How I fixed a 45MB~ hole in a Windows 10 install (Plus some useful information on cloning and snapshotting)

Initially this post was written while I was still finding a solution, but I ended up figuring one out. However there's a lot of useful information here for those who clone often or want to experiment with fixes that could be blown away safely if it doesn't work.

# The cloning process

Someone's drive failed due to old age and it was brought to me. Windows isn't my primary driver, rather this goes to NixOS, but I have tooling to deal with this neatly, specifically Partclone and GNU Ddrescue. partclone can clone used spaces in filesystems instead of the whole partition and ddrescue is a stubborn, powerful disk recovery tool that can work in tandem with partclone in my specific case. In summary the flow is so:

# Copy the partition geometry, including GUIDs
sfdisk -d /dev/sdA | sfdisk /dev/sdB
# Inspect the partitions
fdisk -l /dev/sdB
# Run the approriate partclone variant for each partition, i.e
# efi partition fat32
partclone.fat --dev-to-dev --source /dev/sdA1 --output /dev/sdB1
# some OEM partition unknown
partclone.dd --dev-to-dev --source /dev/sdA2 --output /dev/sdB2
# windows recovery, main partition ntfs
partclone.ntfs --dev-to-dev --source /dev/sdA3 --output /dev/sdB3
partclone.ntfs --dev-to-dev --source /dev/sdA4 --output /dev/sdB4
# This doesn't include copying the MBR, though for most installs (UFEI) this is enough.
# If you really need a MBR, check online on how to clone it or use Windows tooling.

partclone handled the other partitions fine, albiet slow due to the failing disk, but it didn't really like dealing with the main partition where the damage seems to have occurred.

partclone acknowledged that it could still see the NTFS structures to make a optimized plan and could still try to clone, but I didn't want to rely on partclone on a recovery as I prefer ddrescue for this and that's what I did for a bit while doing more research.

Turns out partclone can generate a domain map for ddrescue which gets the best of both worlds: clone only the used data like partclone and great disk recovery that ddrescue can do.

partclone.ntfs --source /dev/sdA4 --domain --output ~/ntfs-domain.map

Then that domain can be given to ddrescue.

ddrescue --force --domain-mapfile=~/ntfs-domain.map --idirect /dev/sdA4 /dev/sdB4 ~/sdB4.map

Cool. This drastically reduces the amount of data I need to recover.

But then I wanted violence.

# Device Mapper & Snapshots

A simple question: "Wonder how the recovery is going so far. Can I even see files yet?"

Yes. Yes you can do this safely.

A rabbit-hole that brought me to Oddbit's blogpost on 2018-01-25, "Fun with devicemapper snapshots"

Device mapper, in short, allows creating virtual block devices that can be backed by many block devices or just at a specific location, among other things. Like sectors A–B go to device X starting at offset δ and sectors C–D go to device Y starting at offset ζ for virtual device θ. But what it also includes is snapshots.

I used fdisk -l to get the sector count (1,953,525,168), but I need a snapshot device. I don't want to use my physical storage (or bother creating a file to act as block storage), but I can use zram to give me one in memory. If you don't already use it for compressed system memory, modprobe zram.

~> zramctl -f -s 16G
/dev/zram1
~> dmsetup create snap --table '0 1953525168 snapshot /dev/sdB /dev/zram1 N 16'

Now there's /dev/mapper/snap that can be modified with up to 16G of changes until writes fail (or you OOM yourself by accident.) It'll miss the partitions you can access like /dev/sdB1, /dev/sdB2, and so on, and I'm sure there's a tool that can help generate those, but using fdisk -l can give you the offsets you need if you want to mount a partition using dmsetup. For example the NTFS partition with all the data starts

How I fixed a 45MB~ hole in a Windows 10 install (Plus some useful information on cloning and snapshotting)

Initially this post was written while I was still finding a solution, but I ended up figuring one out. However there's a lot of useful information here for those who clone often or want to experiment with fixes that could be blown away safely if it doesn't work.

# The cloning process

Someone's drive failed due to old age and it was brought to me. Windows isn't my primary driver, rather this goes to NixOS, but I have tooling to deal with this neatly, specifically Partclone and GNU Ddrescue. `partclone` can clone used spaces in filesystems instead of the whole partition and `ddrescue` is a stubborn, powerful disk recovery tool that can work in tandem with `partclone` in my specific case. In summary the flow is so:

# Copy the partition geometry, including GUIDs
sfdisk -d /dev/sdA | sfdisk /dev/sdB
# Inspect the partitions
fdisk -l /dev/sdB
# Run the approriate partclone variant for each partition, i.e
# efi partition [fat32]
partclone.fat --dev-to-dev --source /dev/sdA1 --output /dev/sdB1
# some OEM partition [unknown]
partclone.dd --dev-to-dev --source /dev/sdA2 --output /dev/sdB2
# windows recovery, main partition [ntfs]
partclone.ntfs --dev-to-dev --source /dev/sdA3 --output /dev/sdB3
partclone.ntfs --dev-to-dev --source /dev/sdA4 --output /dev/sdB4
# This doesn't include copying the MBR, though for most installs (UFEI) this is enough.
# If you really need a MBR, check online on how to clone it or use Windows tooling.

`partclone` handled the other partitions fine, albiet slow due to the failing disk, but it didn't really like dealing with the main partition where the damage seems to have occurred.

`partclone` acknowledged that it could still see the NTFS structures to make a optimized plan and could still try to clone, but I didn't want to rely on `partclone` on a recovery as I prefer `ddrescue` for this and that's what I did for a bit while doing more research.

Turns out `partclone` can generate a domain map for `ddrescue` which gets the best of both worlds: clone only the used data like `partclone` and great disk recovery that `ddrescue` can do.

partclone.ntfs --source /dev/sdA4 --domain --output ~/ntfs-domain.map

Then that domain can be given to `ddrescue`.

ddrescue --force --domain-mapfile=~/ntfs-domain.map --idirect /dev/sdA4 /dev/sdB4 ~/sdB4.map

Cool. This *drastically* reduces the amount of data I need to recover.

But then I wanted violence.

# Device Mapper & Snapshots

A simple question: "Wonder how the recovery is going so far. Can I even see files yet?"

Yes. *Yes you can do this safely.*

A rabbit-hole that brought me to Oddbit's blogpost on 2018-01-25, ["Fun with devicemapper snapshots"](https://blog.oddbit.com/post/2018-01-25-fun-with-devicemapper-snapshot/)

Device mapper, in short, allows creating virtual block devices that can be backed by many block devices or just at a specific location, among other things. Like sectors A–B go to device X starting at offset δ and sectors C–D go to device Y starting at offset ζ for virtual device θ. But what it also includes is snapshots.

I used `fdisk -l` to get the sector count (`1,953,525,168`), but I need a snapshot device. I don't want to use my physical storage (or bother creating a file to act as block storage), but I can use `zram` to give me one in memory. If you don't already use it for compressed system memory, `modprobe zram`.

~> zramctl -f -s 16G
/dev/zram1
~> dmsetup create snap --table '0 1953525168 snapshot /dev/sdB /dev/zram1 N 16'

Now there's `/dev/mapper/snap` that can be modified with up to 16G of changes until writes fail (or you OOM yourself by accident.) It'll miss the partitions you can access like `/dev/sdB1`, `/dev/sdB2`, and so on, and I'm sure there's a tool that can help generate those, but using `fdisk -l` can give you the offsets you need if you want to mount a partition using `dmsetup`. For example the NTFS partition with all the data starts

at sector offset `2,906,112` and has a sector size of `1,927,503,872`

dmsetup create snap-main --table '0 1927503872 linear /dev/mapper/snap 2906112'

Initially I did it too early and the filesystem wasn't cloned enough so mounting failed unceremoniously so I did `dmsetup remove snap-main`, `dmsetup remove snap`, and `zramctl -r /dev/zram1` to blow away what I did. But eventually the recovery got through the disk and now was slowly churning through 45-odd MB 7.5-so GB in the disk where a failure occurred. Setting up a `zram` device and mapping with `dmsetup` again, the NTFS partition had enough structure to be mounted. But rule of thumb for NTFS is `chkdsk` in Windows is what you should use for integrity checking if possible, even from Linux. So a download of Windows 10 installation media later, and I used `qemu` to give me a virtual machine on the spot with 16 cores and 8G of memory.

qemu-system-x86_64 -bios ${pathToOVMF.fd} -enable-kvm -M usb=on -cpu host -smp 16 -m 8G -drive file=~/win10.iso,media=cdrom -device usb-tablet -drive file=/dev/mapper/snap,format=raw

I let Windows on the snapshot try to boot, it does a `chkdsk`, tries to boot again, system recovery, then bails out with a suggestion to check `C:\Windows\System32\LogFiles\Srt\SrtTrail.txt`. Next boot I try to see if Startup Repair on the media can get further, but same message. Using `dmsetup` pointing to the NTFS partition I can mount it, browse, and unmount.

# What I did

Trying to use `dism /Image:C:\ /Source:D:\sources\install.wim:1` bails with a spurious error about being unable to create a temporary directory on `X:\` while the log lists this:

Info DISM DISM Manager: PID=2028 TID=2032 Copying DISM from "C:\Windows\System32\Dism" - CDISMManager::CreateImageSessionFromLocation
Error DISM DISM Manager: PID=2028 TID=2032 Failed to copy the image provider store out of the image. - CDISMManager::CreateImageSessionFromLocation(hr:0x8007025d)
Error DISM DISM.EXE: Could not load the image session. HRESULT=8007025D

I shut down the VM and mount the partition, check `/Windows/System32/Dism` and my file browser subtly highlights something odd. Windows executables look like exclamation dialogs (or their application icon) normally, but two had question marks indicating my file browser couldn't actually determine what they were. Comparing against my personal install of Windows 10 confirms the files were damaged. So I overwrote the damaged files with my personal copy, start the VM, and this changes the `dism` error in the logs to `Failed to copy inbox forwarders to temporary location` which is a dead-end for me.

And since I could, I tried seeing what happens if I just copy my `System32` and `SysWOW64` from my install over. Well. It works, shockingly after some spinning at boot. But it appears computer-specific configurations are in `System32` (and later I end up finding out the system's registry lives in `system32/config`) and instead of being prompted for the person's login it's instead trying to ask for *mine* and clicking the text to try to sign in ends up spinning indefinitely (until it eventually BSOD's in the background because the snapshot device filled from Windows doing Windows things.)

Copying over `System32` and `SysWOW64` seems to have legs, so I theory-crafted on if I could just get a untouched source and turns out I can pull from the install media's `install.wim`. I mounted the install media's wim using `wimlib`'s `wimmount`.

mkdir ~/wim
wimmount /run/media/…/CCCOMA_X64FRE_EN-US_DV9/sources/install.wim 1 ~/wim

I tried copying just `System32`, `SysWOW64`, to copying the whole `Windows` directory and even just the whole contents of the wim over. Doing the last one did try to get the system to stop going into recovery, but endlessly spun. And `dism` would still refuse to do anything with a mix of the others with similar errors.

# What worked

Once I learned that I may have been overwriting the registry with my previous experiments, I copied aside `system32/config` and used `rsync` to overwrite `C:\Windows`

`rsync -avP

~/wim/Windows/ /run/media/…/OS/Windows`

Then I copied `system32/config` back over, started the VM, it spun, and...

[The Crash – Kavinsky](https://www.youtube.com/watch?v=ig8wfLhPi5w&t=45s)

https://preview.redd.it/kvut2nnmpq7f1.png?width=1412&format=png&auto=webp&s=2eece553b405a19add3d2da82a042b1e4dbd54c8

It worked. I have managed to fix a broken Windows 10 install all the while `ddrescue` was still dutifully working in the background trying its hardest to get those remaining 45MBs. I can later redo what I did just in case those 45MBs had something extra in there that wasn't just system files I overwrote. If I really wanted, I could do some deep analysis using the `ddrescue` map and seeing what files got winged by the damage by checking if that file happened to be stored where `ddrescue` couldn't recover.

So hopefully, in some way, my long winded post here has some useful bits of information for anyone who does cloning often or has a need to experiment different fixes and be able to easily blow them away if they don't work.

# Could you just reinstall?

Yes.

I very much could have and it'd be a another anti-climatic end to yet another broken Windows install. But pitching this back at the person with a reinstalled copy of Windows and telling them "Just reinstall all your stuff, your files are in Windows.Old" just didn't feel right, especially since the damage was 45MB somewhere in some core Windows files. Maybe this might be some inspiration to try experimenting to see if some crazed idea would get a install running again, or some divine intervention where a Microsoft engineer will look at my plight and think "You know that just sucks to do blind" and Windows improves a bit on telling you when things go wrong. Either way, hope all of this is useful somehow..

https://redd.it/1ler6o5
@r_Windows

custom windows 1.0 - 98 winver banners

https://redd.it/1legfa9
@r_Windows

Text Editor with 100% self hosted change history tracking?

Hi all!

My job includes keeping text notes of sensitive information, and the need to keep a record of every change made to the document by either making it impossible to delete or hide the history afterwards so that we can always prove who changed what and when. Usually we keep handwritten logs, and the regulations for using a digital version of these logs are super strict. For instance, if they`re in digital format, they MUST be saved in a local encrypted drive.

I know Word and Google drive have this functionality, but they require hosting the file in their cloud services - which is a big no-no!.

I`ve explored using Word`s change tracking, making sure that changes are never fully accepted, but then again, always fear this will eventually cause confusion, and it could eventually be argued that the document was adulterated at some point, so not a good enough solution.

SO, that`s the big question. DO you know a text editor with robust history tracking that can function and store files 100% locally and offline?


Thanks in advance!



https://redd.it/1leulu9
@r_Windows

I want my portable shortcuts to appear when I plug flash drive in

I want to install some portable apps on an SD card, but I kinda wished I could set it up so that whenever I plugged it in all the shortcuts appeared on desktop, while when it's not plugged in it removed shortcuts.
I'm pretty sure that's possible, windows is quite flexible if you know how to use it..... But idon't know how.
I'm planning to put shortcuts on an SD card so that when you open the SD card partition the first thing you see is .exe files. I also don't know if that's possible tho, cuz some apps also require other directories. But I hope I can just make them invisible and never think about them again.


https://redd.it/1lewr5h
@r_Windows

I Wrote About Copilot Vision: Here’s How Microsoft's AI Views Your PC Screen

I recently wrote an article about Microsoft’s new Copilot Vision feature, and I wanted to share some key points that might be useful.

Copilot Vision lets you share up to two windows on your PC, so the AI can see exactly what you’re working on and provide real-time help. Whether you’re reviewing documents, editing photos, or working in other applications, it can offer summaries, step-by-step guidance, or context-aware tips without needing to switch apps or copy-paste anything.

One of the neat parts is the Highlights mode, which overlays numbered pointers on your screen to show you exactly where to click for certain tasks. It’s all opt-in, so you control what the AI sees, and Microsoft has designed it to keep your data private by not storing images and only keeping text responses briefly for safety checks.

The feature is free to use inside Microsoft Edge, but if you want it to help with other desktop apps, there’s a subscription option with a free trial.

For more details, check out the full article here: https://aigptjournal.com/work-life/work/productivity/copilot-vision/

What’s your take on having an AI that can actually see your screen and help out? Have you tried anything like this before? Would love to hear your thoughts!

https://redd.it/1leyhyj
@r_Windows

What the wallpaper for the Windows Phone should look like
https://redd.it/1lezqfk
@r_Windows

Vertical bar in notification area

Am I losing it and this vertical bar has always been there and I never noticed or if it has it appeared because I effed up something? Can someone tell me how to get rid of it. Thanks

https://preview.redd.it/e9sp2qa12t7f1.jpg?width=6056&format=pjpg&auto=webp&s=1d96fe9e98edf04686487a51c1dfd075136d4e7a






https://redd.it/1lf1151
@r_Windows

calender sometimes show next month instead this month. how do i change it to show current month?
https://redd.it/1leybcq
@r_Windows

Recommend me RDP client

I use Windows RDP to connect from my laptop (Win 10) to my PC (Win 11) in my home (fast LAN). But the connection frequently brokes and worse - randomly and suddenly when I write in full screen remote PC, some system windows opens on the laptop (as like key combinations are pressed fastly), which is potentially very dangerous ☠️
Recommend me Win 10 RDP Client instead the old native.

P. S. I tried the app from the Microsoft Store but it is with blured screen and when move the mouse, the laptop taskbar appears in full screen. So it doesn't work as to be useful at all.
P. P. S. Do not recommend other principles like browser based, anydesk or vnc.

https://redd.it/1lf4fty
@r_Windows

I Made Android's "Circle to Search" Feature for Windows

https://redd.it/1lf9rke
@r_Windows

Which Windows Version Should I Use On a Tablet Laptop

(Idk if this is the right subreddit but) if I get a Minisforum V3 (a surface style tablet laptop), I will mainly use Linux but I would like to dual boot with Windows. Which version should I use?

- Win11
- Win8.1
- Win10 LTSC

https://redd.it/1lfaohj
@r_Windows