Reset Windows

Is "reset windows" absolutely safe?

Alek wrote:
Is "reset windows" absolutely safe?

What does it do again ?

Oh yes, it's (undoubtedly) perfectly safe.

https://www.tenforums.com/tutorials/...dows-10-a.html

*******

Now, some hints.

1) You can prepare a Reset stick.
But when I tried some experiments in this area,
it doesn't seem interested in keeping much in
the OS image.

My conclusion was, don't bother making a Reset stick.

The Reset stick option might be best suited to
people who don't have the DVD.

2) It's different for the happy new owner of a
Windows 10 laptop. There is a Reset image of their
OS as delivered, on the laptop. if you do a Reset
there, it could be a kind of "Reset code to factory,
keep user files" kind of thing. In some cases, the
laptop manual on a new laptop, is completely devoid
of information regarding running the recovery software.
It might say "Press F12, follow the prompts", that
kind of rubbish.

You can do a Repair Install, by running Setup.exe off
a Windows 10 DVD, but that requires a running copy of
Windows 10 that is *not* polluted with malware. There
is no flavor of offline repair install, like in the
Windows XP era. In WinXP, you can boot the CD and
repair Windows using the CD. Only Clean Install is
offered when you boot a Windows 10 DVD from the BIOS prompt.

*******

It's the same as any Bomb Disposal Unit project.

Make full backups of the boot drive.

Disconnect any non-OS-drive devices so boot
materials are not accidentally put on the wrong drive.

Then:

Try your RESET experiment. If it's a flop, restore
from backup.

Note that backups can be made from the Macrium Reflectfree
Rescue CD. By doing it that way (offline backup), even
if a PC has malware on it, you can restore it back to
exactly how it was, malware and all... :-)

Paul

On 01/01/2020 22:13, Alek [ aka Alek Idiot ] asked:
Is "reset windows" absolutely safe?

Yes



--
With over 1.2 billion devices now running Windows 10, customer
satisfaction is higher than any previous version of windows.

"Alek" wrote in message ...

Is "reset windows" absolutely safe?

Alek,

Could you provide some details on why you think you need to perform a reset?

To answer your question with an absolute yes or a no answer would be foolish
since there are so many variables.

But if you can't provide any details or don't want to, then go with a "No"
response and do what you need to do based on that answer. If you have some
more details you care to share, then maybe a more helpful response would be
offered.

--

Bob S.

"Paul" wrote in message ...

1) You can prepare a Reset stick.
But when I tried some experiments in this area,
it doesn't seem interested in keeping much in
the OS image.

My conclusion was, don't bother making a Reset stick.

The Reset stick option might be best suited to
people who don't have the DVD.


Paul,

I think your experiments were based on the expectation that when doing a
reset (whether from USB stick or a DVD) that "Resetting" would keep
everything - including any software you had installed but refresh the Win10
operating system. Not so and the instructions are clear in the Recovery
window, "....This lets you choose to keep your *personal files* or remove
them and then reinstalls Windows."

Asterisks around *personal files* to highlight that resetting does not save
any apps/software that is not installed by Win10 during an install.

--

Bob S.

n/a wrote:
"Paul" wrote in message ...

1) You can prepare a Reset stick.
But when I tried some experiments in this area,
it doesn't seem interested in keeping much in
the OS image.

My conclusion was, don't bother making a Reset stick.

The Reset stick option might be best suited to
people who don't have the DVD.


Paul,

I think your experiments were based on the expectation that when doing a
reset (whether from USB stick or a DVD) that "Resetting" would keep
everything - including any software you had installed but refresh the
Win10 operating system. Not so and the instructions are clear in the
Recovery window, "....This lets you choose to keep your *personal files*
or remove them and then reinstalls Windows."

Asterisks around *personal files* to highlight that resetting does not
save any apps/software that is not installed by Win10 during an install.

I was doing this based on a query of the form "this doesn't work".

On one previous occasion, the Reset thing failed because
reagentc wasn't wired up properly or something.

On a second run a year or two later, with reagentc in
working condition, I tried to make the Reset stick,
hoping to keep something. And when I was finished,
I was looking at the stick and asking "what's the point",
when MediaCreationTool could make something of equivalent
functionality.

Some capability to include applications must exist, because
the cruft that OEM laptop makers include in their images,
represents the apps they want to make a buck off of. Their
reset image would include the NTI Backup package they make
a buck from.

I was working through the process as if an end-user was
doing this, and seeing what kind of resistance it throws
up. If your OEM provides an image, the process could
well be a lot more satisfying.

Paul

Paul wrote on 1/1/2020 6:16 PM:
Alek wrote:
Is "reset windows" absolutely safe?

What does it do again ?

Oh yes, it's (undoubtedly) perfectly safe.

https://www.tenforums.com/tutorials/...dows-10-a.html

*******
"If you're planning to donate, recycle, or sell your PC, use this option
and choose to fully clean the drive. This might take an hour or two, but
it makes it harder for other people to recover files you've removed."

How would those other people recover those files? I.e, what tools would
they use?

n/a wrote on 1/1/2020 7:54 PM:
"Alek" wrote in message ...

Is "reset windows" absolutely safe?

Alek,

Could you provide some details on why you think you need to perform a reset?

To answer your question with an absolute yes or a no answer would be foolish
since there are so many variables.

But if you can't provide any details or don't want to, then go with a "No"
response and do what you need to do based on that answer. If you have some
more details you care to share, then maybe a more helpful response would be
offered.

Owner wishes to return HP desktop within the "30 day money back
guarantee" period offered by the seller.

On another note, what is the seller likely to do with the returned machine?

In article , Alek
wrote:

"If you're planning to donate, recycle, or sell your PC, use this option
and choose to fully clean the drive. This might take an hour or two, but
it makes it harder for other people to recover files you've removed."

How would those other people recover those files? I.e, what tools would
they use?

hard drive scavenging tools, which scans the drive and reconstructs
what was previously there. generally, it works quite well.

a secure delete, which writes data to every block and can take much
more than an hour or two for today's high capacity drives, will make
recovery effectively impossible outside of spending a *lot* of time and
money. for a random computer someone bought at a swap meet or off ebay,
it's not worth the trouble, but for a major crime investigation, where
it's believed there is *something* of interest there, it might be.

the only way to be completely sure it's unrecoverable is to remove the
drive and physically destroy it.

chances are the new buyer will want a new and larger capacity drive
anyway.

Alek wrote:
n/a wrote on 1/1/2020 7:54 PM:
"Alek" wrote in message ...
Is "reset windows" absolutely safe?
Alek,

Could you provide some details on why you think you need to perform a reset?

To answer your question with an absolute yes or a no answer would be foolish
since there are so many variables.

But if you can't provide any details or don't want to, then go with a "No"
response and do what you need to do based on that answer. If you have some
more details you care to share, then maybe a more helpful response would be
offered.

Owner wishes to return HP desktop within the "30 day money back
guarantee" period offered by the seller.

On another note, what is the seller likely to do with the returned machine?

"Level and reload"

Although there have been plenty of situations, where
someone receiving what they think is a "new" machine,
finds *all* the files of the previous "sampler user".

Cleaning the machine before you send it back, is
always a good idea, when it comes to passwords and
the like.

*******

I picked this picture, as it helped tweak my memory.

https://www.eightforums.com/data/att...4c28679728.jpg

First of all, the two disks there are GPT partitioned.
At first, I was hoping the left-most box under Disk 0
would say that, but you have to do Properties on the
box over there, to finally see the details.

The danger with erasing things on an OEM setup, is
breaking the recovery process. And you need the recovery
process to reload Windows 10 onto C: .

Windows calls the boot partition "system".

Windows calls the system partition "boot".

And that too, while I'm familiar with the switcheroo,
it was still throwing me off.

Note that Disk Management does not show the 16MB reserved
partition. Microsoft doesn't put a file system in that one.
And as for the materials that go in there, like the name
says ("reserved"), it isn't actually just the one thing.
There are a few items they could hide in there. But they're
not likely to be your SSN number or your shoe size :-)

So let's draw a picture with enough details to take some guesses.
First, the partition numbers won't be logical, so any operation
requiring knowledge of the partition number, you'll have to be
extra careful to not zap the wrong thing. That 16MB hidden one
for example, that's a partition, and it bumps the partition number,
so you'll see a "missing one" in some cases.

+----+----------------+----+--------------+---------------------+-----------------+
| MBR| 650MB Recovery |16MB| ESP (system) | C: (labeled "Boot") | Recovery D: 26GB|
+----+----------------+----+--------------+---------------------+-----------------+
WinRE.wim /EFI/boot The system partition. Used to reload
Emergency boot BCD and boot Should be eraseable. C: for you. Do
Not always materials. Do not erase.
wired up! not erase.

For the recovery process to boot on the HP, we think strategically.

The end one, D:, we need that because it has the backup image.

The ESP is needed, because it handles "vectoring" at
boot time. If HP has any F11 secret saucs, it'll be launched
from the ESP.

The WinRE.wim *could* be the booting OS that D: uses, to move
the materials from D: over top of C: .

You might ask, "why not just use the factory method?"

Good question.

When doing either a "Quick" format or a "Full" format,
not all the sectors are written. This is a privacy issue!

If you format C: , someone can use Recuva or Photorec or
applications of that type, to scan C: and retrieve files
based on their old headers. The $MFT is not absolutely
required for forensic recovery.

An application that *does* write zeros, and selectively,
is "dd.exe". We can erase every last byte in C: , before
paving over it with the F11 recovery procedure.

http://www.chrysocome.net/dd

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

First you do "dd --list" and that gives the partition
numbers. Looking at the eightforums sample picture, C:
there is 450.02GB or 450,000,000,000 bytes. We look
in the dd output for an item of that size.

You need to be booted into some other OS, while doing the
dd commands. The installer DVD for Windows 10, it has
a troubleshooting section with a Command Prompt in it.
In addition, tools like Macrium ReflectFree rescue CD,
have a Command Prompt too. You just need your copy
of "dd.exe" to be put somewhere that you can find it,
and change the drive letter in Command Prompt so you
can run it.

I just used my ugliest disk as a demo. Here is
"dd --list" from an Administrator level Command Prompt.
(Use "whoami" to gain some info regarding the account level.
The result requires some interpretation. The first user
on C: for example, belongs to the administrator group,
and even though the account is named "wally", it's
still an administrator.)

*******
rawwrite dd for windows version 0.6beta3.

Win32 Available Volume Information
\\.\Volume === I removed this section

NT Block Device Objects
\\?\Device\CdRom0
size is 2147483647 bytes
\\?\Device\Harddisk0\Partition0 === Partition 0 is the whole disk
link to \\?\Device\Harddisk0\DR0 Of Harddisk0 in this case.
Fixed hard disk media. Block size = 512
size is 6001175126016 bytes
\\?\Device\Harddisk0\Partition1 === Partition 1 is just a partition
link to \\?\Device\HarddiskVolume1
Fixed hard disk media. Block size = 512
size is 523239424 bytes
\\?\Device\Harddisk0\Partition10 === Partition numbers not in order!
link to \\?\Device\HarddiskVolume10
Fixed hard disk media. Block size = 512
size is 10734272512 bytes
\\?\Device\Harddisk0\Partition11
link to \\?\Device\HarddiskVolume11
Fixed hard disk media. Block size = 512
size is 19999490048 bytes
\\?\Device\Harddisk0\Partition12
link to \\?\Device\HarddiskVolume12
Fixed hard disk media. Block size = 512
size is 20971520000 bytes
\\?\Device\Harddisk0\Partition13
link to \\?\Device\HarddiskVolume13
Fixed hard disk media. Block size = 512
size is 26214400000 bytes
\\?\Device\Harddisk0\Partition14 === 5TB backup partition
link to \\?\Device\HarddiskVolume14
Fixed hard disk media. Block size = 512
size is 5438551621632 bytes
\\?\Device\Harddisk0\Partition2
link to \\?\Device\HarddiskVolume2
\\?\Device\Harddisk0\Partition3 === the 16MB hidden one
link to \\?\Device\HarddiskVolume3 No filesystem.
Fixed hard disk media. Block size = 512
size is 16777216 bytes
\\?\Device\Harddisk0\Partition4 === Since C: is in use, this
link to \\?\Device\HarddiskVolume4 is hidden from us.
\\?\Device\Harddisk0\Partition5
link to \\?\Device\HarddiskVolume5
Fixed hard disk media. Block size = 512
size is 40000028672 bytes
\\?\Device\Harddisk0\Partition6
link to \\?\Device\HarddiskVolume6
Fixed hard disk media. Block size = 512
size is 1024458752 bytes
\\?\Device\Harddisk0\Partition7
link to \\?\Device\HarddiskVolume7
Fixed hard disk media. Block size = 512
size is 120586240 bytes
\\?\Device\Harddisk0\Partition8
link to \\?\Device\HarddiskVolume8
Fixed hard disk media. Block size = 512
size is 38999687168 bytes
\\?\Device\Harddisk0\Partition9
link to \\?\Device\HarddiskVolume9
Fixed hard disk media. Block size = 512
size is 44040192000 bytes

\\?\Device\Harddisk1\Partition0 === beginning of second drive
link to \\?\Device\Harddisk1\DR0
Fixed hard disk media. Block size = 512
size is 57671680000 bytes
\\?\Device\Harddisk1\Partition1
link to \\?\Device\HarddiskVolume15
Fixed hard disk media. Block size = 512
size is 57668534272 bytes

Virtual input devices === sources of erasure data
/dev/zero (null data)
/dev/random (pseudo-random data)
- (standard input)

Virtual output devices
- (standard output)
/dev/null (discard the data)

*******

I can double-check by using "disktype /dev/sda" in Linux.
Then correlate. Not that it matters or anything. This
is just me, double checking stuff for fun.

--- /dev/sda
Block device, size 5.458 TiB (6001175126016 bytes)
GRUB boot loader, unknown compat version 0
DOS/MBR partition map
Partition 1: 2.000 TiB (2199023255040 bytes, 4294967295 sectors from 1)
Type 0xEE (EFI GPT protective) === GPT disks still have an MBR
....
Partition 4: 85.71 GiB (92034564096 bytes, 179755008 sectors from 1259520) === C:
Type Basic Data (GUID A2A0D0EB-E5B9-3344-87C0-68B6B72699C7)
Partition Name "Basic data partition"
Partition GUID C746389B-23FF-7249-9F0D-9333A4200D5D
NTFS file system === that's my Win C: drive
Volume size 85.71 GiB (92034563584 bytes, 179755007 sectors)
....
Partition 15: unused

*******

So now I know how big C: is. It's 92,034,564,096 bytes.

OK, now I'm booted from some media, ready to erase C: on the
hard drive. I can't be booted with C: because that will
prevent erasure.

I change directories to whatever partition has my copy of dd.exe

R:

dd.exe if=/dev/zero of=\\?\Device\Harddisk0\Partition4

And I know it's going to take a while to erase 92GB!

*******

Now, consulting the HP manual, we reboot for the last time.

There should be a "restore system" key to press, like F11 or something.

Press F11, and see if the thing offers to restore C: into
the (now completely empty) C: partition.

This assumes that F11 is the key that HP uses.

https://support.hp.com/doc-images/674/c01892852.gif

If you're not offered that option, or if the system won't
boot, use your Macrium ReflectFree rescue CD, connect the external
drive with the full disk backup image, and restore at least C:
from there. Shouldn't take long, as only a fraction of the
92GB will likely need to be restored by the software.

Because you always have a backup on hand...

Paul