WinPE - Minimum RAM Requirements


Please note that although I have used the term WinPE (Windows Preinstallation Environment) throughout this document, the information here is equally applicable to WinFE (Windows Forensic Environment). I am assuming that you (dear reader) have a prior knowledge of WinPE - I am not going to cover the operating system itself in any detail. See here for a summary of WinPE.

RAM requirements for different versions of WinPE are not particularly well documented. I have therefore taken it upon myself to carry out a few tests following a request for clarification about WinPE RAM usage by forum member Wonko the Sane - thanks to Wonko and fellow forum member erwan.l for their support and contributions. See here for a comparison of the different WinPE versions/features.

There are two distinct methods for booting WinPE -

RAM Boot

RAM boot is ideal for PXE boot, booting from readonly media (e.g. CD/DVD) and booting older (pre Winpe 4.0) versions of WinPE from a USB drive. All WinPE versions since 2.0 (introduced with Windows Vista) essentially work in the same way - boot.wim is copied to RAM and a writable RAM disk is also created (referred to as a scratchspace) for system settings, running programs, etc. As boot.wim is copied to (and stays in) memory you must have at least the amount of RAM as the file size of boot.wim + scratch space + memory required to run the operating system and any programs.

All versions of WinPE use a default sized Scratchspace when the RAM Boot method is used. It's possible to change the size of the scratchspace on all versions of WinPE except WinPE 5.x. Microsoft documentation states that Ram Disks (Scratchspace) of 32, 64, 128, 256, and 512 (MB's) are supported - there are reports of up to 1GB working in some versions (see here). Default sizes (in MB's) -

In regards to WinPE 5.x - it's possible to set a user defined Scratchspace size, however this will be ignored if the system has more than 1GB of RAM. If more than 1GB of RAM is available then the RAM disk will be set to 512MB. If the system has 1GB or less RAM then the size will default to a smaller disk (in the case of WinPE 5.x this appears to be 32MB - unless this value has been changed in the registry).

Flat Boot

See here for instructions on creating a Flat Boot USB drive.

Microsoft refer to Flat Boot as a non-RAMDISK boot - unlike the standard method for booting WinPE the operating system files are not copied into RAM. As a result the boot media must be accessible and cannot be removed whilst WinPE is running. Whilst the Operating System files themselves are not copied into RAM, in the case of WinPE 3.1 a writable RAM Disk (Scratchspace - refer to RAM Boot section) is created when running from read-only media. This is essentially a File Based Write Filter to allow read and write access to read only media - required for some system settings and running certain programs.

It's possible to Flat Boot all versions of WinPE from a hard disk drive. WinPE 2.1/3.x can also be (Flat) booted from read-only media such as a DVD. WinPE 5.1 cannot be Flat Booted from read-only media, however it can be booted from a UFD or USB HDD - something that is not possible with WinPE 2.1/3.x. Attempting to Flat Boot WinPE 3.1 from a USB Drive will result in a 0x7b STOP ERROR as the USB Drivers are not loaded early enough in the boot process - resulting in an inaccessible boot device.

Microsoft describe one advantage of Flat Boot here -

The following table displays which media it's possible to (Flat) boot the different versions of WinPE from -

  WinPE     2.1     3.0     3.1     4.0     5.0     5.1  
USB Boot ? ? ? ?
DVD Boot ? ?
HDD Boot

Whilst most older versions of WinPE do not support Flat Booting from USB devices, it is possible to Flat Boot WinPE 3.1 from this form of media with two minor registry changes. Note - this is not supported on all hardware. Thanks to forum member cdob for reporting these settings (see links in post here).

The required settings are as follows (please note that these settings should be applied to an OFFLINE WinPE System Registry Hive) -
or, using the reg.exe add command -

Test System

The tests were carried out in a virtual environment using VMwarePlayer - which is free for personal use. I used a modified base - boot.wim from 32-bit Windows source DVD's, which was then customised by adding the following programs -

No services were added. Only a few files were added to the system32 directory (including ExplorerFrame.dll and Shellsytle.dll). A few registry keys were added/changed (mainly file associations and some minor tweaks). The following lists boot.wim sizes in MB's before and after modification -
  WinPE 2.1   126 131
  WinPE 3.0   137 144
  WinPE 3.1   138 144
  WinPE 4.0   157 167
  WinPE 5.0   166 176
  WinPE 5.1   189 197

I chose to build from Windows source DVD's for convenience - using the MistyPE project.

The virtual machine comprised of three hard disk drive -

Test 1 (Minimum RAM Requirements)

The aim of the first test was to establish the absolute minimum RAM required in order for WinPE to boot without error and run Task Manager and A43 (file manager). I ran a number of tests using different RAM settings - reducing RAM in 4 MB increments until WinPE failed to boot or Taskmgr/a43 failed to run. Please note that the builds tested are minimal builds with few modifications. Warning - just because it boots doesn't mean it will run any programs or be stable!

RAM BootFlat Boot
  WinPE 2.1   252 108
  WinPE 3.0   264 108
  WinPE 3.1   264 108
  WinPE 4.0   412 76
  WinPE 5.0   372 84
  WinPE 5.1   416 84

Test 2 (RAM Boot Tests)

Based on similarities in terms of the RAM requirements established in the first test I decided to place the WinPE versions into two groups -

The aim of Test 2 was to check whether a RAM Booted WinPE could actually run more demanding applications on a low RAM system. I choose to run Group 1 on a virtual system with 256 MB RAM and Group 2 on a virtual system with 512 MB RAM - RAM configurations commonly in use on older hardware.

Due to my current interest in using the Windows Forensic Environment as an acquisition platform I decided to use disk imaging as the task for this test, attempting to run three different applications -

Whilst this is not necessarily the most demanding test in terms of RAM usage, it's a task that I would actually use WinPE for. The disk imaging test comprised of copying a 1GB virtual hard disk to a 5GB virtual hard disk - either copying to a NTFS Compressed folder or saving the file as NTFS Compressed.

Group 1 - time (in seconds) taken to image a 1GB HDD -

RAM=256 MB Clonedisk DMDE WinHex
  WinPE 2.1   142 error 142
  WinPE 3.0   26 error 44
  WinPE 3.1   26 error 43

Group 2 - time (in seconds) taken to image a 1GB HDD -

RAM=512 MB Clonedisk DMDE WinHex
  WinPE 4.0   24 28 45
  WinPE 5.0   24 26 45
  WinPE 5.1   23 28 44

Group 1 - with 256 MB RAM it was not possible to run DMDE on WinPE 2.1/3.x. The same setup was reused with the addition of 512MB of virtual memory (pagefile) in WinPE 2.1/3.x (created using the wpeutil CreatePageFile /path=c:\pagefile.sys /size=512 command). Time (in seconds) taken to image a 1GB HDD -

RAM=256 MB Clonedisk DMDE WinHex
  WinPE 2.1   29 29 45
  WinPE 3.0   27 29 43
  WinPE 3.1   27 29 44
Not only was DMDE able to run, observe the significant speed increase in WinPE 2.1 when virtual memory is also allocated.

Test 3 (Flat Boot Tests)

Test 3 was similar to Test 2, however a virtual system with 128 MB of RAM was used to test the same disk imaging software using Flat Booted WinPE's. All versions were installed to a virtual hard disk so that a fair comparison could be made.

During initial tests I noticed a big distinction between pre version 4.0 WinPE's - WinPE versions 2.1 and 3.x failed to run one of the applications being tested (DMDE). This is perhaps due to WinPE 4.0 and 5.x also allocating virtual memory when flat booted from a hard disk.

Due to concerns that different versions of WinPE might allocate a different amount of virtual memory (the pagefile), which would lead to unfair comparisons, I changed the registry settings in WinPE 4.0/5.x to limit the pagefile to a fixed size of 512 MB.

Time (in seconds) taken to image a 1GB HDD -

RAM=128 MB Clonedisk DMDE WinHex
  WinPE 2.1   123 error 108
  WinPE 3.0   25 error 45
  WinPE 3.1   25 error 44
  WinPE 4.0   23 26 38
  WinPE 5.0   38 42 51
  WinPE 5.1   30 41 48

With 128 MB RAM it was not possible to run DMDE on WinPE 2.1/3.x. The same setup was reused with the addition of 512MB of virtual memory (pagefile) in WinPE 2.1/3.x (created using the wpeutil CreatePageFile /path=c:\pagefile.sys /size=512 command). The following table shows the time taken (in seconds) to image the same 1GB virtual disk when 512 MB virtual memory was used -

RAM=128 MB Clonedisk DMDE WinHex
  WinPE 2.1   25 25 45
  WinPE 3.0   25 28 45
  WinPE 3.1   25 28 44

With the additional virtual memory it was possible to run DMDE in all WinPE versions. In terms of Clonedisk and WinHex, the use of virtual memory failed to make any noticable speed improvements in WinPE 3.x - there was however a significant speed increase in WinPE 2.1.

Test 4

The table below shows the size (in MB's) of boot.wim before (Original Size) and after (Modified Size) modifications. Remember, boot.wim from Windows Source DVD's has been used. The Minimum RAM shows the results from test 1 (see here) -

Original Size Modified Size Minimum RAM
  WinPE 2.1   126 131 252
  WinPE 3.0   137 144 264
  WinPE 3.1   138 144 264
  WinPE 4.0   157 167 412
  WinPE 5.0   166 176 372
  WinPE 5.1   189 197 416

For comparison purposes this test used an unmodified boot.wim from the Windows Automated Installation Kit (WAIK) / Windows Assessment and Deployment Kit (ADK) to test the mimimum RAM Requirements for these builds. These are unmodified boot.wim files running CMD.exe shell. The Minimum RAM shows the RAM requirements for booting WinPE without error and running Task Manager and a basic file manager (a43). Please note that a43 was not copied to boot.wim and was executed from a (virtual) hard disk drive -

Boot.wim Size Minimum RAM
  WinPE 2.1   174 312
  WinPE 3.0   108 232
  WinPE 3.1   109 232
  WinPE 4.0   126 328
  WinPE 5.0   133 288
  WinPE 5.1   ? ?


Based upon performance in the tests documented here, the different WinPE versions can be split into two distinct groups -

  Group 1   WinPE 2.1 WinPE 3.0 WinPE 3.1

  Group 2   WinPE 4.0 WinPE 5.0 WinPE 5.1

Based upon the test results it is possible to run all versions of WinPE on a system with only 128 MB of system RAM - providing that the Flat Boot method is used. To improve performance a pagefile should also be used in WinPE 2.1/3.x.

It's possible to RAM Boot all of the Group 1 WinPE versions on a system with 256 MB or more RAM. The use of a pagefile will improve performance and allow more programs to be run without error.

It's possible to RAM Boot all of the Group 2 WinPE versions on a system with 512 MB or more RAM.

The size of boot.wim will have a direct impact on RAM requirements when RAM Booting all versions of WinPE. Avoid adding any files to boot.wim if possible. Also avoid adding/running any services as these will also increase the RAM requirements.