Installing Windows Embedded POSReady 2009

The POS2009 ISO is a bit different from normal XP ISOs in that it has no 2nd stage boot and it requires a 'flat-file' structure and \i386 folder on the installation media to be present during the 2nd boot.

There is a ReadMe file at \_ISO\docs\Sample mnu Files\Windows\POS2009_ReadMe.txt on the E2B drive which can be used to install POS2009 to an IDE hard drive.

E2B v1.99 contains revised instructions for guidance on how you can install to SATA\RAID\SCSI disk too.

The ReadMe file in v1.99 is shown below:

Windows 10 font confusion

This problem took me a while to solve today.

I had a file called MissionImpossible.g4b which did not seem to get recognised by grub4dos.

It turned out it was a typo problem and because Windows Explorer shows virtually identical characters for capital I and lowercase L (l), I did not spot it!!!  see below...

Can you tell the difference between I and l in the Windows font?


Good choice of font Microsoft - but give me function and clarity over aesthetics any day!

With some fonts I have problems distinguishing the number 1 from a lowercase l? Now it seems I also need to look out for uppercase I's as well!

Unfortunately Windows 10 has no facility to change the default font (unless you hack the Registry).

Anyone know how to have a legible font in Win10 without having to hack the registry?

P.S. In case you are wondering, the next version of E2B (and grub4dos) will be able to play annoying tunes through the PC internal speaker (if fitted) whilst the animated icon is displayed on the menu! I am testing/debugging it now.

Windows Forensic course for only $25 - Hurry!

If you would like to take a course on Windows Forensic investigation and the Windows Forensic Operating System (WinFE) by Brett Shavers, then you can sign up here for a sale price of only $25 (normal price $95) but be quick - less than 2 days to go!

There is an intro video on the same page (in the Contents list on right hand side of the page) so you can see what the course covers.


About the course
This course is specific to the Windows Forensic Operating System. Everything you need to build and use a WinFE is included in this course (except your personal license for Windows that is needed to build a WinFE) . You'll learn why WinBuilder was chosen as the preferred method, how previous methods are now outdated, and how other methods are not as well suited as the latest Mini-WinFE build. In fact, the latest build application is focused on during this course.

You'll learn various methods of using a WinFE, whether it is for civil matters, criminal cases, or educational uses. Customize your WinFE specific to your needs and see how a customized WinFE boot disc may handle the vast majority of booting the evidence computer forensically over other boot systems such as Linux Live CDs.

MPI Tool Pack v0.082 available

MPI Change History v0.082

• grub4dos \grldr updated to latest version
• Small change to csm\menu.lst for KonBoot menu
• Menu.lst now warns if no UEFI boot files are found
• Chandra's Split_WinISO.exe utility is now included for making split WIM files when a Windows Install ISO has >4GB install.wim/esd files.
• Add 'set default menu and timeout' menu entry to CSM menu
• Change to  add clover menu for (hd0,2) EFI boot files
• Update to latest Clover 64-bit+plist.conf
• Improve FreeBSD menu (now works with Nas4Free)
• Add boot as floppy drive A: to DOS menu entry to \menu.lst

Download here from the Alternate Download Areas. Please let me know if you spot a problem.

The download is named 'Beta' but it is the full released version of 0.082 which I will simply rename and fully release next week if no one reports any issues.

Install Win98 from E2B

PhilsComputerLab has just produced a nice YouTube video showing how to install Win98 onto an old Legacy computer (with IDE drive and <1GB RAM) using a Win98 ISO and an E2B drive.

Several people have commented that they do not want to remove files from the ISO to reduce it's size.

Here is a way of adding a full Win98 Install payload to E2B by using a .imgPTN file.

Useful PDF from Microsoft of Windows Command Line commands

Microsoft PDF for the A-Z list of command line commands.

New Online Html Version
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands

New PDF Download
https://docs.microsoft.com/en-us/windows-server/opbuildpdf/administration/windows-commands/TOC.pdf?branch=live

You may learn something new!

Older versions

Click here to download
English direct download here.

E2B v.1.99d BETA available

When I first added the .imgPTN feature to E2B, I was not sure what partition configuration to use in order to make it bootable on a large range of different UEFI BIOSes.

So I included a wide range of file extensions such as .imgPTNLBAa23, .imgPTNna23, etc. etc.

However, no one has reported any issues and I personally have not had to use any other file extension except for .imgPTN and .imgPTNLBAa23.

So E2B v1.99d has a slight change in that the file extension .imgPTN23 will now be identical to using the file extension .imgPTNLBAa23. i.e.

In versions of E2B before 1.99d, .imgPTN23 did not set the partition as active or use large LBA parameters but in version 1.99d it does. SWITCH_E2B.exe however did use LBA and set the partition active, so E2B now does the same as SWITCH_E2B.exe.

This means that there are now just two file extensions to worry about for 99% of the time: .imgPTN for most purposes or .imgPTN23 if you want the 2nd partition to remain available after switching.

E2B v1.99d is available from the Alternate Download Areas as usual (see side bar).

P.S. The other .imgPTNxxxxx variations will still work in the same way and you do not need to change the file extension of any of your .imgPTN files for this new version.

Progress on the E2B eBook

I have almost finished writing most of the content for the E2B eBook but there is still a lot of work to do yet.

It now has over 100 pages and over 40 'Exercises'.

It will be available as a PDF because this allows a hyperlinked Contents table and you can read it on pretty much any device. I have come to the conclusion that the eBook ePub format is just too limiting for this type of book.

I haven't yet decided on what platform I will use to sell it. I looked at using Lulu.com, but it does not allow me to to easily include a hyperlinked Contents page and has other limitations, so I am now looking at payhip.com which do not provide a purchase site like Lulu does, but just a 'sales page' for each product. However it will accept virtually any PDF format and it will watermark the pages with the buyers email address before making the download available.

Please let me know if you want any more topics added (though some more advanced topics will probably go into a second eBook).

I haven't decided on a price yet, but $6.99 is my initial thought so far, does this sound OK? There may be voucher codes for discounts available later too.

Here is a screenshot of the Contents so far.

E2B v1.99c Beta available

Differences from v1.99b are:

1. Update_E2B_Drive.cmd now has 2 second tolerance on file times (/FFT switch added)
2. CONTIG.ISO is not copied when using red button in MAKE_E2B.exe GUI to make a new E2B drive.
3. Make_CONTIG.ISO.cmd added.

If you want a CONTIG.ISO file you should use the Make_E2B_USB_drive button in the GUI instead of the big red button.

The 500MB CONTIG.ISO is still in the download, it is just not copied across when using the red button.

There is also now a .cmd script to quickly make a CONTIG.ISO file at "\_ISO\docs\E2B Utilities\Make_CONTIG.ISO\Make_CONTIG.ISO.cmd".

The new version can be found in the Alternate Download Areas as usual.

Should I remove CONTIG.ISO from Easy2Boot?

As you may know, \_ISO\CONTIG.ISO is a 500MB blank file which is included in the Easy2Boot download.

The CONTIG.ISO file is only used when a payload file is not contiguous but when E2B needs it to be contiguous. E2B will then copy the entire original payload file to the CONTIG.ISO file. This can take some time and it is done each time you boot to that same payload file.

I never actually use this feature and I suspect most Windows users do not use it either.

When you first make an E2B drive, this large file needs to be copied over to the USB drive and this can take several minutes on slow pen drives. The file also takes up 500MB of space on the USB drive which is never used as long as you always run \MAKE_THIS_DRIVE_CONTIGUOUS.cmd first.

So, my proposal is to remove the CONTIG.ISO file from the E2B self-extracting download file in the next version of E2B (v1.99c).

However, the .zip E2B download file (which is used by linux users to prepare an E2B drive) will still contain a 500MB CONTIG.ISO file.

If a Windows user still wants to use the CONTIG.ISO feature, they simply have to create a \_ISO\CONTIG.ISO file (I can provide a small batch file which will create a file of any size).

Please let me know if you think this is a bad idea ASAP, otherwise I will remove the CONTIG.ISO file in the next version.