2

I have been using some disk imaging software (Ghost 8.0) to clone a Windows XP Embedded image.

I noticed that even if I capture a disk image from a computer and then transfer that image back to the same computer, then on the first boot-up Windows will notice that settings have changed, and it will request a reboot.

My question is, if the hard drive has exactly the same data as it had before, how does Windows know that it should reboot? Is there some kind of hardware flag on the hard drive that lets Windows know when sectors have been overwritten?

Also, I'm not sure if this is relevant, but the image that I was transferring had the Enhanced Write Filter enabled. It's my (possibly mistaken) understanding that Windows cannot make a change to its registry that can survive a power cycle with EWF turned on. I would normally expect the answer to my question to be that Windows stores something in its registry that can be compared to something stored on the hard drive, but since I had EWF enabled, I'm not sure how that would be possible.

4
  • 2
    Depending on the disk imaging technique being used, it might be the disk drive's signature, changed whenever the disk is repartitioned, or perhaps even the NTFS volume ID, changed whenever the volume is reformatted. (I have no idea why such changes makes Windows think a reboot is necessary, but it does.) Oct 24, 2012 at 20:35
  • 2
    "it might be the disk drive's signature" more than likely correct, Acronis captures this signature and allows you to apply it on recovery, and I never get any issues like this using Acronis. Windows System Restore points also uses the disk signature, if signature is not restored they will be lost and is most likely the cause of the reboot request.
    – Moab
    Oct 24, 2012 at 21:21
  • Where is the disk drive signature kept? And is it compared to something in the Windows registry? Oct 25, 2012 at 0:26
  • 2
    The disk drive signature is in the master boot record. There is probably at least one copy stored somewhere in the registry (during the Windows install process, long before you turned on EWF) and IIRC the boot configuration data (BCD) also references it. If this is a major problem for you, your best bet is to find a way to copy the original signature to the new drive. Keep in mind that if you connect two drives with the same signature to the same machine things are going to go wrong. Oct 25, 2012 at 20:21

0

You must log in to answer this question.

Browse other questions tagged .