Wimcapture
Wimcapture
NAME
wimcapture, wimappend − Capture or append a WIM image
SYNOPSIS
wimcapture SOURCE WIMFILE [IMAGE_NAME [IMAGE_DESC]] [OPTION...]
wimappend SOURCE WIMFILE [IMAGE_NAME [IMAGE_DESC]] [OPTION...]
DESCRIPTION
The wimcapture (equivalently: wimlib-imagex capture) and wimappend (equivalently: wimlib-imagex
append) commands create ("capture") a new Windows Imaging (WIM) image. wimcapture creates a new
WIM archive WIMFILE to contain the new image, while wimappend adds the image to the existing WIM
archive WIMFILE.
SOURCE specifies the location of the files from which to create the WIM image. If SOURCE is a directory
or a symbolic link pointing to a directory, then the image is captured from that directory as per DIREC-
TORY CAPTURE (UNIX) or DIRECTORY CAPTURE (WINDOWS). Alternatively, if --source-list
is specified, then SOURCE is interpreted as a file containing a list of files and directories to include in the
image. Still alternatively, if SOURCE is a UNIX block device, then an image is captured from the NTFS
volume on it as per NTFS VOLUME CAPTURE (UNIX).
IMAGE_NAME and IMAGE_DESC specify the name and description to give the new image. If
IMAGE_NAME is unspecified, it defaults to the filename component of SOURCE, appending a unique suf-
fix if needed. Otherwise, IMAGE_NAME must be either a name not already used by an image in WIM-
FILE, or the empty string to create an unnamed image. If IMAGE_DESC is unspecified then the new image
is given no description.
If WIMFILE is specified as "-", then the --pipable option is assumed and a pipable WIM is written to stan-
dard output (this is a wimlib extension).
DIRECTORY CAPTURE (UNIX)
On UNIX-like systems, if SOURCE specifies a directory or a symbolic link to a directory, then the WIM
image will be captured from that directory. The directory can be on any type of filesystem, and mount-
points are followed. In this mode, the following types of information are captured:
• Directories and regular files, and the contents of regular files
• Hard links
• Symbolic links (translated losslessly to Windows reparse points)
• Last modification times (mtime) and last access times (atime) with 100 nanosecond granularity
• Files that appear to be sparse will be flagged as such, but their full data will still be stored, subject to
the usual compression.
• With --unix-data: standard UNIX file permissions (owner, group, and mode)
• With --unix-data: device nodes, named pipes, and sockets
• With --unix-data: extended attributes (Linux only)
There is no support for storing last status change times (ctimes), or hard link information for symlinks
(each symlink will be stored as a separate file). Also, filenames and symlink targets which are not valid
UTF-8 with the addition of surrogate codepoints are unsupported. Note that if you have a filesystem con-
taining filenames in another multibyte encoding, such as ISO-8859-1, and you wish to archive it with wim-
lib, you may be able to mount it with an option which causes its filenames to be presented as UTF-8.
NTFS VOLUME CAPTURE (UNIX)
On UNIX-like systems, SOURCE may also be specified as a block device (e.g. /dev/sda3) containing an
unmounted NTFS volume. In this mode, wimcapture uses libntfs-3g to capture a WIM image from root
directory of the NTFS volume. In this mode, as much data and metadata as possible is captured, including
NTFS-specific and Windows-specific metadata:
• All data streams of all unencrypted files, including the unnamed data stream as well as all named data
streams.
--solid
With wimcapture, create a "solid" WIM file that compresses files together rather than indepen-
dently. This results in a significantly better compression ratio, but it comes at the cost of slow com-
pression with very high memory usage, reduced compatibility, and slow random access to the result-
ing WIM file.
By default this enables solid LZMS compression, thereby creating a file equivalent to one created
with DISM’s /compress:recovery option. Such files are also called "ESD files" and were first sup-
ported by WIMGAPI in Windows 8, by DISM in Windows 8.1, and by 7-Zip 15.12.
--solid-compress=TYPE[:LEVEL]
Like --compress, but set the compression type used in solid resources. The default is LZMS com-
pression. This option only has an effect when --solid is also specified.
--solid-chunk-size=SIZE
Like --chunk-size, but set the chunk size used in solid resources. The default, assuming LZMS
compression, is 64MiB (67108864); this requires about 640MiB of memory per thread. This option
only has an effect when --solid is also specified. Note: Microsoft’s WIM software is not compatible
with LZMS chunk sizes larger than 64MiB.
--threads=NUM_THREADS
Number of threads to use for compressing data. Default: autodetect (number of available CPUs).
--rebuild
With wimappend, rebuild the entire WIM rather than appending the new data to the end of it.
Rebuilding the WIM is slower, but will save some space that would otherwise be left as a hole in the
WIM. Also see wimoptimize(1).
--flags=EDITIONID
Specify a string to use in the <FLAGS> element of the XML data for the new image.
--image-property NAME=VALUE
Assign an arbitrary property to the new image in the XML document of the WIM. VALUE is the
string to set as the property value. NAME is the name of the image property, for example "NAME",
"DESCRIPTION", or "TOTALBYTES". The name can contain forward slashes to indicate a nested
XML element; for example, "WINDOWS/VERSION/BUILD" indicates the BUILD element nested
within the VERSION element nested within the WINDOWS element. A bracketed number can be
used to indicate one of several identically-named elements; for example, "WINDOWS/LAN-
GUAGES/LANGUAGE[2]" indicates the second "LANGUAGE" element nested within the "WIN-
DOWS/LANGUAGES" element. When adding a list of elements in this way, they must be specified
in sequential order. Note that element names are case-sensitive. This option may be specified mul-
tiple times.
--dereference
(UNIX-like systems only) Follow symbolic links and archive the files they point to, rather than ar-
chiving the links themselves.
--config=FILE
Specifies a configuration file (UTF-8 or UTF-16LE encoded; plain ASCII also works) for capturing
the new image. The configuration file specifies files that are to be treated specially during the image
capture.
The format of the configuration file is INI-style; that is, it is arranged in bracketed sections. Cur-
rently, the following sections are recognized:
• [ExclusionList] --- contains a list of path globs to exclude from capture. If a directory is
matched, both the directory and its contents are excluded.
• [ExclusionException] --- contains a list of path globs to include in the capture, even when the
file or directory also matches a glob in [ExclusionList].
• [PrepopulateList] --- this does not affect capture, but if the image is applied later with --wim-
boot, these are globs of files that shall be extracted normally, not as WIMBoot "pointer files".
If a directory is matched, all files and subdirectories are also matched recursively.
Path globs may contain the ’*’ and ’?’ meta-characters. Relative globs (e.g. *.mp3) match against a
filename in any directory. Absolute globs (e.g. /dir/file), are treated as paths starting at the main
directory being captured, or the root of the NTFS volume for NTFS volume capture mode. Do not
use drive letters in the paths; they will be ignored. Path separators may be either forwards slashes or
backwards slashes.
Lines beginning with the ’#’ or ’;’ characters are treated as comments and ignored. Globs with
whitespace in them need not be quoted; however, if they are, both double and single quotes are
accepted.
If this option is not specified the following default configuration file is used:
[ExclusionList]
\$ntfs.log
\hiberfil.sys
\pagefile.sys
\swapfile.sys
\System Volume Information
\RECYCLER
\Windows\CSC
However, special behavior applies if --wimboot is also specified. By default, with --wimboot spec-
ified, the file Windows/System32/WimBootCompress.ini in the directory being captured will be
used as the configuration file. However, this can be overridden using --config; and this also causes
the specified configuration file to be saved in the WIM image as Windows/System32/WimBoot-
Compress.ini, overriding any that may be present on the filesystem.
--unix-data
(UNIX-like systems only) Store UNIX-specific metadata and special files. This includes: standard
UNIX file permissions (owner, group, and mode); device nodes, named pipes, and sockets; and
extended attributes (Linux only). This information can later be restored by wimapply with the
--unix-data option.
UNIX-specific information is ignored by Microsoft’s WIM software and by the Windows version of
wimlib.
--no-acls
Do not capture files’ security descriptors.
--strict-acls
Fail immediately if the full security descriptor of any file cannot be read. On Windows, the default
behavior without this option is to first try omitting the SACL from the security descriptor, then to try
omitting the security descriptor entirely. The purpose of this is to capture as much data as possible
without always requiring Administrator privileges. However, if you desire that all security descrip-
tors be captured exactly, you may wish to provide this option, although the Administrator should
have permission to read everything anyway.
--rpfix, --norpfix
Set whether to fix targets of absolute symbolic links (reparse points in Windows terminology) or
not. When enabled (--rpfix), absolute symbolic links that point inside the directory tree being cap-
tured will be adjusted to be absolute relative to the root of the directory tree being captured. When
disabled (--norpfix), absolute symbolic links will be captured exactly as is.
The default behavior of wimcapture is equivalent to --rpfix. The default behavior of wimappend
is equivalent to --rpfix if reparse point fixups have previously been done on WIMFILE, otherwise
--norpfix.
rebuilt each time it is appended to; and when piping such a WIM to wimapply to extract an
image, some unneeded data will be sent over the pipe.
• Although a pipable WIM image may be updated using wimupdate, it requires a full rebuild of
the WIM file, making it less efficient than updating a non-pipable WIM.
• Solid pipable WIMs are not yet supported.
--not-pipable
With wimappend, rebuild the WIM file in the non-pipable (regular) format. This option is only
useful if you happen to be adding an image to a pipable WIM (see --pipable) which you want in
non-pipable format instead. Note that wimoptimize(1) can also be used to convert between non-
pipable and pipable WIMs.
--update-of=[WIMFILE:]IMAGE
Hint that the image being captured or appended from SOURCE is mostly the same as the existing
image IMAGE in WIMFILE, but captured at a later point in time, possibly with some modifications
in the intervening time. This is designed to be used in incremental backups of the same filesystem
or directory tree. IMAGE can be a 1-based index or name of an existing image in WIMFILE. It can
also be a negative integer to index backwards into the images (e.g. -1 means the last existing image
in WIMFILE).
When this option is provided, the capture or append of the new image will be optimized by not
reading files that, based on metadata such as timestamps, appear not to have been modified since
they were archived in the existing IMAGE. Barring manipulation of timestamps, this option only
affects performance and does not change the resulting WIM image (but see note below).
As shown, the full syntax for the argument to this option is to specify the WIM file, a colon, and the
image; for example, "--update-of mywim.wim:1". However, the WIM file and colon may be omit-
ted if --delta-from is specified exactly once, in which case the WIM defaults to that specified in
--delta-from, or if the operation is wimappend rather wimcapture, in which case the WIM
defaults to the one being appended to.
Note: in the Windows version of wimlib, it has been observed that --update-of mode is not com-
pletely reliable at detecting changes in file contents, sometimes causing the old contents of a few
files to be archived rather than the current contents. The cause of this problem is that Windows does
not immediately update a file’s last modification timestamp after every write to that file. Unfortu-
nately, there is no known way for applications like wimlib to automatically work around this bug.
Manual workarounds are possible; theoretically, taking any action that causes the problematic files
to be closed, such as restarting applications or the computer itself, should cause the files’ last modi-
fication timestamps to be updated. Also note that wimlib compares file sizes as well as timestamps
in determining whether a file has changed, which helps make the problem less likely to occur; and
the problem does not occur on other operating systems such as Linux which maintain files’ last
modification timestamps correctly.
--delta-from=WIMFILE
Capture or append the new image as a "delta" from WIMFILE. Any file data that would ordinarily
need to be archived in the new or updated WIM is omitted if it is already present in the WIMFILE
on which the delta is being based. The resulting WIM will still contain a full copy of the image
metadata, but this is typically only a small fraction of a WIM’s total size.
This option can be specified multiple times, in which case the resulting delta WIM will only contain
file data not present in any of the specified base WIMs.
To operate on the resulting delta WIM using other commands such as wimapply, you must specify
the delta WIM as the WIM file to operate on, but also reference the base WIM(s) using the --ref
option. Beware: to retain the proper functioning of the delta WIM, you can only add, not delete,
files and images to the base WIM(s) following the capture of a delta from it.
--delta-from may be combined with --update-of to increase the speed of capturing a delta WIM.
(initial backup)
rebuilt (e.g. with --rebuild), in which case you should delete the temporary file left over.
wimlib-imagex creates WIMs compatible with Microsoft’s software (WIMGAPI, ImageX, DISM), with
some caveats:
• With wimlib-imagex on UNIX-like systems, it is possible to create a WIM image containing files with
names differing only in case, or files with names containing the characters ’:’, ’*’, ’?’, ’"’, ’<’, ’>’, ’|’,
or ’\’, which are valid on POSIX-compliant filesystems but not Windows. Be warned that such files
will not be extracted by default by the Windows version of wimlib-imagex, and (even worse) Micro-
soft’s ImageX can be confused by such names and quit extracting the image partway through.
• Pipable WIMs are incompatible with Microsoft’s software. Pipable WIMs are created only if WIM-
FILE was specified as "-" (standard output) or if the --pipable flag was specified.
• WIMs captured with a non-default chunk size (with the --chunk-size option) or as solid archives (with
the --solid option) or with LZMS compression (with --compress=LZMS or --compress=recovery)
have varying levels of compatibility with Microsoft’s software. Generally, more recent versions of Mi-
crosoft’s software are more compatible.
EXAMPLES
First example: Create a new WIM ’mywim.wim’ with LZX ("maximum") compression that will contain a
captured image of the directory tree ’somedir’. Note that the image name need not be specified and will
default to ’somedir’:
wimcapture somedir mywim.wim
Next, append the image of a different directory tree to the WIM created above:
wimappend anotherdir mywim.wim
Easy enough, and the above examples of imaging directory trees work on both UNIX-like systems and
Windows. Next, capture a WIM with several non-default options, including XPRESS ("fast") compression,
extra integrity information, no messing with absolute symbolic links, and an image name and description:
wimcapture somedir mywim.wim --compress=fast \
--check --norpfix "Some Name" "Some Description"
On a UNIX-like system, capture a full NTFS volume into a new WIM using the NTFS VOLUME CAP-
TURE (UNIX) mode, and name the image "Windows 7":
wimcapture /dev/sda2 windows7.wim "Windows 7"
or, on Windows, to capture a full NTFS volume you instead need to specify the root directory of the
mounted volume, for example:
wimcapture E:\ windows7.wim "Windows 7"
Same as UNIX example above, but capture the WIM in the wimlib-specific "pipable" format that can be
piped to wimapply:
wimcapture /dev/sda2 windows7.wim "Windows 7" --pipable
Same as above, but instead of writing the pipable WIM to the file "windows7.wim", write it directly to stan-
dard output through a pipe into some other program "someprog", which could, for example, be a program
or script that streams the data to a server:
wimcapture /dev/sda2 - "Windows 7" | someprog
SEE ALSO
wimlib-imagex(1), wimapply(1) wimoptimize(1)