1

I did a thorough search before and I did have knowledge of the subject years ago when UEFI was not yet a thing. But seems when you don't use something, sometimes you "unlearn" it. Seems nobody CLEARLY states actual distinction.

So I have an image (either USB or disc image, doesn't matter). If I mount it or "open" it to see the contents (or even without? With a tool?), how can I be relatively sure that it supports legacy booting, UEFI or both? WITHOUT attempting to boot it (as actually failing or succeeding will reveal the answer - plus many UEFI do indicate if they detected a UEFI capable medium).

In contrast to common (?) knowledge, partition type doesn't seem to be a deciding factor (at least not in an exclusive way). I suspect, certain files need to be in certain places? Can someone point which, where?

I have a pack of images I need to classify and clean up.

NLS
  • 21

2 Answers2

0

I can only comment on CD/DVD and their ISO Images. I have never tried it with USB images so indeed this answer may not be complete.

You need a tool like ISO Buster. (Windows application) The free functionality should work in most cases I guess.

  1. Open the ISO image in ISO Buster
  2. In Left Pane click on 'Bootable Disk'. The right pane shall show the .img file(s). If you don't see this 'Bootable Disk' item, the ISO is not bootable at all.
  3. If you see only one .img it's single mode boot disk (However it could be either Legacy or UEFI). If you see two .img then it's multi boot.
  4. Now Right click the .img and hit Run
  5. A new window will open. If you see only Session & Track info then it's Legacy Bootable
  6. A UEFI bootable .img will show upon Run, Partition -> EFI Sector
  7. If you find two .img therein and one shows only track sector and another EFI sector then it's both Legacy and UEFI Bootable.

Note - This method can not verify the actual integrity of the .img file. Based on the structure of .img it indicates if it's Legacy or UEFI bootable. I can have a fake bootx64.efi inserted as image file at EFI/boot then the ISO buster shall indicate that it's a bootable image but the actual ISO or DVD will fail to boot as there's no real bootable code inside bootx64.efi and so is the case with Legacy images.

See below screenshots.

Hiren Boot CD ISO (Only Legacy Bootable)

enter image description here

enter image description here

Windows 7 64 - Both Legacy + UEFI Bootable

enter image description here

enter image description here

enter image description here

patkim
  • 5,592
0

For UEFI, you have a lot of hints indicating that a disk is bootable, but absence of them doesn't necessarily mean that the disk isn't bootable. Keep in mind that for internal disks, part of this information is usually stored in the motherboard's NVRAM and doesn't necessarily travel together with the disk's contents.

  • Partition table:

    The UEFI specification allows GPT and MBR partition tables for all kinds of disks. Removable devices can also be unpartitioned, consisting entirely of an EFI-compatible filesystem. CDs/DVDs use the same El Torito structure as for BIOS boot.

  • Partition:

    The boot files are stored in an "EFI system partition", which has a specific partition type ID assigned for both MBR (0xEF) and GPT (C12A7328-F81F-11D2-BA4B-00A0C93EC93B).

    (Note that some tools show the partition type IDs differently, e.g. gdisk shortens the GPT GUID to EF01 and parted shows it as a flag instead.)

    However, if the firmware boots according to specific partition GUID and file path stored in the system's NVRAM (the Boot#### entries), then the partition type ID isn't strictly required (if I'm reading the spec right). It is only needed if the firmware has no information and needs to auto-detect the partition and file to boot from.

    The partition type ID is also not required for removable media.

  • El Torito:

    CDs and DVDs do not have partition tables, instead they have a boot catalog with several entries, one for each platform they support. EFI-bootable discs have an entry with platform ID 0xEF (which is multi-platform as it contains the same files as an EFI System Partition would):

    $ dumpet -i en_windows_vista_enterprise_sp2_x64_dvd_342332.iso
Section Header Entry:
     Header Indicator: 0x91 (Final Section Header Entry)
     PlatformId: 0xef (EFI)

  • Filesystem:

    UEFI defines FAT(16/32) as the standard filesystem that must be supported for the EFI system partition.

    Though it does not forbid firmwares from supporting other filesystems (I believe Macs accept HFS? and some PCs accept NTFS?), so a disk could potentially be UEFI-bootable even if it doesn't have a FAT filesystem anywhere.

  • File path:

    EFI can be configured to boot any executable file from the specified partition, but if the NVRAM entries are not present (or if they all fail), it will look for the standard path \EFI\Boot\BootARCH.efi (case-insensitive), where ARCH is X64 for amd64.

grawity
  • 501,077