Windows 10+ Recovery Environment (RE) Notes



Summary and Basics

 * The Windows Recovery Environment (RE) is a computer's restoration platform.  It is a collection of tools with a graphical interface that can repair a computer, or reinstall it from saved images.  It can also use an USB recovery drive, so that work can be done externally to the Windows environment.
 * The Winre.wim file is its core, and It is an image file.
 * It is normally hidden from view, but can be seen in Windows Explorer when the folder options are adjusted, and the recovery partition is given a drive letter.
 * Winre.wim is initially located in folder \Windows\System32\Recovery, for staging or when disabled. When the RE is clean-installed or otherwise enabled, tt is moved to folder \Recovery\WindowsRE, in the recovery partition with two other files.
 * The file depends on finding the specified folder at its destination. For a clean installation, the empty folder tree at the working location must be prepared prior to initially enabling the RE.
 * The Reagent.xml file is also located in \Windows\System32\Recovery, and travels with the Winre.wim file.  When it is missing in Windows 10 and beyond, a new one is made automatically for the current configuration.  Before Windows 10, handling procedures can differ.
 * The Recovery Environment (RE) can be switched on and off.  If it is off, (disabled), most facilities will be unavailable.  it will not be possible to make a recovery drive, access advanced options, or install a system image.   When the recovery environment is switched on, (enabled), a full set of advanced tools is available.
 * When the recovery partition is unsuitable for the RE, C:\Recovery\WindowsRE is used instead.  However, when the problems with the partition are corrected, the RE can be redirected back to the partition, using an entry made at an elevated command prompt.
 * When the Recovery Environment is disabled, the Winre.wim file is moved back to its staging location in the \Windows\System32\Recovery folder.  (See Figure D).   It is then moved back to its working location when it is enabled.
 * A USB recovery drive can override RE settings. Booting with a recovery drive can access a full set of advanced options even when the computer's RE is disabled. (See later).
 * Reagentc.exe is used to switch the RE on and off.  It is also used to check its status, and to tell the system where to install the RE files. It is accessed in an elevated command prompt, and a detailed log of its actions is always available at C:\Windows\Logs\Reagent.log.
 * Users sometimes need to work on the hidden recovery partition. Assigning a drive letter, viewing files, and extending the partition are the main tasks that users might encounter.  All of these tasks can be carried out in Windows, but are more easily done with a third party partition tool.   Even free tools, like MiniTool Partition Wizard Free Edition, are easier to use than Windows.
 * The RE does not normally need manual intervention. The configuration files are automatically updated by switching the RE from the disabled state to the enabled state, or by notifying a change in the location to send the RE.  In Windows 10, a new xml file is made if one cannot be found. If necessary, when things still go wrong, there are commands that can be used to check and change the status of the RE, and to tell the system of the new location for its working files.
 * A good way to reinstate the integrity of the Recovery Environment is to allow the installation of a Windows Feature Update.  Because the update needs the RE to do its work, it will be sure to reinstate it.  Another, more timely method is to perform a clean installation of the RE. (see later).
 * A copy of the Winre.wim file should be kept as a backup.  If a Winre.wim file is thought to be defective, the backup copy could then be used to reinstall the RE.   Copies can also be imported from other computers, or from installation and system images, but having a backup is more convenient.   There is no need to backup the reagent.xml file in Windows 10 as the system can make a new file every time the RE is enabled.
 * The Windows USB Recovery Drive can give full RE access, even when it is disabled, so a USB Recovery Drive is well worth the time in its making. Such a drive can be used to boot (load) a PC into Windows even if the PC cannot start on its own.  It can also boot the PC into a full version of the Recovery Environment.  Running the RE on a USB Recovery Drive can allow the installation of system images at times when other methods would fail.   It cannot transfer a WindowsBackupImage onto a new, blank hard drive however, since some preparation of the disc's partitions must still be made.   For a blank hard drive, cloning or the use of installation media are still the preferred methods.

Accessing the Recovery Options
There are several ways to access the recovery options. (See Figure A.)  Some use keys during startup, and some others a modified form of restart. These methods set flags that cause the relevant boot loaders to load the Recovery Environment instead of the Windows operating system. The most reliable methods are given here.

Starting the RE with Hot Keys
When the PC is switched on or reset, there is an immediate startup phase, in which pressing certain keys on the keyboard can cause the computer to go into the Recovery Mode. For example, some HP computers use the f11 key for this. Other manufacturers will use other keys, but often there is brief message at the bottom of the screen that invites the user to press a certain key for this purpose. At times, recovery mode can be accessed from the Startup menu, accessed on HP computers by pressing the Esc key during startup. Along with the RE startup key, there is also a key to go to the UEFI/BIOS settings; on HP computers it is f10, though it too changes between manufacturers. Refer to documentation for your PC to learn correctly which keys to use. Notice also that the startup keys are still valid whether the PC boots on its own, or with the help of an USB Recovery Drive.

Starting the RE with Shift-Restart
Provided that the PC can start, then the preferred method to enter the Recovery Environment is to restart the PC while pressing the shift key. Power switch restarts can be initiated anywhere that a restart button exists, including the Sign-On screen, the Start Menu, Advanced Startup in Settings> Recovery, and no doubt others. 

Starting the RE with an USB Recovery Drive

 * The Use a Device choice (see figure A), runs a version of the RE from the USB Recovery Drive. In this way the USB can perform recovery tasks independently of Windows, and can do so even if the RE in the PC is set to disabled.   In order to make use of these features the user should of course, have a Windows Recovery Drive, made at a time when the PC was working well.   Details on how to make such a drive can be found by searching in Windows for the term Create a Recovery Drive.   The following method although of use generally, is made for a near-worst scenario, where the computer cannot start on its own, the user has forgotten the startup keys, and the computer's RE is presently in a disabled or inoperable state. The sequence of work used to enter the recovery environment, and gain external control of it, is as follows:
 * Set the boot order of the BIOS/UEFI to boot from the USB. That is to say, access the UEFI settings, then move the USB choice to the top of the boot order, then save and exit the UEFI settings.  This should have already been done as a matter of routine, but in case of difficulty, refer to Boot Menu Option Keys for All Computers, for the boot access key on your computer.
 * Switch off the computer. A cold start is best; remove power from the power cord as well, since the mother board has power unless mains power is removed. Press the start switch a few times to discharge any residual power. After a few minutes reconnect the mains.
 * Remove all USB objects except the mouse and Recovery Drive and start the PC.  Do not touch any keys at this stage.  The Recovery Drive should boot the PC into Windows normally.   It is assumed here that the PC reaches the sign-in screen, having run an automatic startup check and repair.   Note: If you know the key to press to enter the RE during startup, and don't need start-up repairs, then press that key during startup, and skip to making the "Use a device" item below.
 * Perform a Shift-Restart from the sign-in screen. That is, hold down the shift key while selecting restart on the lower-right power button.   A similar procedure could be performed at any other point on the PC where there is a power button.   The computer restarts, booted by the Recovery Drive, and opens a reduced version of the Recovery Environment; this version has very little other than that available in a boot menu, but additionally includes the "Use a device" option.
 * Find and select the option Use a Device. From the three or so options then presented, choose the one for the removable USB drive. The PC will automatically restart, and the Recovery Drive will open a full set of options of its own, the first of which is a language selection.
 * The language screen is characteristic of USB control, there being no other notice as to which device is now running the RE. When making selections from these options, the Recovery Environment will make use of tools in the Recovery Drive, as opposed to those in the PC or Windows.  This would even permit the formatting of Windows if deemed necessary.
 * Remove the Recovery Drive from the USB slot. Do this when it is no longer needed, and before proceeding normally to Windows again. This avoids another unnecessary USB boot into the RE.

RE Management with Windows Explorer
Although enabling and disabling the RE must be done at the Command Prompt, searching for files can always be done from within Windows Explorer. If work needs to be done directly in the recovery partition however, a drive letter will need to be assigned. (See later). For some actions that will not be necessary. In general, the user should consider logging on as an administrator, and in any case adjust the folder options as follows:
 * Go to Windows Explorer's View drop menu.
 * Select the Options tile, then Change folder and search options.
 * In the dialog that opens, select the View tab, then check Show hidden files, folders and drives.  In addition, ensure that the Hide protected operating system files (Recommended) remains unchecked.
 * Click Apply then OK to quit the dialog.

Search for files
Left-click the C: drive in the left panel then enter the file name and extension in the top-right Search This PC text field, (for example, winre.wim ). Hit Enter to start the search of C: drive. After a while the results list will be completed. Narrow or widen the search locations by choosing a different drive or folder in the left panel, then re-entering the file details.

File Restrictions
Being able to see system and operating files does not necessarily mean that they can be moved or copied. That privilege depends on who the owner is. In the event of such difficulty, the intending user might have to take ownership of such a file or folder, or extend sharing to himself. Use the right-click menu item "Give access to", to give yourself access to some restricted files.

Hidden Partition Working
Before installing the RE in a partition, the system checks to see if the partition is suitable. During the install run, it checks for size and type, and otherwise decides on suitability. If it decides that it is too small for the files and working space, or otherwise unsuitable, it will install the RE into the C:\Recovery folder instead. So, if at any time the RE is found in that folder, it would be best to consider any issues with the partition before attempting to install in it. Microsoft's page on this issue is best, at Disk partition requirement for using Windows RE tools on a UEFI-based computer.

If it is decided to extend the partition, or to work on it, the use of a partition tool is preferred. Even free utilities such as MiniTool Partition Wizard Free Edition permit the assignment of drive letters and the adjustment of a partition's size. They also allow the viewing of files in hidden partitions, using an explore option. These utilities are often simpler to use than those supplied by Windows, but on a cautious note, care is needed in any partition tool's use, since changes made in a casual way can have far reaching consequences.

In order to see and work with any files in a hidden partition, a drive letter must first be assigned. Then the files can be handled in Windows Explorer, in the same way as any others. After a session of work is done, the drive letter can be removed again to make it inaccessible. Before working on any system files, it is advised to set the folder options of Windows Explorer so that system files will be visible and so that operating system files are not hidden. Otherwise, they will be invisible for both viewing and command prompt listings. Similarly, any use of the command prompt should be done at an Admin level, the so-called elevated command prompt, or some commands will not work at all. It might also be as well to sign on to Windows as an administrator for any extended work. This will minimise the requests for permissions.

Making Clean Starting Folders
When attempting to make a clean installation of the RE, it is important to avoid any residual problems that exist in the surrounding files and folders. One way, when it is possible, is to install into empty folders made for the purpose, and to first rename any similar existing folders so that they are unavailable. For example, for a partition, the RE system will install into a specific folder in a specific folder tree, and no other. For a clean installation, the partition must have an empty outer folder in it called Recovery. Within the Recovery folder there must be another empty folder called WindowsRE. If any existing folder tree exists with the Recovery name it should be renamed so that it is unavailable.

Similarly, during the installation of the RE, a Winre.wim image file must initially be located in folder C:\Windows\System32\Recovery. There is no need for any WindowsRE folder at this location, since it is merely a staging location for the wim file, prior to the start of the installation. If there is doubt as to the integrity of the Winre.wim file, then it too should be renamed, and another file that is known to work, brought in to replace it. In Windows 10 and beyond, some files are made automatically when they are not found during an RE installation run. This is not the case for earlier Windows editions. For Windows 10 and 11, this makes it a useful way to exclude such files from adversely affecting the new installation. If there is an existing REAgent.xml file in the C:\Windows\System32\Recovery folder, it must be deleted before a clean install; the system will make a new one on-the-fly, with all of the new configurations in it. Note that a missing Winre.wim file will not be replaced during a run; it must be present at the staging point before enabling the RE.

Checking System Files and Images
At any time, the integrity of the system can be checked by running a file check. That does not mean that the recovery partition will be checked as well. When the RE is disabled, the Winre.wim file is brought back into the C:\Windows\System32\Recovery folder, regardless of where it was located while it was enabled. So prior to running a specific file check it would be best to make sure that the Winre.wim file is conveniently located in Windows, by first disabling the RE. Code for doing this, and other tests, is given in a later section, though recent tests have introduced doubt as to whether or not the Winre.wim file is ever included in a System File Check; no mention of it is ever found in the various logs.

An alternative to file checking is to make use of a Winre.wim file from a known, good Windows computer of the same edition. Another alternative is to allow the computer to do a features update, or an upgrade of Windows. Because the system needs the RE for its updates, it will make sure that there is a working RE by the time it is done. That is not to say that the system will install the RE where you want it; it will not install it into a partition if it was not notified (set) there before. Another way, more complex, to get a file is to mount an installation image so that there is access to its files. The wim file can then be copied, and dismounted after use.

Microsoft recommends running DISM before sfc in Windows 10, so this is the sequence displayed below. The following code can be used at an elevated command prompt to perform more searching tests and repairs on the computer, but should be used sparingly and with caution, in view of the damage that might result from careless use:

To check the Windows image for integrity
The code lines shown here require an online internet connection. They check the Windows files against a reference set of files in a Microsoft server. The first line will check that files are OK without making changes, while the second line will check the integrity of the component store. The third and most useful will check and fix any bad files that are found. The process can take some time since many files need to be checked. Press Enter after any one line of code, then await completion before any other:  Dism /Online /Cleanup-Image /CheckHealth Dism /Online /Cleanup-Image /ScanHealth Dism /Online /Cleanup-Image /RestoreHealth

To perform system file tests and repairs
The first of these two code lines will verify the integrity of the system files but will not make any changes to them. The second line will check such files and also repair or replace them as necessary. A log file for the process is available at C:\Windows\Logs\CBS\CBS.log. Press Enter after any one line of code, then await completion before any other:.  sfc /verifyonly sfc /scannow

To perform hard drive sector tests and repairs
The first of these two code lines will verify the integrity of C: drive's sectors, and will report but not make any changes to them. The second line will check the sectors and also make repairs as necessary. Press Enter after any one line of code, then await completion before any other:  chkdsk /r c: chkdsk /f c:

To obtain a hash for your working Winre.wim file
There is no clear evidence that the wim file is ever checked during a sfc check, so the next best thing is to do a hash of your wim file while it is working well so that you can compare it when it is in doubt. The procedure below first disables the RE to move the wim file into Windows. Then the directory is changed to the folder that contains the wim file, then the hash line is run. Change the MD5 to SHA1, SHA256, or SHA512 for other hashes. The sequence of work is just: Press Enter after each line of code, then await completion before any other:  reagentc /disable cd c:\windows\system32\recovery certutil -hashfile winre.wim MD5 reagentc /enable reagentc /info

To Check, Enable or Disable the RE
At various times we need to disable or enable the Windows Recovery Environment. When disabled, there is no access to the advanced options of the RE without a Recovery Drive, and it is not possible to make such a drive when the RE is disabled. However, at times when repairing the RE, we need to switch it off and on. These commands, as for many others, must be made at an administrator command prompt.  reagentc /info  reagentc /enable  reagentc /disable 
 * The RE status tells us whether it is currently enabled or disabled, (see Figure B), and if enabled, what its set location path is.  It is found with:
 * To enable the RE we use:
 * To disable it we use:

Clean Install the RE to a Partition
This procedure is the most general, and as such is easily adapted to address a number of RE problem types. These include but are not limited to:


 * Cannot enable the RE
 * Recovery Environment not found.
 * Confused configuration issues.
 * First time install of RE.
 * RE installed in Windows instead of Recovery Partition.
 * No backup to staging location when disabled.

This description assumes that there is a Winre.wim file available on the computer from some suitable source. That is to say, from a backup copy or a computer of the same edition: Win10 needs a file from a Win10 computer, etc. It further assumes that there is already a recovery partition made, it is hidden, and that after installation of all files, it will still have free space roughly equal to the size of the Winre.wim file itself. A partition size of greater than 1GB would usually do fine. Ideally, the RE partition should be located immediately following the partition in which Windows is installed. For a detailed description of the most general method of RE installation, first refer to Microsoft; Deploy Windows RE.The summary of the procedure is as follows:
 * Prepare Windows Explorer; set the folder options to unhide and view system and operating system files.
 * Prepare the Recovery Partition; give the partition a drive letter. We use "R" for our example.
 * Disable the RE if there is already one installed.
 * Use Windows Explorer” to view the existing Recovery Partition'' files.
 * Rename any existing Recovery folder structure in the recovery partition; eg; make it bakRecovery.
 * Then make sure that the empty folder structure Recovery\WindowsRE exists as a top level folder tree in the RE partition. (See Figure D).   If it does not, then make it.
 * Copy your Winre.wim file to the clipboard, then Paste it into the \Windows\System32\Recovery folder.  This becomes the staging location of Winre.wim. Note that this method is simply considered the most convenient, and that with a little more effort the file could be found and copied into place at the command prompt instead.
 * While in \Windows\System32\Recovery rename any existing REAgent.xml file to make it unavailable. (Note: This advice is for Windows10 and beyond).
 * Set the location for the installation of RE files using reagentc /setreimage /path r:\recovery\windowsre at an elevated command prompt.  The system will make a new reagent.xml file, then add it, the winre.wim file, and a boot.sdi file to the WindowsRE folder in the recovery partition,
 * Confirm the status of the RE with reagentc /info, noting that it is enabled, and that the RE has the installed path as intended.
 * If all is well, then remove the drive letter from the recovery partition.
 * A detailed log file for the process can be found at C:\Windows\Logs\ReAgent\reagent.log.

Command line code related to the clean RE install
 diskpart list drive select drive 0 list partition select partition 4 assign letter=R exit  reagentc /info  reagentc /enable  reagentc /disable <poem style="margin-left:25px;letter-spacing:0.05em;color:green;font-weight:bold;font-family:consolas;font-size:11pt;"> dir /a /s c:\winre.wim <poem style="margin-left:25px;letter-spacing:0.05em;color:green;font-weight:bold;font-family:consolas;font-size:11pt;"> attrib [full path to the FILE whose attributes are to be checked] attrib -h -s [full path to the source FILE to copy] xcopy /h [full path to the source FILE to copy] [full path to destination FOLDER for the copy] attrib h s [full path to the source FILE that was copied] attrib h s [full path to the new destination FILE] <poem style="margin-left:25px;letter-spacing:0.05em;color:green;font-weight:bold;font-family:consolas;font-size:11pt;"> reagentc /setreimage /path r:\recovery\windowsre <poem style="margin-left:25px;letter-spacing:0.05em;color:green;font-weight:bold;font-family:consolas;font-size:11pt;"> diskpart list drive select drive 0 list partition select partition 4 remove letter=R exit
 * To assign a drive letter to the Recovery Partition:    It is best to use a third-party partition tool (recommended), but if the command prompt must be used, enter following code lines at an elevated prompt, one by one, pressing Enter after each.  Note:  For this purpose, we use the letter "R", and assume it is for partition four.
 * To check the status of the RE:
 * To disable the RE:   Enter the following code at the elevated command prompt.
 * To enable the RE:
 * To find a list of Winre.wim files in C: drive: Enter the following code at the elevated command prompt. (See Figure C)
 * To copy a Winre.wim file using Command Prompt: Note: The first line is just used for you to find the file's attributes; it is assumed here that, among others, system and hidden attributes (h and s) were found; these two found attributes are removed in the second line, the xcopy is applied in the third, then the attributes are reapplied at both the new and old addresses. It is easiest to rename and move files in Windows Explorer, but when the command prompt (elevated) must be used, the following code shows the sequence of work:
 * To tell the RE where to place the enabled Winre.wim file:  In this case we assume that the correct place is the recovery partition, and that it has been labelled as "R" drive.  As well as setting up the various configuration files and notifying the system as to where the RE is to be installed, this code line ends by enabling the RE, ready for use:
 * To remove the drive letter from the recovery partition:  Use the third-party partition software for speed and convenience, or repeat the earlier use of diskpart, replacing the lettering line with remove letter=R.
 * To access the log file for any REAgentc process: In Windows Explorer, go to C:\Windows\Logs\ReAgent\reagent.log, and Open with Notepad or Wordpad.

<div style="background:papayawhip;margin:0px;padding-left:10px;padding-right:10px;padding-top:10px;padding-bottom:10px;border:1px solid gray;">

Internal Links

 * Wikibooks: Windows Recovery with an Image  : More information related to installing images with the Recovery Environment