Join Us!

Microsoft Surface P...
 
Notifications
Clear all

Microsoft Surface Pro 3 Imaging?  

  RSS
erowe
(@erowe)
Active Member

I've been doing some research and testing on how to image the Surface Pro 3 without cracking it open and removing the SSD and I’m not having much luck.

If you have the password FTK Imager works fine from an external USB. The problem there is of course that you’re using the suspect’s live device to image it and leaving all the associated footprints of your activity on it. You also need their cooperation.

Booting to a forensic distro is what I really want to do, but it looks like things are pretty locked down. I can make a UEFI bootable USB using Rufus, but even after changing the BIOS settings I can’t get to a point where the Surface will boot from it. I get an initial red screen and then get redirected to a Bit Locker recovery screen that I can’t get around.

Has anyone had any success imaging Surfaces? I gather there are similar problems booting to some all-in-one computers.

All the videos and publications seem to point to the fact that you used to be able to boot to a USB but no longer can. (Although post I found on Symatec’s forum claims boot USBs created with the Symantec System Restore Wizard works.)

Thanks.

Eric

Quote
Posted : 27/02/2015 7:41 pm
jaclaz
(@jaclaz)
Community Legend

How EXACTLY did you set the BIOS rectius stupid UEFI firmware?

http//winsupersite.com/mobile-devices/surface-pro-3-tip-access-firmware

It is possible that there is in your case the combination of two things, any among the Secureboot/TPC and an additional bitlocker "layer".

The Surface Pro 3 is reportedly somehow "different" or "more picky" than earlier Surfaces and of most other "All in one", but installing to it - say - Ubuntu is possible
http//blog.davidelner.com/dual-booting-ubuntu-14-10-on-the-surface-pro-3/
or debian
http//winaero.com/blog/how-to-install-linux-on-surface-pro-3/
or suse
https://forums.opensuse.org/showthread.php/502637-Guide-Run-OpenSUSE-on-Surface-Pro-3-dual-boot-with-Windows!

So the issue may be on the actual specific "Rufus made" UEFI boot stick, as there are as well reports of "Rufus made" USB sticks used successfully
http//www.surfacegeeks.net/forums/index.php?/topic/1391-clean-install-of-windows-81-on-sp3/

I would try replicating this last report, as the Windows 8.1 setup is actually a (basic) form of PE, and if it can boot, then *any* PE 5 (or possibly even 4) should boot as well.

jaclaz

ReplyQuote
Posted : 28/02/2015 12:15 am
C.R.S.
(@c-r-s)
Active Member

Did you remove the SD Card or any other media? Can you boot Windows, either "To Go" or natively? Since Windows 8 boots from USB without hassles, you can attach any installed hard drive. To Go is configured to keep local drives offline, while native Windows will mount them. However, this should be tolerable when Bitlocker is active.

ReplyQuote
Posted : 28/02/2015 12:41 pm
rjo86
(@rjo86)
New Member

I've not tried it with a Surface 3, but when I first imaged an original Surface Pro my method was

1. Boot into the UEFI and disable Secure Boot if it is enabled.
2. Save the UEFI changes and immediately power the Surface down.
3. Plug in a USB hub, attach a bootable USB. NOTE The distro on the bootable USB has to be a 64-bit distro (I used DEFT 7.x at the time).
4. Boot from USB, plug a USB HDD into the hub to save your image to and use Guymager to image the internal SSD.

I did have some issues with the bootable USB and I can't remember if it was rufus/unetbootin/pen drive linux or even manually creating one in cmd line that worked in the end I'm afraid.

Rob

ReplyQuote
Posted : 28/02/2015 9:51 pm
cunninghamja
(@cunninghamja)
New Member

Below is a link to my process

https://winfe.wordpress.com/2014/10/16/image-a-surface-pro-using-bootable-uefi-winfe/

ReplyQuote
Posted : 04/03/2015 1:45 am
Adam10541
(@adam10541)
Senior Member

I thought I'd revisit this as I'm currently trying to get a process up to image Surface Pro 3 and 4 (with no luck thus far).

It appears the method used for earlier models by creating a WinPE (Mr Cunningham's guide) will not work with these models.

Does anyone have a successful method (other than live) for acquiring these devices yet?

ReplyQuote
Posted : 31/03/2016 12:33 pm
jaclaz
(@jaclaz)
Community Legend

It appears the method used for earlier models by creating a WinPE (Mr Cunningham's guide) will not work with these models.

It appears HOW?

I mean, you did try it and what happened?

Which PE (like 4.x, 5.x, 10.x) did you try?

Just in case, a direct link to the .pfd is here
https://winfe.files.wordpress.com/2014/10/image-a-surface-pro-using-bootable-uefi-winfe1.pdf

Here is an indirect confirmation that specifically the Surface Pro 3 can boot from USB (in this case Ubuntu)
http//blog.davidelner.com/dual-booting-ubuntu-14-10-on-the-surface-pro-3/

But more generally *any* Rufus made USB stick works
https://www.thurrott.com/mobile/microsoft-surface/2515/how-to-dual-boot-windows-10-on-surface-pro-3

jaclaz

ReplyQuote
Posted : 31/03/2016 4:14 pm
kacos
(@kacos)
Member

But more generally *any* Rufus made USB stick works
https://www.thurrott.com/mobile/microsoft-surface/2515/how-to-dual-boot-windows-10-on-surface-pro-3

Major points from the above link
The flash drive MUST be formatted as FAT32.
NTFS will not work.
You must also use GPT partitioning, not MBR.

ReplyQuote
Posted : 31/03/2016 4:35 pm
bknowlton107
(@bknowlton107)
New Member

After making multiple attempts to image one of these (and failing) I found the easiest method was using a Paladin bootable USB to image it to an external drive.

ReplyQuote
Posted : 31/03/2016 11:29 pm
Adam10541
(@adam10541)
Senior Member

I suspect it was the GPT partitioning that was stopping me on previous attempts.

Rufus made bootable USB with Paladin 6.08 worked. )

ReplyQuote
Posted : 01/04/2016 8:36 am
jaclaz
(@jaclaz)
Community Legend

And - as a side note - I provided a link to Paul Thurrott's site only because he provided a clear overview of the process, otherwise what you usually get from him is usually something either inaccurate or obsolete, or obvious (or all three).

Seriously, recent versions of Rufus include a NTFS bootloader/driver/extender for UEFI/EFI, though I have no idea if it works specifically for the Surface (Pro 3 or other models), it does work normally fine on EFI/UEFI boards.
https://github.com/pbatard/uefi-ntfs

As a side note, and partially a plug 😯 , to make a "universal" stick for - say - a WinFE, this might be of interest (device GPT partitioned BUT transparently booting on BIOS only systems)
http//reboot.pro/topic/19516-hack-bootmgr-to-boot-windows-in-bios-to-gpt/page-14#entry198148

jaclaz

ReplyQuote
Posted : 01/04/2016 2:13 pm
Guinan
(@guinan)
New Member

I Used FTK Imager Lite (free - no installation required) from an external USB Hard Disk to do
a physycal acquisition but the result was "unrecognized file system" on the C partition.
So, I did a logical acquisition of the C partition of the Surface Pro 3 with a positive result.
Then I did some carving on it with good results. You can repeat it on the other partitions.
The problem is that you you have to turn up the Surface and to know the password to access the desktop. No problem with bitlocker with it or not, you can do your logical acquisition with the same positive results.

ReplyQuote
Posted : 01/04/2016 3:39 pm
Share: