Please note that although I have used the term WinPE (Windows Preinstallation Environment) throughout this document, the information here is equally applicable to WinFE (Windows Forensic Environment). I am assuming that you (dear reader) have a prior knowledge of WinPE - I am not going to cover the operating system itself in any detail. See here for a summary of WinPE.
RAM requirements for different versions of WinPE are not particularly well documented. I have therefore taken it upon myself to carry out a few tests following a request for clarification about WinPE RAM usage by Reboot.pro forum member Wonko the Sane - thanks to Wonko and fellow reboot.pro forum member erwan.l for their support and contributions. See here for a comparison of the different WinPE versions/features.
There are two distinct methods for booting WinPE -
RAM boot is ideal for PXE boot, booting from readonly media (e.g. CD/DVD) and booting older (pre Winpe 4.0) versions of WinPE from a USB drive. All WinPE versions since 2.0 (introduced with Windows Vista) essentially work in the same way - boot.wim is copied to RAM and a writable RAM disk is also created (referred to as a scratchspace) for system settings, running programs, etc. As boot.wim is copied to (and stays in) memory you must have at least the amount of RAM as the file size of boot.wim + scratch space + memory required to run the operating system and any programs.
All versions of WinPE use a default sized Scratchspace when the RAM Boot method is used. It's possible to change the size of the scratchspace on all versions of WinPE except WinPE 5.x. Microsoft documentation states that Ram Disks (Scratchspace) of 32, 64, 128, 256, and 512 (MB's) are supported - there are reports of up to 1GB working in some versions (see here). Default sizes (in MB's) -
See here for instructions on creating a Flat Boot USB drive.
Microsoft refer to Flat Boot as a non-RAMDISK boot - unlike the standard method for booting WinPE the operating system files are not copied into RAM. As a result the boot media must be accessible and cannot be removed whilst WinPE is running. Whilst the Operating System files themselves are not copied into RAM, in the case of WinPE 3.1 a writable RAM Disk (Scratchspace - refer to RAM Boot section) is created when running from read-only media. This is essentially a File Based Write Filter to allow read and write access to read only media - required for some system settings and running certain programs.
It's possible to Flat Boot all versions of WinPE from a hard disk drive. WinPE 2.1/3.x can also be (Flat) booted from read-only media such as a DVD. WinPE 5.1 cannot be Flat Booted from read-only media, however it can be booted from a UFD or USB HDD - something that is not possible with WinPE 2.1/3.x. Attempting to Flat Boot WinPE 3.1 from a USB Drive will result in a 0x7b STOP ERROR as the USB Drivers are not loaded early enough in the boot process - resulting in an inaccessible boot device.
Microsoft describe one advantage of Flat Boot here -
The following table displays which media it's possible to (Flat) boot the different versions of WinPE from -
| WinPE | 2.1 | 3.0 | 3.1 | 4.0 | 5.0 | 5.1 |
|---|---|---|---|---|---|---|
| USB Boot | ? | ? | ✘ | ? | ? | ✔ |
| DVD Boot | ✔ | ✔ | ✔ | ? | ? | ✘ |
| HDD Boot | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Whilst most older versions of WinPE do not support Flat Booting from USB devices, it is possible to Flat Boot WinPE 3.1 from this form of media with two minor registry changes. Note - this is not supported on all hardware. Thanks to Reboot.pro forum member cdob for reporting these settings (see links in post here).
The required settings are as follows (please note that these settings should be applied to an OFFLINE WinPE System Registry Hive) -
or, using the reg.exe add command -
The tests were carried out in a virtual environment using VMwarePlayer - which is free for personal use. I used a modified base - boot.wim from 32-bit Windows source DVD's, which was then customised by adding the following programs -
| Original | Modified | |
|---|---|---|
| WinPE 2.1 | 126 | 131 |
| WinPE 3.0 | 137 | 144 |
| WinPE 3.1 | 138 | 144 |
| WinPE 4.0 | 157 | 167 |
| WinPE 5.0 | 166 | 176 |
| WinPE 5.1 | 189 | 197 |
I chose to build from Windows source DVD's for convenience - using the MistyPE project.
The virtual machine comprised of three hard disk drive -
The aim of the first test was to establish the absolute minimum RAM required in order for WinPE to boot without error and run Task Manager and A43 (file manager). I ran a number of tests using different RAM settings - reducing RAM in 4 MB increments until WinPE failed to boot or Taskmgr/a43 failed to run. Please note that the builds tested are minimal builds with few modifications. Warning - just because it boots doesn't mean it will run any programs or be stable!
| RAM Boot | Flat Boot | |
|---|---|---|
| WinPE 2.1 | 252 | 108 |
| WinPE 3.0 | 264 | 108 |
| WinPE 3.1 | 264 | 108 |
| WinPE 4.0 | 412 | 76 |
| WinPE 5.0 | 372 | 84 |
| WinPE 5.1 | 416 | 84 |
Based on similarities in terms of the RAM requirements established in the first test I decided to place the WinPE versions into two groups -
The aim of Test 2 was to check whether a RAM Booted WinPE could actually run more demanding applications on a low RAM system. I choose to run Group 1 on a virtual system with 256 MB RAM and Group 2 on a virtual system with 512 MB RAM - RAM configurations commonly in use on older hardware.
Due to my current interest in using the Windows Forensic Environment as an acquisition platform I decided to use disk imaging as the task for this test, attempting to run three different applications -
Group 1 - time (in seconds) taken to image a 1GB HDD -
| RAM=256 MB | Clonedisk | DMDE | WinHex |
|---|---|---|---|
| WinPE 2.1 | 142 | error | 142 |
| WinPE 3.0 | 26 | error | 44 |
| WinPE 3.1 | 26 | error | 43 |
Group 2 - time (in seconds) taken to image a 1GB HDD -
| RAM=512 MB | Clonedisk | DMDE | WinHex |
|---|---|---|---|
| WinPE 4.0 | 24 | 28 | 45 |
| WinPE 5.0 | 24 | 26 | 45 |
| WinPE 5.1 | 23 | 28 | 44 |
Group 1 - with 256 MB RAM it was not possible to run DMDE on WinPE 2.1/3.x. The same setup was reused with the addition of 512MB of virtual memory (pagefile) in WinPE 2.1/3.x (created using the wpeutil CreatePageFile /path=c:\pagefile.sys /size=512 command). Time (in seconds) taken to image a 1GB HDD -
| RAM=256 MB | Clonedisk | DMDE | WinHex |
|---|---|---|---|
| WinPE 2.1 | 29 | 29 | 45 |
| WinPE 3.0 | 27 | 29 | 43 |
| WinPE 3.1 | 27 | 29 | 44 |
Test 3 was similar to Test 2, however a virtual system with 128 MB of RAM was used to test the same disk imaging software using Flat Booted WinPE's. All versions were installed to a virtual hard disk so that a fair comparison could be made.
During initial tests I noticed a big distinction between pre version 4.0 WinPE's - WinPE versions 2.1 and 3.x failed to run one of the applications being tested (DMDE). This is perhaps due to WinPE 4.0 and 5.x also allocating virtual memory when flat booted from a hard disk.
Due to concerns that different versions of WinPE might allocate a different amount of virtual memory (the pagefile), which would lead to unfair comparisons, I changed the registry settings in WinPE 4.0/5.x to limit the pagefile to a fixed size of 512 MB.
Time (in seconds) taken to image a 1GB HDD -
| RAM=128 MB | Clonedisk | DMDE | WinHex |
|---|---|---|---|
| WinPE 2.1 | 123 | error | 108 |
| WinPE 3.0 | 25 | error | 45 |
| WinPE 3.1 | 25 | error | 44 |
| WinPE 4.0 | 23 | 26 | 38 |
| WinPE 5.0 | 38 | 42 | 51 |
| WinPE 5.1 | 30 | 41 | 48 |
With 128 MB RAM it was not possible to run DMDE on WinPE 2.1/3.x. The same setup was reused with the addition of 512MB of virtual memory (pagefile) in WinPE 2.1/3.x (created using the wpeutil CreatePageFile /path=c:\pagefile.sys /size=512 command). The following table shows the time taken (in seconds) to image the same 1GB virtual disk when 512 MB virtual memory was used -
| RAM=128 MB | Clonedisk | DMDE | WinHex |
|---|---|---|---|
| WinPE 2.1 | 25 | 25 | 45 |
| WinPE 3.0 | 25 | 28 | 45 |
| WinPE 3.1 | 25 | 28 | 44 |
With the additional virtual memory it was possible to run DMDE in all WinPE versions. In terms of Clonedisk and WinHex, the use of virtual memory failed to make any noticable speed improvements in WinPE 3.x - there was however a significant speed increase in WinPE 2.1.
The table below shows the size (in MB's) of boot.wim before (Original Size) and after (Modified Size) modifications. Remember, boot.wim from Windows Source DVD's has been used. The Minimum RAM shows the results from test 1 (see here) -
| Original Size | Modified Size | Minimum RAM | |
|---|---|---|---|
| WinPE 2.1 | 126 | 131 | 252 |
| WinPE 3.0 | 137 | 144 | 264 |
| WinPE 3.1 | 138 | 144 | 264 |
| WinPE 4.0 | 157 | 167 | 412 |
| WinPE 5.0 | 166 | 176 | 372 |
| WinPE 5.1 | 189 | 197 | 416 |
For comparison purposes this test used an unmodified boot.wim from the Windows Automated Installation Kit (WAIK) / Windows Assessment and Deployment Kit (ADK) to test the mimimum RAM Requirements for these builds. These are unmodified boot.wim files running CMD.exe shell. The Minimum RAM shows the RAM requirements for booting WinPE without error and running Task Manager and a basic file manager (a43). Please note that a43 was not copied to boot.wim and was executed from a (virtual) hard disk drive -
| Boot.wim Size | Minimum RAM | |
|---|---|---|
| WinPE 2.1 | 174 | 312 |
| WinPE 3.0 | 108 | 232 |
| WinPE 3.1 | 109 | 232 |
| WinPE 4.0 | 126 | 328 |
| WinPE 5.0 | 133 | 288 |
| WinPE 5.1 | ? | ? |
Based upon performance in the tests documented here, the different WinPE versions can be split into two distinct groups -
| Group 1 | WinPE 2.1 | WinPE 3.0 | WinPE 3.1 |
| Group 2 | WinPE 4.0 | WinPE 5.0 | WinPE 5.1 |
Based upon the test results it is possible to run all versions of WinPE on a system with only 128 MB of system RAM - providing that the Flat Boot method is used. To improve performance a pagefile should also be used in WinPE 2.1/3.x.
It's possible to RAM Boot all of the Group 1 WinPE versions on a system with 256 MB or more RAM. The use of a pagefile will improve performance and allow more programs to be run without error.
It's possible to RAM Boot all of the Group 2 WinPE versions on a system with 512 MB or more RAM.
The size of boot.wim will have a direct impact on RAM requirements when RAM Booting all versions of WinPE. Avoid adding any files to boot.wim if possible. Also avoid adding/running any services as these will also increase the RAM requirements.