partition is (seems to
> be?) completely empty, i.e. I can mount it, but File Explorer, DIR and
> ATTRIB show no files or folders.
>
> If my (02AUG2022, i.e pre-MAY2023) notes are correct, it used to
> contain a single folder 'Recovery' with a single 3-byte file _CNBRP.FLG.
>
> Why the difference and why is the partition empty/nearly-empty?
>
> Should I worry?
>
> FTR, Macrium says this about the partition:
>
> 4 - (None) Primary - NTFS 603.5 MB 693.0 MB
>
> The others (non-C:) are:
>
> 1 - SYSTEM (None) Primary - FAT (LBA) 71.0 MB 260.0 MB
> (Contains folder 'EFI' with subfolders.)
>
> 2 - (None) Primary - Unformatted 16.0 MB 16.0 MB
>
> [...]
>

(1) is EFS, the "system" partition used by UEFI. It can be
as small as 100MB. Linux does not like it to be 100MB and has
a different minimum size for it.

(2) in your example, is Microsoft Reserved, it is quite small, and
it has no file system inside it. Since it has no file system,
some utilities are not prepared to even move such a partition.
Macrium switches to "dd" mode to back that up. Macrium is not
defeated by such "items". Linux GParted on the other hand...

(4) is System Reserved and is sized to hold WinRE.wim.

With an Admin terminal, try

reagentc /info

and that will tell you whether the System Reserved is currently being
used for its WinRE.wim , or the WIM is coming from somewhere else.

If you have several System Reserved, the one "nearest" the right-hand-end
of the C: partition, that could be the "real" one. The others may be
part of supporting Windows.old rollback procedures on a failure.

If the C: partition is ever inaccessible (like, say, BitLocker issue
due to TPM resetting), that is when you want the WinRE.wim to be
somewhere other than C: . That can function as the Recovery Environment
when the OS can't or won't boot.

Paul

Paul <nospam@needed.invalid> wrote:
> On 6/9/2023 2:01 PM, Frank Slootweg wrote:
> > [Context kept because of age. Please skip to the end.]

[Lots deleted.]

> > I finally re-made the (Macrium Reflect Free) Image backup of the three
> > non-C: partitions.
> >
> > I noticed that now the (image of the) Recovery Partition is (seems to
> > be?) completely empty, i.e. I can mount it, but File Explorer, DIR and
> > ATTRIB show no files or folders.
> >
> > If my (02AUG2022, i.e pre-MAY2023) notes are correct, it used to
> > contain a single folder 'Recovery' with a single 3-byte file _CNBRP.FLG.
> >
> > Why the difference and why is the partition empty/nearly-empty?
> >
> > Should I worry?
> >
> > FTR, Macrium says this about the partition:
> >
> > 4 - (None) Primary - NTFS 603.5 MB 693.0 MB
> >
> > The others (non-C:) are:
> >
> > 1 - SYSTEM (None) Primary - FAT (LBA) 71.0 MB 260.0 MB
> > (Contains folder 'EFI' with subfolders.)
> >
> > 2 - (None) Primary - Unformatted 16.0 MB 16.0 MB
> >
> > [...]
> >
>
> (1) is EFS, the "system" partition used by UEFI. It can be
> as small as 100MB. Linux does not like it to be 100MB and has
> a different minimum size for it.
>
> (2) in your example, is Microsoft Reserved, it is quite small, and
> it has no file system inside it. Since it has no file system,
> some utilities are not prepared to even move such a partition.
> Macrium switches to "dd" mode to back that up. Macrium is not
> defeated by such "items". Linux GParted on the other hand...
>
> (4) is System Reserved and is sized to hold WinRE.wim.
>
> With an Admin terminal, try
>
> reagentc /info
>
> and that will tell you whether the System Reserved is currently being
> used for its WinRE.wim , or the WIM is coming from somewhere else.
>
> If you have several System Reserved, the one "nearest" the right-hand-end
> of the C: partition, that could be the "real" one. The others may be
> part of supporting Windows.old rollback procedures on a failure.
>
> If the C: partition is ever inaccessible (like, say, BitLocker issue
> due to TPM resetting), that is when you want the WinRE.wim to be
> somewhere other than C: . That can function as the Recovery Environment
> when the OS can't or won't boot.

This is what 'reagentc /info' says:

Windows Recovery Environment (Windows RE) and system reset configuration
Information:

Windows RE status: Enabled
Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
Boot Configuration Data (BCD) identifier: 78cb9cd9-c29d-11ed-8d0a-ffb519a0e260
Recovery image location:
Recovery image index: 0
Custom image location:
Custom image index: 0

REAGENTC.EXE: Operation Successful.

The

Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE

part seems to imply that my Recovery Partition (4) is in use and should
contain WindowsRE[.wim] in folder Recovery, but as I said, the partition
does not contain/show any files or folders (at least not in File
Explorer (with (Show) File name extensions and Hidden items ticked), nor
with DIR and 'ATTRIB *.*).

So still:

> > Should I worry?

On 6/10/2023 7:53 AM, Frank Slootweg wrote:
> Paul <nospam@needed.invalid> wrote:
>> On 6/9/2023 2:01 PM, Frank Slootweg wrote:
>>> [Context kept because of age. Please skip to the end.]
>
> [Lots deleted.]
>
>>> I finally re-made the (Macrium Reflect Free) Image backup of the three
>>> non-C: partitions.
>>>
>>> I noticed that now the (image of the) Recovery Partition is (seems to
>>> be?) completely empty, i.e. I can mount it, but File Explorer, DIR and
>>> ATTRIB show no files or folders.
>>>
>>> If my (02AUG2022, i.e pre-MAY2023) notes are correct, it used to
>>> contain a single folder 'Recovery' with a single 3-byte file _CNBRP.FLG.
>>>
>>> Why the difference and why is the partition empty/nearly-empty?
>>>
>>> Should I worry?
>>>
>>> FTR, Macrium says this about the partition:
>>>
>>> 4 - (None) Primary - NTFS 603.5 MB 693.0 MB
>>>
>>> The others (non-C:) are:
>>>
>>> 1 - SYSTEM (None) Primary - FAT (LBA) 71.0 MB 260.0 MB
>>> (Contains folder 'EFI' with subfolders.)
>>>
>>> 2 - (None) Primary - Unformatted 16.0 MB 16.0 MB
>>>
>>> [...]
>>>
>>
>> (1) is EFS, the "system" partition used by UEFI. It can be
>> as small as 100MB. Linux does not like it to be 100MB and has
>> a different minimum size for it.
>>
>> (2) in your example, is Microsoft Reserved, it is quite small, and
>> it has no file system inside it. Since it has no file system,
>> some utilities are not prepared to even move such a partition.
>> Macrium switches to "dd" mode to back that up. Macrium is not
>> defeated by such "items". Linux GParted on the other hand...
>>
>> (4) is System Reserved and is sized to hold WinRE.wim.
>>
>> With an Admin terminal, try
>>
>> reagentc /info
>>
>> and that will tell you whether the System Reserved is currently being
>> used for its WinRE.wim , or the WIM is coming from somewhere else.
>>
>> If you have several System Reserved, the one "nearest" the right-hand-end
>> of the C: partition, that could be the "real" one. The others may be
>> part of supporting Windows.old rollback procedures on a failure.
>>
>> If the C: partition is ever inaccessible (like, say, BitLocker issue
>> due to TPM resetting), that is when you want the WinRE.wim to be
>> somewhere other than C: . That can function as the Recovery Environment
>> when the OS can't or won't boot.
>
> This is what 'reagentc /info' says:
>
> Windows Recovery Environment (Windows RE) and system reset configuration
> Information:
>
> Windows RE status: Enabled
> Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
> Boot Configuration Data (BCD) identifier: 78cb9cd9-c29d-11ed-8d0a-ffb519a0e260
> Recovery image location:
> Recovery image index: 0
> Custom image location:
> Custom image index: 0
>
> REAGENTC.EXE: Operation Successful.
>
> The
>
> Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
>
> part seems to imply that my Recovery Partition (4) is in use and should
> contain WindowsRE[.wim] in folder Recovery, but as I said, the partition
> does not contain/show any files or folders (at least not in File
> Explorer (with (Show) File name extensions and Hidden items ticked), nor
> with DIR and 'ATTRIB *.*).
>
> So still:
>
>>> Should I worry?

You should use TestDisk to look in the 0x27 Hidden NTFS "System Reserved" partition.

https://www.cgsecurity.org/wiki/TestDisk_Download

The thing is, reagentc.exe cannot claim "Enabled", unless
it has checked that the file in question is present. We
suspect, with a high probability, that it is there, and
it's just a matter of identifying the partition properly.
The diskpart.exe can list partitions. Compare that list
to Disk Management.

[Picture]

https://i.postimg.cc/cJ1p8BNX/fun-with-partitions-and-winre-wim.gif

Paul

Paul <nospam@needed.invalid> wrote:
> On 6/10/2023 7:53 AM, Frank Slootweg wrote:
> > Paul <nospam@needed.invalid> wrote:
> >> On 6/9/2023 2:01 PM, Frank Slootweg wrote:
> >>> [Context kept because of age. Please skip to the end.]
> >
> > [Lots deleted.]
> >
> >>> I finally re-made the (Macrium Reflect Free) Image backup of the three
> >>> non-C: partitions.
> >>>
> >>> I noticed that now the (image of the) Recovery Partition is (seems to
> >>> be?) completely empty, i.e. I can mount it, but File Explorer, DIR and
> >>> ATTRIB show no files or folders.
> >>>
> >>> If my (02AUG2022, i.e pre-MAY2023) notes are correct, it used to
> >>> contain a single folder 'Recovery' with a single 3-byte file _CNBRP.FLG.
> >>>
> >>> Why the difference and why is the partition empty/nearly-empty?
> >>>
> >>> Should I worry?
> >>>
> >>> FTR, Macrium says this about the partition:
> >>>
> >>> 4 - (None) Primary - NTFS 603.5 MB 693.0 MB
> >>>
> >>> The others (non-C:) are:
> >>>
> >>> 1 - SYSTEM (None) Primary - FAT (LBA) 71.0 MB 260.0 MB
> >>> (Contains folder 'EFI' with subfolders.)
> >>>
> >>> 2 - (None) Primary - Unformatted 16.0 MB 16.0 MB
> >>>
> >>> [...]
> >>>
> >>
> >> (1) is EFS, the "system" partition used by UEFI. It can be
> >> as small as 100MB. Linux does not like it to be 100MB and has
> >> a different minimum size for it.
> >>
> >> (2) in your example, is Microsoft Reserved, it is quite small, and
> >> it has no file system inside it. Since it has no file system,
> >> some utilities are not prepared to even move such a partition.
> >> Macrium switches to "dd" mode to back that up. Macrium is not
> >> defeated by such "items". Linux GParted on the other hand...
> >>
> >> (4) is System Reserved and is sized to hold WinRE.wim.
> >>
> >> With an Admin terminal, try
> >>
> >> reagentc /info
> >>
> >> and that will tell you whether the System Reserved is currently being
> >> used for its WinRE.wim , or the WIM is coming from somewhere else.
> >>
> >> If you have several System Reserved, the one "nearest" the right-hand-end
> >> of the C: partition, that could be the "real" one. The others may be
> >> part of supporting Windows.old rollback procedures on a failure.
> >>
> >> If the C: partition is ever inaccessible (like, say, BitLocker issue
> >> due to TPM resetting), that is when you want the WinRE.wim to be
> >> somewhere other than C: . That can function as the Recovery Environment
> >> when the OS can't or won't boot.
> >
> > This is what 'reagentc /info' says:
> >
> > Windows Recovery Environment (Windows RE) and system reset configuration
> > Information:
> >
> > Windows RE status: Enabled
> > Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
> > Boot Configuration Data (BCD) identifier: 78cb9cd9-c29d-11ed-8d0a-ffb519a0e260
> > Recovery image location:
> > Recovery image index: 0
> > Custom image location:
> > Custom image index: 0
> >
> > REAGENTC.EXE: Operation Successful.
> >
> > The
> >
> > Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
> >
> > part seems to imply that my Recovery Partition (4) is in use and should
> > contain WindowsRE[.wim] in folder Recovery, but as I said, the partition
> > does not contain/show any files or folders (at least not in File
> > Explorer (with (Show) File name extensions and Hidden items ticked), nor
> > with DIR and 'ATTRIB *.*).
> >
> > So still:
> >
> >>> Should I worry?
>
> You should use TestDisk to look in the 0x27 Hidden NTFS "System Reserved" partition.
>
> https://www.cgsecurity.org/wiki/TestDisk_Download
>
> The thing is, reagentc.exe cannot claim "Enabled", unless
> it has checked that the file in question is present. We
> suspect, with a high probability, that it is there, and
> it's just a matter of identifying the partition properly.
> The diskpart.exe can list partitions. Compare that list
> to Disk Management.
>
> [Picture]
>
> https://i.postimg.cc/cJ1p8BNX/fun-with-partitions-and-winre-wim.gif
>
> Paul

Thanks Paul, for yet another detailed response!

As I mentioned, I was looking at the (Macrium Reflect) *image of* the
Recovery Partition, not at the Recovery Partition itself (because you
can not - at least not easily - give that a drive letter).

While Macrium Reflect should *backup* the content of the Recovery
Partition, perhaps it does not *show* the (hidden?) content in the
image.

If I've the time, I will look into this. Alternatively others could
perhaps 'mount' ('Browse' in Macrium Reflect) the image of their
Recovery Partition and see if it's 'empty' like in my case.

On 6/10/2023 3:45 PM, Frank Slootweg wrote:

>
> Thanks Paul, for yet another detailed response!
>
> As I mentioned, I was looking at the (Macrium Reflect) *image of* the
> Recovery Partition, not at the Recovery Partition itself (because you
> can not - at least not easily - give that a drive letter).
>
> While Macrium Reflect should *backup* the content of the Recovery
> Partition, perhaps it does not *show* the (hidden?) content in the
> image.
>
> If I've the time, I will look into this. Alternatively others could
> perhaps 'mount' ('Browse' in Macrium Reflect) the image of their
> Recovery Partition and see if it's 'empty' like in my case.

That's easy to test, and the backup only takes two seconds.

I backed up just that partition, then used the Macrium mounter to view it.
I ticked the box for removing restrictions on folders, when using the mounter.

[Picture]

https://i.postimg.cc/0NFb8mZx/macrium-has-it.gif

Paul

Paul <nospam@needed.invalid> wrote:
> On 6/10/2023 3:45 PM, Frank Slootweg wrote:
>
> > Thanks Paul, for yet another detailed response!
> >
> > As I mentioned, I was looking at the (Macrium Reflect) *image of* the
> > Recovery Partition, not at the Recovery Partition itself (because you
> > can not - at least not easily - give that a drive letter).
> >
> > While Macrium Reflect should *backup* the content of the Recovery
> > Partition, perhaps it does not *show* the (hidden?) content in the
> > image.
> >
> > If I've the time, I will look into this. Alternatively others could
> > perhaps 'mount' ('Browse' in Macrium Reflect) the image of their
> > Recovery Partition and see if it's 'empty' like in my case.
>
> That's easy to test, and the backup only takes two seconds.
>
> I backed up just that partition, then used the Macrium mounter to view it.
> I ticked the box for removing restrictions on folders, when using the mounter.
>
> [Picture]
>
> https://i.postimg.cc/0NFb8mZx/macrium-has-it.gif

Thanks - again - Paul.

Despite ticking the 'Enable access to restricted folders.' when
Browse-ing the image of my Recovery Partition, I still can not see any
files/folders (like you can in your screenshot).

But the issue is moot, because I apparently had a brain fog and did
not realize that Macrium Reflect shows the used space for both the real
Recovery Partition and the image of the partition. I had posted the
numbers before, but did not realize the relevance until now.

Macrium Reflect gives Capacity 693.0 MB, Used Space 603.5 MB and Free
Space 89.5 MB for both the real Recovery Partition and for the image of
the partition.

When I 'mount' (Browse) the image (with 'Enable access to restricted
folders.' ticked), (Windows) File Explorer still does not show any
folders/files, but the 'This PC' page says "89.4 MB free of 692 MB" for
the drive letter of the mounted image, i.e. essentially the same
numbers as Macrium Reflect gives.

So while I can not see the files, the "Used Space 603.5 MB" (Macrium)
and "89.4 MB free of 692 MB" (File Explorer) show that there *is* a WIM
in the Recovery Partition c.q. the image of the Recovery Partition.

I still don't understand why - in an old(er), 02AUG2022 backup -, I
*can* see the Recovery folder and the 3-byte _CNBRP.FLG file in that
folder.

But I do not really trust 'my' tools - File Explorer in this case -,
because for example FE shows the '.FLG', even if I untick (Show ->)
'File name extensions'!

Bottom line: For me the case is closed. But if anyone has any ideas
why my File Explorer (and DIR and 'ATTRIB *.*) does not show any files/
folders, but yours does, I'm all ears.

Thanks again.