System hacks: Microsoft version of “Ghost” Windows FFU

In the daily maintenance, system backup and restore is something that you often need to operate. Although Windows 10 has provided many tools, such as System Restore, WIM backup/restore, VHD backup, etc.. However, most of these tools are file-based backup/restore. We used to use Ghost, which is a sector-based backup/restore, and this tool can achieve very thorough backup and restore. Now Windows 10 introduces a similar tool, FFU Image Backup and Restore, which can achieve thorough backup and restore like Ghost.

What is FFU images backup and restore

The full name of FFU images is Full Flash Update images, which directly translates to Full Flash Update images. This image format was first used to update and install Microsoft mobile devices, such as Windows Mobile phones and Surface, which are similar to our Android and iPhone phones. However, since Windows 10 v1709, the system also supports FFU image format so that we can use this format for Windows 10 system backup and restore. To find out if your Windows 10 supports FFU images, just open Notepad, click on “Help → About Notepad” and check if your system is v1709 and above (Figure 1).


Figure 1 View system version information

As mentioned above, FFU is an image format, similar to Ghost’s GHO file. For Windows 10 systems, capturing FFU images can be done with the help of the DISM command that comes with the system. Since the DISM command only supports capturing of the entire hard disk, it uses sectors to save files, so you can make a complete backup of the entire hard disk, including the boot partition, recovery partition, data partition, etc. Because it backs up the entire hard drive, this backup method requires the support of two storage devices.

For single hard drive users, it is recommended to use a removable hard drive or a high-capacity USB flash drive (which needs to be formatted to NTFS format) to make a boot PE disk first, and then use the boot PE disk to enter and perform backup operations. For SSD + normal hard drive users, it is recommended to use a normal hard drive as the storage device and then enter the Windows 10 recovery environment and use the Dism command to backup the entire SSD hard drive. To reduce the size of the FFU image file, you can pre-launch the disk cleanup tool to clean up all unnecessary junk files (Figure 2).


Figure 2 Clean up junk files

After you finish cleaning the junk files, type “Change advanced startup options” in the search box, and then click “Restart now” under the advanced startup window (Figure 3).


Figure 3 Select Advanced Boot

After restarting the system, follow the instructions to enter the command prompt window of WinRE environment. Enter the command “wmic diskdrive list brief” to get the serial number of the disk that needs to be backed up, as in the example of this article.


Figure 4 Get disk serial number

Continue with the following command to perform a full backup of the SSD drive (Figure 5).

dism /capture-ffu /imagefile:d:ssd.ffu /capturedrive:\. physicaldrive0 /name:Disk0-W10Pro

Command explanation.

/capture-ffu: captures the disk using the capture command, /imagefile specifies the path and file name where the ffu format image is stored, /capturedrive specifies the drive to be captured, where \. physicaldrive0 means hard disk 0, here pay attention to choose the correct hard disk


Figure 5 Backup disk as FFU file


If you are using a large capacity USB flash drive for backup, you can also use “dism /split-image /imagefile:ssd.ffu /sfufile:winoem.sfu /filesize:3500” to split the file into multiple sizes 3500MB winoem*.sfu split file.

Thus, after capturing the FFU image file, we have completed the backup of the entire SSD hard drive. If we need to restore the system later, enter the WinRE repair environment (or PE system) as above and enter the following command to restore the entire hard drive image to the specified drive (Figure 6).

dism /apply-ffu /imagefile:d:ssd.ffu /applydrive:. physicaldrive0


Figure 6 Recovering the system

After successfully recovering the system this way and rebooting, the original SSD hard drive’s system and data can be fully recovered. The recovery effect is the same as a full disk recovery with GHOST. Since FFU is sector-based recovery, the above method is ideal for SSD+traditional hard drive users to backup/restore their systems. Here are some things to note

1. FFU images can only be recovered to a new hard drive with more (or the same) capacity than the original hard drive space.

2. Since it is a full disk recovery, you must make a good backup of the original data before recovery

Of course, the above method can also be used for the rapid deployment of new computers with the same configuration purchased by the company. So we just need to install Windows 10 on a new computer and plan a good partition, then use the removable hard disk for full disk backup, then use the removable hard disk to boot into the PE system, the same method as above to restore the FFU image file to the new computer can complete the installation of Windows 10 and partition planning to quickly achieve the deployment of the new computer system. If the restored computer has a different configuration, please use the “sysrprep” command to initialize the backup image file before capturing it.

Leave a Comment