View separate section about winpe 3.1 and winfe 3.1

Permanent link for this blog :
http://gverswijvel.wordpress.com/2009/08/09/winfe/

As I’m an amateur, you may find more specialized advice here
by the likes of Troy Larson (Microsoft) and such : http://winfe.wordpress.com
A forum that is discussing all things forensic and the automatic creation of winfe with winbuilder is here : http://reboot.pro/forum/63/
http://reboot.pro/forum/109/

Activate the administrator account
Start, Run (in order to view “Run” in your startmenu, you’ll have to make it visible : rightclick on the startmenu, properties, put a mark before “run command”, and click on apply), enter the command :
net user administrator /active:yes         In the search bar you type : command prompt
You’ll see the command prompt in the start menu now Right click on it, and
choose : “pin to the start menu” Right click on it again and choose “properties”,
then choose “Advanced”. Mark “execute as administrator”, and click on Ok, and/or “Apply”
Double-click on the command prompt you see in the start menu. Control the title of the
command prompt : it will be named : “Administrator : Command Prompt”
(an ordinary command-prompt opens as “c:\windows\system32\cmd.exe”)
In order to activate the hidden Administrator account, you type in this admin-command-prompt :
net user administrator /active:yes

Now restart the computer, and you can log in into the Administrator account.Then go to “Control Panel”, “User accounts”, manage another user account” : the administratoraccount will show up, and you attribute a password for it (be careful : you’ll need this password to log in)
Restart your computer, and log on into the Administrator account
Now download the Waik , and install it.
You’ll need Windows 7 (or windows 7 service pack 1) , and the Windows AIK (waik) for Windows 7
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=696dd665-9f76-4177-a811-39c26d3b3b34
———————————————————————————————————————————————————————-
update : WINPE 3.1 or WINFE 3.1
only install complementary supplement iso if you desperately need the changes in the new winpe 3.1,
or want to edit wims from a Windows 7 SP1 Dvd. Even if you have installed service pack 1 for Windows 7,
you can still use the old waik for windows 7. You strictly don’t need the supplementary iso if you don’t have
install dvd’s WITH service pack 1.

IMPORTANT : you FIRST install the WAIK for Windows 7 mentioned above. Then you’ll
integrate the supplement iso which you can find here :
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0aee2b4b-494b-4adc-b174-33bc62f02c5d
Burn the iso as an image to dvd with Imgburn, and put the dvd in the drive (here it has drive letter E: )
You open an administrator command prompt, and type the following command :

xcopy E:\ "C:\Program Files\Windows AIK\Tools\PETools" /ERUY  

What’s changed in this Windows AIK supplement?
* The number in the Version registry value is 3.1 to reflect the new Windows PE version.
* As of 2011 , the drive manufacturers deliver hard drives with a different layout , called “advanced format” ; winpe 3.1
offers support for these 4k/512e drives. The Windows PE 3.1 base image contains fixes that are related to 4k/512e drive support. These fixes are also available for Windows PE 3.0 as a hotfix. For more information, see Knowledge Base Article ID: 982018 (http://go.microsoft.com/fwlink/?LinkId=206679). .
* The Windows PE 3.1 base image contains Remote Network Driver Interface Specification (RNDIS) binaries. These binaries are also available for Windows PE 3.0 as a hotfix. For more    information, see Knowledge Base Article ID: 979265 (http://go.microsoft.com/fwlink/?LinkId=206678).
* Windows PE 3.1 includes 802.1x binaries as an optional component. The file name of this package is WinPE-Dot3Svc.cab. This optional component is also available for Windows PE 3.0 as a hotfix. For more information, see Knowledge Base Article ID 972831(http://go.microsoft.com/fwlink/?LinkId=206072).
* Windows PE 3.1 includes bug fixes that are related to the Windows PE version that is included with Windows 7 SP1.

The process to make a winpe or winfe does not change. So you can follow the procedure beneath.

————————————————————————————————————————-
 !!!  64-BIT winpe or  graphical winpe : make it with winbuilder

Important remark : Those of you who want a graphical option instead of a spartan non-gui winfe,
and an easy way to make a 64-bit live-cd look at the bottom of
http://windowspowershell.wordpress.com
There is a description in English on how to use winbuilder + a download.
In order to have a forensic iso  :
Click “finalize” and then “optimisations” in the left pane
In the right pane, (after you have clicked on the tab “script” above) you will see the option “don’t mount harddrives”
And you can set the option “firewall enable” at start  instead of “disabled”

—————————————————————————————————————————–

PREPARATIONS FOR A NON-GRAPHICAL WINPE

Make a folder C:\keyboard\, in which you put the file keyboard.exe. (With this file in your winpe you can change from qwerty to belgian azerty (or other keyboard layouts), only giving the command (from command prompt) :

keyboard.exe
and the command (be is Belgian azerty, nl  is the qwerty of the Netherlands) :
be
Hit ENTER, and there is your azerty. It will only be applied when you open a second command prompt, which you can do by typing :
start cmd.exe
In order for this to work , you will need  the dll file of your localized layout in the /mount/windows/system32 folder (in my case, it’s kbdbene.dll for Belgian azerty)

Make a folder c:\programs\, in which you put all your programs, preferably standalone apps. [I have zipped the extra files you'll need in the folder c:\programs, and the file keyboard.exe in a file named "PROGSnew.zip".  Caution : use at your own risk ; the version of dd contained in this zip contains already the necessary files for use in vista and windows 7, and if you want dd.exe for specific use within a Windows xp, or Windows 2000 environment, download from the original site :  http://www.chrysocome.net/dd

!!! You'll need at least google chrome version 12.0.742.112, Opera browser version 11.50 or Firefox 5 to download from microsoft live skydrive

http://cid-eabc6ce1aad35979.skydrive.live.com/embedicon.aspx/Openbaar/PROGSnew.zip

-folder c:\programs\DD\ contains the program dd.exe for windows from John Newbigin, a program that has always worked flawlessly when putting the image of a hard drive back to an identical disk  or one that is larger, after zero-filling that disk  or taking a brand new one.[Hiren's boot cd contains all the hard drive tools from every hard disk manufacturer on the planet, in order to wipe or zero-fill your drives http://www.hiren.info/
Google  with the search terms  "hiren's boot cd 10.0" . ]

In the download you’ll find a text file, in which I describe how to image a hard drive with the dd.exe from John Newbigin. Be very careful when using this program. Read other user manuals on the web to be sure how to do this, because the nickname for this thing is DATA DESTROYER (and I already made an unfortunate acquaintance with its evil impersonation) Consider this : you have two internal drives. You first make an image of the first internal drive to an external drive (that is bigger and is formatted NTFS). Then you wipe the first internal drive (fill it with zeroes), or you put a bigger one in, that is equally blank. After this procedure,  your internal drives may have changed names. The following command is your friend :

dd --list output to txt-file : dd --list 2> output.txt 

-folder c:\programs\FAU\ contains the dd.exe from the “forensic acquisition utilities” In the download you’ll find a text file on how to use this dd.exe

-folder c:\programs\Odin\ contains a gui-program to better identify your hard drives if you have any doubts about the output of the two dd-versions

-folder c:\programs\filemanager\ contains  the browser Opera oneuse and the filemanager Explorer++.exe
(you can always copy “Explorer++.exe”  to        C:\winpe_x86\mount\windows\system32       when making
your winpe ; thus it’s immediately available when winpe starts)

Optionally you can download Unreal Commander on      http://x-diesel.com/download.php?
It is a free twin- pane file-manager that is almost a copy of TotalCommander  (if you extract the setup file with Uniextract, you’ll have a standalone app).
To view hidden files in Unreal Commander, click on “Show”, and then mark “show hidden files”.The unreal commander has a very performing file search, which can work with regular expressions. It”s free, however, you’ll need to create a key, to have all the options of the program. You can find it here :

http://x-diesel.com/

http://x-diesel.com/download.php?

Now we start making our winpe via : Start, All programs, Microsoft windows AIK, rightclick on “deployment tools command prompt”, and choose : run as administrator.

You can copy the sentences with ctrl + C , and then paste it in the command prompt with a rightclick choosing "paste".

Important note :  make sure that whenever you open an explorer window to copy the contents of   c:\Programs\   to   c:\winpe_x86\mount\Program Files, be sure to close it again.
If an explorer-window remains open within one of the mounted folders, the process of dismounting will fail.

Remark : give each command enough time. Some commands take a long time to complete.

Remove the folder c:\winpe_x86 , and type the following command to clean
up the remains of a former winpe  (type one sentence at a time + push Enter  at the end of each sentence) :

Dism /Cleanup-Wim

Then type :         cd C:\Program Files\Windows AIK\Tools\PETools
Then type :

copype.cmd x86 c:\winpe_x86

Now type :

copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim

If when booting from your winpe – you don’t want a choice between booting from cd or booting from hard disk (and you don’t want this in winfe), then you’ll want to remove the file “bootfix.bin” in the directory : c:\winpe_x86\ISO\boot
If you navigated there with windows explorer, then close explorer again.

Mounting with :
Dism /Mount-Wim /WimFile:C:\winpe_x86\winpe.wim /index:1 /MountDir:C:\winpe_x86\mount

Copy your own standalone apps to the winpe. I use Unreal commander to copy the folders in “C:\programs” to the folder “C:\winpe_x86\mount\Program Files”. Copy “keyboard.exe”  and Explorer++.exe  (which is now in  “C:\programs”)  to  “C:\winpe_x86\mount\windows\system32″. Be sure to close Unreal commander.

Editing registry for a forensic boot cd
When you want to make a forensic boot cd, that will not automatically mount the hard drives when booting, you will have to edit the registry. From c:\windows\system32   you copy the following files into a new folder c:\reg\   :
reg.exe, regedt32.exe, regini.exe, registeriepkeys.exe , regsvc.dll, regsvr32.exe.  Then type :

cd c:\winpe_x86
Now type :
copy C:\reg

(this will copy the needed files to c:\winpe_x86) .Now, change the registry (Enter one sentence at a time)
The registry of the winpe will be temporarily loaded into the windows 7 registry.
Afterwards the winpe-registry will be unloaded again. The san-policy within the winpe-registry will be to
NOT mount drives by default :
REG LOAD HKLM\WINFE2 .\mount\Windows\System32\config\SYSTEM
Now type :

REG ADD HKLM\WINFE2\ControlSet001\Services\MountMgr /v NoAutoMount /t REG_DWORD /d 1 /f

Now you type:

REG ADD HKLM\WINFE2\ControlSet001\Services\partmgr\Parameters /v SanPolicy /t REG_DWORD /d 3 /f

Now  type :

REG UNLOAD HKLM\WINFE2

Turn off Caps-lock with the Shift key.
REG LOAD HKEY_USERS\WINFE2 .\mount\Windows\System32\config\DEFAULT
Now – in Windows 7 – open regedit with Windows-key + R  and by typing :
regedit
Navigate to HKEY_USERS\WINFE2\Keyboard Layout
Rightclick on “Keyboard Layout”, choose NEW, “Dword value”, name it “Attributes”.
Double-Click the DWORD value you just made and enter: 00010000 ( hexadecimal  is already
marked by default)
Click OK
Navigate to HKEY_USERS\  and put the mouse cursor on “WINFE2″
From the menu above, you choose “File”, and then “unload hive”
This will remove the temporarily added winpe-registry from the windows 7-registry.
(this action is the same as “REG UNLOAD…”)

Installing packages

To view available packages, that can be installed with Dism, you navigate to the folder c:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs.  There you have the name and path of the package to install.
Here (http://technet.microsoft.com/en-us/library/dd799244%28WS.10%29.aspx) you can see that
the XML-package is already included in the base boot.wim of a winpe 3.0.

In this folder, you can see which packages can be installed :
“C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs”

WinPE-WMI.cab                  Installs Windows Management Instrumentation (WMI) support
WinPE-HTA.cab                  Installs HTML application support
WinPE-Scripting.cab         Installs Windows Script Host support
WinPE-MDAC.cab               Installs Microsoft Data Access Component support
WinPE-LegacySetup.cab Installs the legacy setup package
WinPE-Setup.cab                Installs the main setup package
WinPE-Setup-Client.cab  Installs the client setup package (as long as you have already installed the main setup package)
WinPE-Setup-Server.cab  Installs the server setup package (as long as you have already installed the main setup package)
WinPE-WDS-Tools.cab      Installs the Windows Deployment Services tools package
WinPE-FONTSupport-Language.cab        Installs fonts for the specified language: ja-jp, ko-kr, zh-cn, zh-hk, or zh-tw

Add packages, and language packs when needed, by using the Dism command with the /Add-Package  option. For example, to add the HTA package you must add both the language neutral package (WinPE-HTA.cab) along with the language specific package

Dism /image:C:\winpe_x86\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\WinPE-HTA.cab"

Then type:

Dism /image:C:\winpe_x86\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\WinPE-HTA_en-us.cab"

Then

Dism /image:C:\winpe_x86\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\WinPE-wmi.cab"

The following language-specific package may give you an error ; you can leave it out

Dism /image:C:\winpe_x86\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\WinPE-wmi_en-us.cab"

Adding Drivers to WinPE

DISM /image:c:\winpe_x86\mount /Add-Driver /driver:C:\YOUR_FOLDER_OF_INF_DRIVERS\ /recurse

Add drivers with the /recurse command. The /recurse command now allows us to simply have all of our drivers in their own directory and tell DISM to scan the root folder and everything beneath it.The number of subdirectories doesn’t matter. You need the network and vga drivers for every computer you boot up to in the WinPE environment.

PROBLEMS WITH DRVLOAD UNDER WINPE 3.0 : Solution !

In order to use drvload.exe in a Winpe 3.0- session, you  need minimum 512 mb ram (read the details for “drvload”  beneath in  the
winpe 2.1-section) ; to be able to load drivers  on the fly from a usb stick, there is a hotfix (august 12th 2010)
which will reduce  the long loading time of drivers within winpe 3.0 :

http://support.microsoft.com/kb/2276755

Copy  Drvstore.dll and Setupapi.dll files to the following directory
C:\winpe_x86\mount\windows\System32\drivers).
I have made a zip for you with the 32- and 64-bit-versions, you can download here :
!!! You’ll need at least google chrome version 12.0.742.112, Opera browser version 11.50 or Firefox 5 to download from microsoft live skydrive
http://cid-eabc6ce1aad35979.office.live.com/embedicon.aspx/Openbaar/loaddrivers.zip

Screen resolution in winpe

Winpe starts default with a resolution of 800×600. There is a program, called setres.exe, that will give you the
optimal resolution, if the drivers for your graphic card are installed.
http://www.iansharpe.com/downloads.php
Someone made a batch file, setres.bat.
http://www.msfn.org/board/topic/14669-screen-resolution-in-winpe/
Setres.bat will usually be your first command in the command prompt in
a winpe-session. You’ll see a list of possible resolutions. My Dell inspiron 6400 ideally needs 1280X800,
but  – as that option was not included – I have to choose  1024×768 by typing   3, the number corresponding
to that option.
During the process of making a winpe, copy the files setres.exe and setres.bat to :
C:\winpe_x86\mount\windows\System32\
You can download setres.exe v2.1 and setres.bat (version optimised for winpe)  in a zip file here :
!!! You’ll need at least google chrome version 12.0.742.112, Opera browser version 11.50 or Firefox 5 to download from microsoft live skydrive
http://cid-eabc6ce1aad35979.office.live.com/embedicon.aspx/Openbaar/setres.zip

Allocating scratch space.

http://grandstreamdreams.blogspot.com/2010/03/winpe-and-dismpeimg-to-boost-scratch.html

If your Windows PE environment becomes unresponsive when running an application, you may have run out of memory. By default, Windows PE allocates 32 megabytes (MB) of writeable memory, known as scratch space.

In order to be able to set the maximum of scratch space (512 mb), your computer must have preferably 1 gb of ram.
You can also choose 64, 128, 256.

dism /image:C:\winpe_x86\mount /Set-ScratchSpace:512

Use Rocketdock as a would-be shell

http://4sysops.com/archives/free-rocketdock-a-mac-os-x-dock-clone-for-windows/

Adding Custom Files

f

Tip : copy keyboard.exe and Explorer++.exe to C:\winpe_x86\mount\Windows\System32\ with the twin-pane file manager Unreal Commander, and be sure to close unreal commander again.
Of course, you’d rather start your winpe with an already localized keyboard layout (here is an example for belgian azerty – on one of my computers  the dutch version of the Belgian retail Windows 7 Home Premium is installed). Do not expect the winpe to be completely in dutch. Big parts of it will still be in English, but at least you have a familiar keyboard layout
cd c:\program files\Windows AIK\Tools\x86

Next type :

intlcfg.exe -syslocale:nl-be -image:c:\winpe_x86\mount

Now type:

intlcfg.exe -inputlocale:nl-be -image:c:\winpe_x86\mount

Then type :

intlcfg.exe -userlocale:nl-be -image:c:\winpe_x86\mount

:

Check with :
intlcfg -report -image:c:\winpe_x86\mount

Unmounting your finished .WIM

Dism /Unmount-Wim /MountDir:C:\winpe_x86\mount\ /Commit

This commits the final changes to your .WIM file and anything you added to it. Keep waiting, even if the cursor keeps blinking as if it will do so eternally.  It is very important to unmount your .WIM file when you have finished.

Copy your .WIM to Boot ISO

copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim /Y

Create bootable .ISO of WinPE 3.0

oscdimg -n -bc:\winpe_x86\etfsboot.com c:\winpe_x86\ISO c:\winpe_x86\winpe_x86.iso

Burn your iso

Imgburn is a free program that does this job perfectly.

Automation of a winpe with winbuilder.

If you know how to work with winbuilder, you’ll find winbuilder.zip here to make
a forensic winpe with scripts for special forensic programs :

Automation of the process with batch files

In order to create a winfe automatically via batch files , go to http://winfe.wordpress.com
The ones with peimg will be typical for a winfe 2.0 or 2.1 (vista) ;
http://winfe.wordpress.com/downloads/bjorn-gansters-batch-files/
The ones with dism will be winfe 3.0 (windows 7)
The one called “waik3 version” for win 7 will be creating a winfe 3.0 easily + you can create a bootable usb-stick with
it. Here is the link  :
!!! You’ll need at least google chrome version 12.0.742.112, Opera browser version 11.50 or Firefox 5 to download from microsoft live skydrive.
http://winfe.wordpress.com/downloads/waik-3-0-version/
https://skydrive.live.com/?cid=eabc6ce1aad35979&sc=documents&id=EABC6CE1AAD35979!167

You download : CreatewinFEE. It’s a zip file. Extract it, and you’ll see “createwinFEE.txt”
By changing the extension .txt to .bat, you’ll have an executable batch file, made by Mauritz Botha
On drive C: create the following folders :
-drivers  (in which you put your drivers ( the .inf files) in their respective folders)
-WinFEtools , which contains the following 3 sub-folders :
-  Applications (contains all the programs in their respective folder)
-  Desktop (which contains your customized background winfe.bmp)
-  tools , which contains the following 2 subfolders :
+  + + + + bootside  (with the programs in their respective folders)
+  + + + + winfe (this contains the programs (in their respective folders) which you’ll want to use without booting the cd or usb. You can even add things to this folder on the usb while in windows, and it will
be available to you after booting winfe : yes, you can have it both ways.

While executing the batch, I quickly copy keyboard.exe and Explorer++.exe to the
/mount/windows/system32    folder, and the newest drvload drivers , setupapi.dll and drvstore.dll,
to   /mount/windows/system32/drivers
You can give yourself a little bit more time, by changing this line in the batch :
timeout /T 30       to something like        timeout /T  190
The beauty of this batch file is that you can immediately create a usb-stick
with it , but it lacks one essential sentence to do so.
At the end of the batch , you see :
ECHO list disk

Beneath this line,AND BEFORE the line ” ECHO   clean”, you will have to add the complete following sentence :
ECHO select disk 1  (or  -VERY IMPORTANT IF YOURS is disk 2   :         ECHO select disk 2
*always identify your drives by size, so you can determine which is the intended usb stick ) and save the batch file.

If you want to speed things up, you may also want to change  “ECHO format fs=fat32″  to
ECHO format fs=fat32 quick
When making the usb, all these sentences will be typed by hand,
and this batch is by far the easiest one to create a winfe cd and
usb.
You booted a forensic winfe cd or usb, and you plug in another usb-stick
and want to bring it online, and make it writable. Beware that
this process is still hit-and-miss. But at http://winfe.wordpress.com
someone is creating a program to do this successfully.
An external harddisk will work most of the time ; it’s only the usb-sticks
that are a bit recalcitrant.

Whenever you want to reuse the usb-stick for something else,
and you get “permission denied” to do so,
use diskpart, and     clean all      to completely wipe the stick
You can do this process  from a non-forensic winpe-cd, as you are not administrator,
but SYSTEM. This means you have even more rights than an administrator,
and you won’t get  “permission denied” this time.

Automation with a powershell script

There is a magical powershell script that will create a winpe for you, except burning the iso
http://www.gregorystrike.com/?p=269

Afterwards, you will find the finished winpe.iso in the folder “C:\temp\WinPE”
Powershell (the command prompt on steroids) is included in windows 7.
Copy the contents of the script in a text-file , that you save with the extension  .ps1
Rightclick on it , and choose “run in powershell” (you must be administrator for this).

PREPARATION:
-To execute Powershell with admin rights : Start ->
type ‘powershell” in the search bar ; rightclick “windows powershell”, en choose “pin to start menu”.
Rightclick the Powershell in your start menu, choose PROPERTIES, choose ADVANCED,
and put a mark before : execute as administrator. Click “apply”, and “OK”.
To be able to execute a powershell script (.ps1) change the policy
Open Powershell (= rightclick on the item in the startmenu), and type :
Get-ExecutionPolicy
It will be “Restricted”
Type :
Set-ExecutionPolicy Unrestricted
Confirm with Y (yes)
(after the execution of the script, set back to ” Restricted”)

-make a folder on your desktop, named  WinPE_Files , within this folder you create the following  folders : Drivers,   Program Files, Registry and Windows). In the folder “Program Files” you create the folder :
System
The path must be “”C:\Documents and Settings\Administrator\Desktop\WinPE_Files”; (which is identical to :
“C:\Users\Administrator\Desktop\WinPE_Files” because the script executed beautifully) ;  copy the path with a shift + rightclick on the folder “WinPE_Files”, and edit the powershell script to be identical to your path. The script will then
scroll through this folder and the folders underneath.
In the folder “System” you place  autostart.cmd  and winpe.bmp, if you want your screen to look different (under Customizing the background of your winpe you’ll find the specifications for the winpe.bmp) .
My autostart.cmd (a textfile you save with the name autostart.cmd) looks like this ( it sets my keyboard automatically to Belgian azerty)
@ECHO OFF
cd x:\windows\system32
start /WAIT wpeutil EnableFirewall
start /WAIT wpeutil SetKeyboardLayout 1080c:0001080c
start /WAIT cmd.exe
EXIT

Put your winpe on a usb-stick

Preparation : In order to put a valid bootloader onto your usb-stick,
you’ll need a vista install dvd or a windows 7 install dvd, or
if you did not get one with your laptop, download the test version in english
Make a live-id with Microsoft, (preferably you are an it-manager, and
your aim is to test applications on win 7:-)
Log in with your live id.
You will be able to download a test version of win 7 enterprise
Put      http://technet.microsoft.com/           in front of :
en-us/evalcenter/cc442495.aspx?ITPID=wtcfeed           to get the goodies
I think this opportunity will end by the end of 2011.

1. Plug in an empty flash drive

2. Open a Command Prompt with admin rights.

*Go to Start menu > All programs > Accessories, right click on Command Prompt
and select Run as administrator.

3. Now you’ll need to identify your usb stick

type :
DISKPART
and hit enter

Next type :
LIST DISK
and identify – be very careful -  the Disk number (for example : Disk 1) of your
USB flash drive (You should be able to tell by the size)

4. Next type all the below commands one by one (press ENTER after each one)
Here I assume that your usb stick is “Disk 1”. If  your USB flash drive is Disk 2,
then use Disk 2.

SELECT DISK 1

CLEAN

CREATE PARTITION PRIMARY

SELECT PARTITION 1

ACTIVE

FORMAT FS=NTFS QUICK

(you can also choose :  FORMAT FS=FAT32 QUICK  ),
as it seems there is more write activity on an ntfs-formatted stick
(not confirmed)

ASSIGN

EXIT
(this exits diskpart)

Don’t close the command prompt as we need to execute one more command at the
next step. Just minimize it.

5. Non-EFI motherboards will not be able to boot a drive without a bootloader

Next insert your Windows7/Vista DVD into the optical drive and check the
drive letter of the DVD drive. (read “IMPORTANT NOTE”  for another solution if you don’t have a vista or win7 dvd)
In this guide I will assume that your DVD drive letter is “D” and USB drive
letter is “H” (important : control what drive letter your usb-stick has, because a bootsector will
be written to it).

6. Maximize the – in step 4 – minimized Command Prompt.Type the following command now, in order
to go to your win7 or vista dvd (if your cdrom is drive letter D:) :
D:

Then type :
CD BOOT

—————————————————————————
IMPORTANT NOTE for those who don’t have a win7 or vista dvd : If you have installed the waik, no need to
download the test version of windows 7 enterprise,
you find  bootsect.exe here :
C:\Program Files\Windows AIK\Tools\PETools\x86\bootsect.exe
Consequently you can skip step 6 .
Instead , type the command :
cd C:\Program Files\Windows AIK\Tools\PETools\x86\
Then continue from step 7
—————————————————————————-

7. Now we’ll give the usb-stick a bootsector, and type (if H: is your usb drive letter) :

BOOTSECT.EXE /NT60 H:

(with  bootsect.exe /NT60 ,   the underlying winpe has to be made with the Windows Automated Installation Kit
(waik) for vista or for windows 7)

8. now eject the win7 or vista DVD, and insert your ready-made winpe cd.

Now copy the contents of the winpe onto the usb drive.
using your favorite Windows file manager program (with options enabled to see system/hidden files)I had the
impression that this process went much better with Total Commander or Unreal Commander.
If you want to use Robocopy or xcopy  in an administrator command prompt, and if your cd-drive is D:  and if your usb-stick is  H:

robocopy D: H: /MIR /V /FP

With xcopy :

xcopy D:\*.* /s /e /f H:\

9. Your USB drive is ready to boot. The only thing you need to change is
the boot priority in the BIOS to USB . Beware that older motherboards (before 2002 or so) may not be able
to boot from usb. Even on recent motherboards, you may have to try different
usb settings in order to make it work.
Credit goes to :

http://grandstreamdreams.blogspot.com/2009/11/sexy-usb-boots-win-pe-style.html

USING THIS BOOT CD

Possible problem : numlock activated (eee pc / acer)

You want to type k, and you see  2 (or J and you see 1).
Laptops may have integrated numeric keypads on the letters
U, I,O,J,K,L,etc.
A winpe cd (that does not give me any problems on a Dell) boots
on my eee pc and on my Acer with Numlock activated, so I
can’t type  U, I, O, J, K, L.
Holding down the key FN while pushing the Num lk key does the trick;
it deactivates Numlock.
However, different laptops may use other key combinations.
Sometimes the above combination needs to be pressed down simultaneously.
Other key combinations :
press FN + Numlock key (Num lk)
press Numlock key (Num lk)
press FN + F11
press FN + F11 + Num lk
Press left Shift + Num lk
Some HP laptops need FN + F8
press Alt + Num lk on Sony Vaio
press FN + F11 + Scroll lk
FN + Scroll lk
right Shift + Num lk
FN + Shift + Num lk
FOR DELL MINI NETBOOKS that have function keys ( FN key) locked or stuck:
You need to press FN and the key that is next to your “space” key (between “space key” and “alt gr”) simultaneously!

I always use a cable instead of wireless for security’s sake.

If you have integrated the drivers of the ethernet card , winpe will automatically establish an
internet connection via DHCP with the startnet command. By default , it contains already a lot of drivers.

When booting (you’ll have to change the boot order in the bios, so that you boot from cd first), you’ll be presented with a command prompt starting in  X:\windows\system32.
It seems that the firewall is enabled by default. If you are not sure, however, type :
wpeutil EnableFirewall
Everything you copied during the making of your winpe to   C:\winpe_x86\mount\windows\System32\   will be readily available now.
Winpe copies everything to ram. The advantage of this cd is that – even if it starts with a command window – you can use all the gui apps in gui-mode. When you close the command window, the computer shuts down. Leave at least one command window open, if you are using other applications.

A clean shutdown is executed from the command prompt with the command : wpeutil shutdown (Other interesting commands : wpeutil EnableFirewall, or wpeutil DisableFirewall)

In the command window I type :

keyboard.exe

then I choose Belgian azerty, and type

be

Hit Enter, and you have your Belgian azerty.  However, you will only see the changes when you start a second command window by typing :
start cmd.exe

Now we type :
Explorer++.exe
(Explorer++  is an alternative to the windows explorer)
In this explorer window, you’ll see all the mounted hard drives (unless you have edited the registry to start with the fixed drives unmounted for forensic use)
Double click on X: (you can read and write to this drive)
Double click on “Program Files” And there you’ll see all your own programs. In Explorer++.exe, you can open a second command prompt, from which you can use dd.exe, to make images of your hard drive.

For the time being, you’ll use the us keyboard layout.  Then type :

cd.. 

(+ ENTER  : means pushing the Enter key)

cd..
+ ENTER ; then type:

cd "Program Files" 

+ ENTER ; then:

cd dd 

Simple programs , that don’t need the NET framework for instance, can be installed in the live cd. Try it.
The use of portable programs on a usb-stick is even better. Beware that – if you made a forensic winfe – your usb stick will not be mounted. You will have to mount it with diskpart.
In the winfe I have integrated flash and firefoxportable ; this is used as my live-cd for internet banking. Although I have to admit that pclinuxos 2010 live cd – openbox edition , Lubuntu (based on ubuntu 10.04), Linuxmint xfce (which contains a firewall- you have to start it yourself), or peppermint one live cd (also based on ubuntu) start way faster (2 min.), so for internet banking these are now my preferred live-cd’s
It seems you can leave a winpe running for 72 hours, after which it will automatically shut down.
There is a script in winbuilder that will disable this 72-hour-limitation. You will have a graphical winpe  with winbuilder.
Update : go to http://windowspowershell.wordpress.com and on the bottom ot the page you can download winbuilder from dropbox. But read the accompanying warning about removing the driver folders specific to my hardware !!!!

Customizing the background of your winpe
Make your best photo the default background of your winpe.
First, make sure you have a photo or a picture with the following characteristics :
1024×768 pixels, 24-bit color, 72 DPI resolution
(you can do so by using the resize/resample feature in Irfanview, and save as a bitmap)
Change its name to winpe.bmp.

When you have mounted the winpe, copy this winpe.bmp to c:\winpe_x86\mount\windows\system32
overwriting the original one.

Making your winpe a basis for a future winpe

Download poweriso , and open your winpe ; in the left pane navigate to “sources”, there you’ll find “boot.wim”.
In the menu  choose “extract”, you will then be able to save the file in a folder of your choice.
Copy this boot.wim to “C:\Program Files\Windows AIK\Tools\PETools\x86″. Rename winpe.wim to originalwinpe.wim ,and rename boot.wim to winpe.wim.

When you have mounted your winpe.wim, you probably won’t remember which packages you installed. Check with :
dism /image:C:\winpe_x86\mount /get-packages
Control how much scratch space you have with :
Dism /image:C:\winpe_x86\mount /Get-ScratchSpace
you can change with :
Dism /image:C:\winpe_x86\mount /set-ScratchSpace:xxx     (xxx may be  256 or so)
Normally, your winpe is mounted under the drive letter x:            Control with :
Dism /image:C:\winpe_x86\mount /Get-TargetPath
Change the target path :
Dism /image:C:\winpe_x86\mount /Set-TargetPath:T:

=====================================================================================================

WINFE : windows fe (the forensic edition of windows pe (or winpe), built on Vista SP1 or SP2

The easiest way is to activate the administrator account : Start, Run, enter the command:

net user administrator /active:yes       Then go to “Control Panel”, “User accounts”,
“manage another user account” : the administrator account will show up, and you
attribute a password for it (be careful : you’ll need this password to log in

Restart your computer, and log on into the Administrator account Now download the Waik , and install it. Necessary: vista sp1, with the “Windows AIK” (waik) for Vista sp1, which you can download from Microsoft. http://www.microsoft.com/downloads/details.aspx?FamilyID=94BB6E34-D890-4932-81A5-5B50C657DE08&displaylang=en

Update : I have installed service pack 2 for Vista, and the instructions  remain the same (there is no special waik for vista sp2)
Attention : a different version of windows, or a different version of the WAIK may give other results than the ones i’m describing here.

Those with windows xp , you can make a simple winpe , not a forensic one ; read the following between the lines
———————————————————————————————————————————————

If you use windows xp service pack 2 or 3, and if you only want to make an ordinare winpe , without the forensic registry editing  (that was only introduced in later versions of windows), you can download the waik to install in windows xp from here : (you’ll have to undergo the genuine validation procedure that checks if your winxp is genuine)

http://www.microsoft.com/downloads/details.aspx?familyid=C7D4BC6D-15F3-4284-9123-679830D629F2&displaylang=en

The download is an image with the extension .img. You can burn this with the free  tool Imgburn to a dvd.
Making the winpe : be sure to be logged on as administrator on win xp
Start
Programs
Microsoft Windows AIK

Now click on “windows petools command prompt”

Now look beneath under “the steps for making a winfe disk”, and
follow everything beneath “Enter the commands :”

Skip everything that has to do with registry editing. You can’t
make a forensic winpe within winxp and the waik for winxp.
You may delete however “bootfix.bin” if you want.

Whatever may happen : always unmount (so be sure your laptop
is not working on a battery that may give up during the process),
and remove the folder c:\WinFEx86, before starting another
building process.

————————————————————————————————————————————–

The steps for making a winfe disk : Preparations
If you want to edit the registry in order to make sure that winfe starts with the fixed disks unmounted, I have found this workaround
Make a folder in C: called “reg” The folder “reg” must contain the following files you can get from c:\windows\system32  : reg.exe, regedt32.exe, regini.exe, registeriepkeys.exe , regsvc.dll, regsvr32.exe

I have made a folder “c:\programs” with subfolders, in which I put all my standalone programs. Subfolders :

-FILEMANAGER, with the browser Opera Oneuse, and the filemanager  Explorer++.exe.
Optionally you can download Unreal Commander on      http://x-diesel.com/download.php?
It is a free twin- pane file-manager that is almost a copy of TotalCommander  (if you extract the setup file with Uniextract, you’ll have a standalone app).
To view hidden files in Unreal Commander, click on “Show”, and then mark “show hidden files”.The unreal commander has a very performing file search, which can work with regular expressions. It”s free, however, you’ll need to create a key, which will only last for 25 days, to have all the options of the program. So, it will be outdated on the winpe the 26th day.
You could however put it on a usb-stick, and update the key regularly. You can find it here :

http://x-diesel.com/

http://x-diesel.com/download.php?

-FAU with dd from the Forensic Acquisition utilities. In the download PROGSnew.zip, I have included a text file with
a detailed description on how to use this

-DD with the dd.exe from John Newbigin (in the download you’ll find a text file on how to use this program)

-Odin (to have a clearer view on your hard disks)
Download “PROGSnew.zip” here :
!!! You’ll need at least google chrome version 12.0.742.112, Opera browser version 11.50 or Firefox 5 to download from microsoft live skydrive.
http://cid-eabc6ce1aad35979.skydrive.live.com/embedicon.aspx/Openbaar/PROGSnew.zip

Open  a command prompt as admin : start, All programs, Microsoft Windows AIK, rightclick “Deployment Tools command prompt”, and select “‘run as administrator”

When you run as Administrator, the command prompt title will show as “Administrator: Command Prompt” instead of the regular “C:\Windows\system32\cmd.exe” making it easier to tell when multiple command prompt windows are running)

You can copy the sentences with ctrl + C , and then paste it in the command prompt with a rightclick choosing "paste".

Enter the commands :

cd c:\Program Files\Windows AIK\Tools\PETools\ 

Now type :

cmd /k copype.cmd x86 c:\WinFEx86

Before you mount everything, you’ll have to remove the file “bootfix.bin”  in c:\WinFEx86\ISO\boot. This bootfix.bin gives you the choice : start from cd or not, and this is not desirable in a winfe. You navigate to

cd c:\program files\windows AIK\Tools\Petools\

Now we will mount everything with the following command :

imagex /mountrw C:\WinFEx86\ISO\sources\boot.wim 1 C:\WinFEx86\mount

If you want to change keyboards easily, you’ll need the file “keyboard.exe”, which you can download here (see link above to download “PROGSnew.zip) and you’ll need to copy it  (with unreal commander) to C:\WinFEx86\mount\windows\system32
Copy “Explorer++.exe” which is now in “C:\programs”  to the folder “C:\WinFEx86\mount\windows\system32″

With WinFe mounted, you can copy all the programs you have collected in the folder” C:\programs” to the folder “C:\WinFEx86\mount\Program Files”  Be sure to always close the Windows explorer window afterwards. You don’t want it to be open, when you unmount everything.
Navigate to this directory :

cd c:\program files\windows AIK\Tools\Petools

In order to install  a special driver you’ll need, you’ll have to do commands like this :

peimg.exe /inf="C:\Windows\System32\SATADRIVER\WINXP\fast.inf" C:\WinFEx86\mount\Windows

Or with the last part between parentheses :

peimg.exe /inf="C:\Windows\System32\SATADRIVER\WINXP\fast.inf" "C:\WinFEx86\mount\Windows" 

Sometimes drivers are downloaded as an .exe. You could use winrar or 7-zip to extract, in order to view the .inf-files you need.
Now suppose the structure of your extracted drivers looks like this :
C:\winpedrivers\massstorage\satadriver\winxp\*.inf
C:\winpedrivers\massstorage\idedriver\winxp\*.inf
c:\winpedrivers\graphical\nvidiadriver\winxp\*.inf
c:\winpedrivers\graphical\atidriver\winxp\*.inf
(you might want to search the appropriate Vista-drivers instead of the winxp ones)
and you want to install all the drivers from the folder c:\winpedrivers and its subfolders in one go.
Issue the following command :

for /R c:\winpedrivers %i in (*.inf) do peimg /inf=%i c:\WinFEx86\mount\windows

Tip from :

http://www.uvm.edu/~jgm/wordpress/?cat=3

You’ll see the message : installing inf package. In order to add additional packages :

cd c:\program files\windows AIK\Tools\Petools 

Now type :

peimg /list /image=c:\WinFEx86\mount

The packages will be listed, with a minus sign to the left of the package name. We are going to add 3 Packages to the Windows directory in the WinPE image. Type the following:

cd c:\program files\windows AIK\Tools\Petools\    

Now type :

peimg /Install=WinPE-XML-Package C:\WinFEx86\mount\Windows

Now type:

peimg /install=WinPE-Scripting-Package C:\WinFEx86\mount\Windows

Next type:

peimg /install=WinPE-WMI-Package C:\WinFEx86\mount\Windows 

Next type:

peimg /install=WinPE-HTA-Package C:\WinFEx86\mount\Windows

Then type :

peimg /list /image=C:\WinFEx86\mount\

You will see a + sign next to the WinPE scripting, wmi, hta and XML packages. If you want to be sure your hard disks are not mounted, when you image them (in a forensic environment), then be sure to edit the registry .
Navigate to :

cd c:\WinFEx86 

and execute the command:

copy C:\reg 

six files, called reg.exe, etcetera, that I had you put in the folder “c:\reg”, will now be in C:\WinFEx86 Now we’ll change the registry (one sentence at a time + push Enter-key)

REG LOAD HKLM\WINFE2 .\mount\Windows\System32\config\SYSTEM   

Now you type:

REG ADD HKLM\WINFE2\ControlSet001\Services\MountMgr /v NoAutoMount /t REG_DWORD /d 1 /f

you type:

REG ADD HKLM\WINFE2\ControlSet001\Services\partmgr\Parameters /v SanPolicy /t REG_DWORD /d 3 /f

Now type:

REG UNLOAD HKLM\WINFE2

Now you copy the contents of your “C:\programs”, where you have put all your necessary standalones, to  c:\WinFEx86\mount\Program Files  .Close windows explorer again.

You’d rather start your winpe with an already localized keyboard layout (here is an example for belgian azerty – on my computer  the dutch version  is installed). Do not expect the winpe to be completely in dutch. Big parts of it will still be in English, but at least you have a familiar keyboard layout

cd c:\program files\Windows AIK\Tools\x86 
intlcfg.exe -inputlocale:nl-be -image:c:\winFEx86\mount
intlcfg.exe -syslocale:nl-be -image:c:\winFEx86\mount
intlcfg.exe -userlocale:nl-be -image:c:\winFEx86\mount
Check with :
intlcfg -report -image:c:\winFEx86\mount

Now we can unmount:

cd c:\Program Files\Windows AIK\Tools\x86 

Then:

imagex.exe /unmount /commit C:\WinFEx86\mount

This takes quite a while .We can make the iso

cd c:\program files\windows AIK\tools\x86 

Then type :

oscdimg -n -m -o -bC:\WinFEx86\etfsboot.com C:\WinFEx86\ISO C:\WinFEx86\WinFEX86.iso

You can then burn the iso with Imgburn.

Customizing the background of your winpe
Make your best photo the default background of your winpe.
First, make sure you have a photo or a picture with the following characteristics :
1024×768 pixels, 24-bit color, 72 DPI resolution
(you can do so by using the resize/resample feature in Irfanview, and save as a bitmap)
Change its name to winpe.bmp.

When you have mounted the winpe, copy this winpe.bmp to c:\winfFEx86\mount\windows\system32
overwriting the original one.

Use of diskpart.exe in mounting of hard disks with a winfe

This is the procedure : in order to learn how to mount disks readonly and such, you will have to learn all the commands of diskpart.exe
—————————————————————————————————————————————————–
Use of diskpart.exe in mounting of hard disks with a winfe
bootdisk (which boots with hard drives unmounted)

If you don’t know if you’re using a forensic winpe or a normal one, just issue the following commands :
diskpart

next command :
DISKPART > SAN
(this will give the actual san policy of the drives ; if the result is OfflineAll, then it’s a forensic winfe)

DISKPART > SAN POLICY=OnlineAll
is the command you want to use to be able to mount the drives (not a good idea in forensic imaging !!!!)

When you boot this winfe, the hard disks will be unmounted. However : to image a hard drive to another ,the latter should be mounted read-write, and the volume (or partition) should be read-write too.
You should use the Diskpart utility to add and mount hard disks. In
order to save an image to an external drive you have to put it online,
assign a drive letter and remove its read only attribute. A number of
Diskpart commands are required to achieve this.
( http://www.thinktankforensics.com/index.php/forensicsf?start=25 )

Windows FE boots up to a shell. You will have an admin command prompt
on the X drive which is a RAM disk. To launch the Diskpart utility , navigate to

X:\windows\system32 (actually , the boot disk starts in this folder) and type :
diskpart

To establish which disks can be seen, type:

DISKPART >List Disk

If you have not yet attached your collection disk, do it now, and type:

DISKPART > Rescan
then type :
List Disk
Now you have to identify your disk (look at the size).
If you see two disks, and number 1 is the drive you want to make writable,
use the following command

DISKPART >Select Disk 1

and put it online:

DISKPART >online disk

rescan
this is the command so you can verify if the disk is indeed online)

To view the actual attributes, type :
attributes disk

and then clear any readonly attributes with the following command :

DISKPART >Attributes disk clear readonly

attributes disk (this command controls if the readonly attribute is indeed removed)

Then identify the volume you wish to image to:

DISKPART >List Volume
and then select the volume ; if it’s volume 1, type :
DISKPART >Select Volume 1

online volume  (to bring the volume online)

and then clear any readonly attributes (with an ordinary small usb-stick, this command may
be superfluous) :

DISKPART >Attributes volume clear readonly

Next – assign a drive letter:

DISKPART >assign letter=k

You should now be able to write an image to your collection disk. If
you are getting the error “your disk is write protected” or similar the
problem most likely lies with the read only attribute.

Now you can make an image with dd.exe
After you made your image, you have to remove the disks again(unmounting)
With Explorer++.exe, navigate to x:\windows\system32\, open a command
prompt, and type :
diskpart
list disk       (identify your disk by size)
select disk 1
list volume
select volume 1        (if this was the volume you used)
remove all dismount       (this removes the drive letter, and dismounts the volume)
list disk
(disk 1 is still selected)
offline disk

(this brings the disk offline)

—————————————————————————————————————————————–

I have made this disk  in order to be able to image my hard disks with my favorite program : dd.exe  for windows from John Newbigin.

http://www.chrysocome.net/dd

You can  take version 0.5 , or the newly compiled
version 0.6 beta
on the site of webconverger;
http://webconverger.com/dd.exe

dd --list output to txt-file : dd --list 2> output.txt

It takes a long time to image a disk, but the result is flawless.

I’ve imaged Vista, windows 7, dualboot disks, etc.
When you re-image back to another disk, be sure that this one
is zero-filled. You could use diskpart on the winpe for this ( in a command prompt) :
diskpart
list disk
select disk 0    ((or 1, or 2) be sure to identify the right disk)
clean all       (this zerofills the drive : it takes 30 minutes per 60 gb)
exit
You can use Darik’s boot and nuke.iso, and type “autonuke”, which will
overwrite the drive 3 times with random signs instead of zero-filling.

To zero-fill I always use Hiren’s boot cd, which contains
all the Hard disk tools from every hard disk manufacturer on the
planet, or almost. (but then you’ll have to know the manufacturer and the make of the drive)
Google the following search terms “hiren’s boot cd 10.0″, and
hirensbootcd.net will be your saviour.

For zero-filling, the following terms can be found :
“erase disk”, “low level format”, or “fill drive with zeroes”

Use of the winpe disk to back up your hard drive to an external
hard drive

I have a laptop with two hard drives, and want to back up the
first hard drive to an external hard drive.

preparations :

be sure your external drive is formatted NTFS.
Then there’s no need for splitting the backup in chunks of 2 gb,
because NTFS can handle large files.

You attach the hard drive (via a hard disk enclosure (icybox) , or
via an usb-atapi cable) to an usb-port.

You change the boot order in the bios, so the cd boots first.
The first thing you’ll see when the cd boots up, is a command prompt
window.
Attention : once you close the command prompt,  the computer shuts down.

Once you see the command window(this can take a while) , type :

keyboard.exe

This will give you the option to choose a localized keyboard, like belgian
You type :
be
Then hit ENTER twice.

You will have to open a second command window to use your
belgian azerty keyboard, by typing :
start cmd

Now you type :
Explorer++.exe
(Explorer++ is an alternative to Windows Explorer)
In this explorer window, you’ll see all the mounted hard drives
(unless you have edited the registry to start with the fixed drives
unmounted)
Double click on X: (you can read an write to this drive)
Double click on “Program Files”
And there you’ll see all your own programs.
In Explorer++.exe, you can open a second command prompt,
which will now give you the belgian azerty keyboard layout, and from
which you can use dd.exe, to make images of your hard drive.

For the time being, you’ll use the us keyboard layout
Type :

cd.. 

+ push Enter key ; then type:

cd..
+ ENTER key ; then type:

cd "Program Files" 

+ ENTER key ; then type:

cd dd 

There is another way (besides using keyboard.exe)  to change the keyboard layout on the fly in
your winpe.
You boot your computer with the winpe-cd.

But first you’ll have to copy your localized keyboard.dll to
x:\windows\system32. In my case (belgian (flemish) azerty keyboard), I
need to copy KBDBENE.dll (that I put on a usb-stick) to the folder
mentioned above, and verify that the files wpeutil.exe and wpeutil.dll
are already in this folder.

The cd boots to the folder : x:\windows\system32

Then I issue the command :

wpeutil SetKeyboardLayout 1080c:0001080c
(this is Belgian azerty comma, the next one is Belgian point)
wpeutil SetKeyboardLayout 0813:00000813
and the command :
start cmd.exe
as the changed keyboard layout will only be applied to a new process.

How do you find code 1080c:0001080c

For the first sequence of numbers : use the last numbers of
the
code, leaving out the zeroes that precede it,  (if there are
only
tree, put a zero in front of it, because you need minimum four numbers)
For the  sequence of 8 numbers that form the last part :

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001080c]

Use the last numbers of the code, and put one zero – or more
if necessary, because you need 8 numbers -  in front of it.

If you want to know what keyboard.dll you need, and which code
to use,
you’ll find the codes below .

http://technet.microsoft.com/en-us/library/cc766503(WS.10).aspx

Install your winpe to a flash drive or usb stick

Here is an outstanding tutorial on how to do it :

http://blog.brianleejackson.com/formatting-winpe-3-0-usb-flash-drive-dism

Install drivers on the fly within an active winpe-session

Important : you’ll need 512 mb ram to install drivers on the fly.
I’m using winpe 3.0 here (should work with winpe 2 or 2.1 as well)
Sometimes it’s easier to put additional drivers on a usb-stick in a folder
(winpedrivers\dellbroadcom\b44win.inf  and also a sys-file, eventually a dll-file) , so you
can integrate them when needed. I also put Explorer++.exe and operaoneuse.exe
in the root of the usb drive.
I have managed to use winxp ethernet drivers in a winpe 3.0 this way.

Problems you can come across : you can’t see your usb stick.
Colin Ramsden at winfe.wordpress.com is busy working on
a solution for this.
Normally there should be no problems with usb drives, as they
are seen as disks.

Booting up the winpe, you’re in x:\windows\system32

You type :
diskpart
and then you type :
list disk
Normally you should see your usb disk online (identify by gigabyte or mb)
Try re-plugging it in a second time if you don’t see it. Repeat the commands above
and eventually also the command         rescan
Type :
select disk 1  (if you know that this is your usb device)
list volume
now you should see the drive letter the usb has. Type “exit” to leave diskpart.
We’re in c:\windows\system32.
With the command       cd..
you move to x:\windows
Repeat        cd..
we have moved to  x:
type the drive-letter for your usb-stick you have retrieved via the diskpart command.
Now you’re in the root of the usb-stick
Typing Explorer++.exe   will give you a graphical  explorer-window in which you shall see
your usb-stick.
Problem solved ; now we can access the network drivers on the usb-stick.

When you boot up your winpe cd, you’ll find drvload.exe in the folder x:\windows\system32.

Assuming we can”t get an internet connection, we’ll control first if the network
drivers are installed.
Type IPCONFIG or ipconfig /all. If the command lists the IP addresses for your network,
you’re good to go.
However, we don”t get an IP-address. Now we will install the ethernet driver with drvload.exe.
If a reboot is specified in the inf  or sys , as may be the case with graphical drivers,
you’re out of luck.Then you’ll have to integrate these before, when building  your winpe.
Either with DISM in a winpe 3.0 , or with peimg in a winpe 2.0 or 2.1.
The drive letter of my usb-stick is f:
drvload f:\winpedrivers\dellbroadcom\b44win.inf
If all goes well, you’ll see : “drivers successfully loaded”
Update  August 12th, 2010 : :hotfix for drvload with winpe 3.0

http://support.microsoft.com/kb/2276755

Copy the updated Drvstore.dll and Setupapi.dll files to the following directory
C:\winpe_x86\mount\windows\System32\drivers)

REMARK : You have now found the correct INF file, however you may also need to identify any additional files (eg .SYS and .DLL files). You can use Notepad to look at the text in the INF file to determine which files are used. Typically ‘doris.inf’ will use a .SYS file called ‘doris.sys’.
Repeat the test above but ensure you only have the set of files that you wish to test on the USB flash memory drive (you can simply move the unwanted files. END OF REMARK

Type :
NETCFG -WINPE
This will initialize the network connection.

Type :
IPCONFIG or ipconfig /all
If you see an ip-address, then you can launch f:\operaoneuse.exe, and
surf the net.

Network connection (this one is not tested by me, but it might be of use) :
net use g: \\192.168.200.4\sh /USER:Li587\ad A1234567
This is a command for connecting a remote shared folder. The folder will be connected as the disk g:, is located in a PC with the IP address 192.168.200.4 and sharing name sh. Domain or name of the computer is Li587, user ad, password A1234567.
Error 3775 The user context supplied is invalid. – this will appear if credentials of the user is required (the following is not sufficient: net use g: \\192.168.200.4\sh)

________________________________________________________________________________________________

WINPE 4.0 for deploying windows 8 WITH WAIK FOR WINDOWS 8

You will need to be administrator to easily make a winpe.

The new waik for deploying windows 8 is now called “assessment and deployment kit” (ADK),
and it can be installed in windows 7 and in the new Windows 8 Developer Preview.

The file is “en_windows_developer_preview_adk_x86_x64_734756.zip” , and for now
it is only available to MSDN-subscribers (prices beginning at around 745 euro if you want a
subscription),or for students whose institutions have a paid membership of
MSDN ACADEMIC ALLIANCE.

Details :
Date Published (UTC): 9/13/2011 4:18:35 PM
Last Updated (UTC): 9/13/2011 4:18:35 PM
SHA1: 037F8159737AAB475732684A42A7A8F92AC0197C
ISO/CRC: 97482D1C

I happen to know someone with such a membership and could try it out.

If you are installing the Assessment and Deployment Kit on windows 7 , you will be asked to first
install Net Framework 4.

Here is a description to make a 64-bit version of winpe 4.0 :
http://www.deploymentresearch.com/Blog/tabid/62/EntryId/41/Windows-8-Preview-Howto-Creating-a-WinPE-boot-image-with-NET-Framework-and-PowerShell.aspx

This is the procedure  I used to make a 32-bit version of winpe 4.0 :

If you want a keyboard layout other than the default us keyboard, you will need to
copy “intlcfg.exe” from a WINDOWS AUTOMATED INSTALLATION KIT for Windows 7 (waik) to the folder :
“C:\Program Files\Windows Kits\8.0\Assessment and Deployment Kit\Deployment and Imaging Tools\x86\Imaging”.

Start the command prompt of the ADK  like this :

Start
All programs
Windows kits
windows ADK
RightClick on “Deployment and Imaging Tools Environment” with the command-prompt icon, and execute as administrator

You can copy the sentences with ctrl + C , and then paste it in the command prompt with a rightclick choosing "paste".

Now you have to type the following commands, pushing the Enter-key after every sentence.

Dism /Cleanup-Wim

Now rename c:\winpe4  to c:\winpe4_old,  or delete the folder “c:\winpe4″, if it existed before.

Type the following commands :

mkdir c:\Mount
mkdir c:\winpe4
mkdir C:\winpe4\ISO
mkdir C:\DRIVERS

If you see TWO sentences above the line, type the command in ONE SENTENCE ONLY, not two  :

cd /d C:\Program Files\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\x86
________________________________________________________________________
copy winpe.wim C:\winpe4

Mount the image with the following command:
Imagex /mountrw C:\winpe4\winpe.wim 1 C:\Mount

Add packages to the image by running the following commands .
Type each sentence, push Enter after each one, and wait long enough for the commands to finish
cd WinPE_OCs

dism /image:C:\Mount /add-package /packagepath:WinPE-Scripting.cab
dism /image:C:\Mount /add-package /packagepath:en-us\WinPE-Scripting_en-us.cab
dism /image:C:\Mount /add-package /packagepath:WinPE-WMI.cab
dism /image:C:\Mount /add-package /packagepath:en-us\WinPE-WMI_en-us.cab
dism /image:C:\Mount /add-package /packagepath:WinPE-MDAC.cab
dism /image:C:\Mount /add-package /packagepath:en-us\WinPE-MDAC_en-us.cab
dism /image:C:\Mount /add-package /packagepath:WinPE-HTA.cab
dism /image:C:\Mount /add-package /packagepath:en-us\WinPE-HTA_en-us.cab
dism /image:C:\Mount /add-package /packagepath:WinPE-NetFx4.cab
dism /image:C:\Mount /add-package /packagepath:en-us\WinPE-NetFx4_en-us.cab
dism /image:C:\Mount /add-package /packagepath:WinPE-PowerShell3.cab
dism /image:C:\Mount /add-package /packagepath:en-us\WinPE-PowerShell3_en-us.cab
dism /image:C:\Mount /add-package /packagepath:WinPE-DismCmdlets.cab
dism /image:C:\Mount /add-package /packagepath:en-us\WinPE-DismCmdlets_en-us.cab

If you see TWO sentences above the line, type them as ONE SENTENCE in the command prompt :

cd /d C:\Program Files\Windows Kits\8.0\Assessment and Deployment Kit\Deployment and Imaging Tools\x86\Imaging
___________________________________________________________________________________________
The next command will give me a Belgian azerty keyboard layout at the start of the winpe boot cd :

intlcfg.exe -inputlocale:nl-be -image:c:\mount

Copy any programs (standalone apps) you need to the “c:\mount\Program Files” directory.

During the process of making a winpe, copy the files setres.exe and setres.bat to :
C:\mount\windows\System32\
Rename setres.bat  to  res.bat

You can download setres.exe v2.1 and setres.bat (version optimised for winpe 3.0 and winpe 4.0)  in a zip file here :
!!! You’ll need at least google chrome version 12.0.742.112, Opera browser version 11.50 or Firefox 5 to download from microsoft live skydrive
http://cid-eabc6ce1aad35979.office.live.com/embedicon.aspx/Openbaar/setres.zip

When you start your winpe boot-cd, you will be in the directory x:\windows\system32
By typing res.bat   (+ push Enter-key), you will see a choice of resolutions , which MAY BE supported
by your monitor.

I always type :
3
to get a resolution of 1024 x 768  instead of the default 800 x 600.

Another program I copy in the C:\mount\windows\system32  directory is
Explorer++.exe, downloadable here (choose 32-bit or 64-bit)
http://www.explorerplusplus.com/download

Rename Explorer++.exe  to  ex.exe
At the start of the winpe-boot-cd, you type :
ex          (and push Enter-key)
and you will have a Windows Explorer-like graphical navigation program.

Another must-have is a portable Firefox, which I first installed to a usb-stick
(on a NEW and CLEAN VIRUS-FREE system). I rename the file “firefox.exe”
to “go.exe”.
I copy the contents of the folder “Firefoxportable” directly to the folder
C:\mount\windows\system32

At the start of the winpe, I only have to type :
go
to be able to surf the net (That is if your winpe contains the ethernet or
wireless drivers  your computer needs to establish an internet
connection)

Installing drivers

Put for instance a folder “Realtek wireless driver”, containing .inf-files, in the folder C:\DRIVERS /
the /recurse  parameter will search through all the subfolders of c:\DRIVERS and install them.
DISM /image:c:\Mount /Add-Driver /driver:C:\DRIVERS\ /recurse

If your Windows PE environment becomes unresponsive when running an application,
you may have run out of memory. By default, Windows PE allocates 32 megabytes (MB)
of writeable memory, known as scratch space.
Dism /image:C:\mount /Get-ScratchSpace
Dism /image:C:\mount /set-ScratchSpace:128     (xxx may be  256 or so,has to be a multiple of 32)
————————————————————————————————————————
While making your winpe , open Notepad, and copy the following into it :
@ECHO OFF
wpeutil shutdown
Now save this as stop.bat (don’t save as .txt file, but choose “All files”), and
put   stop.bat    in the folder C:\Mount\Windows\System32
Whenever you want to shutdown your winpe, type   :            stop  (push Enter-key)
————————————————————————————————————-

Edit the registry of your future winpe for adjustments

1. MAKE A FORENSIC WINPE (hard disks not mounted)

Start – run
Type :
regedit
and OK

Put the cursor on :

HKEY_LOCAL_MACHINE

Choose “File”, and then “load hive”, navigate to :

“C:\mount\Windows\System32\config”

and put your cursor on “SYSTEM”   and click “Open”

Now you will have to give a key name :
type :      WINFE2
Click “OK”

Now, in the registry, navigate to
HKEY_LOCAL_MACHINE\WINFE2\ControlSet001\Services\MountMgr
Rightclick MountMgr
Choose “new”  – “dword 32BIT value” (if your winpe is 32bit)
Type the name :
NoAutoMount
Doubleclick “NoAutoMount”, en change the value  0  to  1

Now, in the registry, navigate to
HKEY_LOCAL_MACHINE\WINFE2\ControlSet001\Services\partmgr\
Click on “Parameters”
In the right panel, choose “SanPolicy”, doubleclick it,
and change the value to   3

Click OK

In the left pane, click “WINFE2″
Choose “File”, and then “unload hive”
Click “Yes”

Close regedit
_______________________________________________________________________________

2 CHANGE PRELOADED KEYBOARD LAYOUT OF YOUR WINPE

When you want your winpe to have a certain keyboard layout preloaded at start :
Start – run
Type :
regedit
and OK

Put the cursor on :

HKEY_LOCAL_MACHINE

Choose “File”, and then “load hive”
navigate to

“C:\mount\Windows\System32\config”
and open “DEFAULT”
Now you will have to give a key name :
type :      WINFE2
Click “OK”

Now, in the registry, navigate to
HKEY_LOCAL_MACHINE\WINFE2\Keyboard Layout\Preload

I change the value 1 from     00000813 (Belgian point)  to   0001080c (is Belgian comma,
to have a comma on the numeric keypad of my laptop)

In the left pane, click “WINFE2″
Choose “File”, and then “unload hive”
Click “Yes”

Close regedit

____________________________________________________________________________________________

3 TURN OFF CAPSLOCK WITH THE SHIFT KEY

Start – run
Type :
regedit
and OK

Put the cursor on :

HKEY_LOCAL_MACHINE

Choose “File”, and then “load hive”
navigate to

“C:\mount\Windows\System32\config”
and open “DEFAULT”
Now you will have to give a key name :
type :      WINFE2
Click OK

Now, in the registry, navigate to

REG LOAD HKEY_USERS\WINFE2\Keyboard Layout
Rightclick on “Keyboard Layout”, choose NEW, “Dword value (32 bit)”, name it “Attributes”.
Double-Click the DWORD value you just made and enter: 00010000
(hexadecimal, but this is already marked by default)
Click OK
Navigate to HKEY_USERS\  and put the mouse cursor on “WINFE2″
From the menu above, you choose “File”, and then “unload hive”
This will remove the temporarily added winpe-registry from the windows 7-registry.

_____________________________________________________________________________________

Commit the changes to the boot image by running the following command:

Imagex /unmount /commit C:\Mount

Create a bootable ISO image
If you see TWO SENTENCES above the line , THEY HAVE  TO BE TYPED AS ONE SENTENCE, NOT AS TWO PARTS :

cd /d C:\Program Files\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\x86
_______________________________________________________________________________________

robocopy Media /MIR /V /FP C:\winpe4\ISO

mkdir c:\winpe4\ISO\Sources
cd C:\winpe4
copy winpe.wim C:\winpe4\ISO\Sources
cd C:\winpe4\ISO\Sources
ren winpe.wim boot.wim

If you see TWO SENTENCES ABOVE THE NEXT LINE, type them as ONE SENTENCE in the command prompt :

cd /d C:\Program Files\Windows Kits\8.0\Assessment and Deployment Kit\Deployment and Imaging Tools\x86\Oscdimg
_________________________________________________________________________________________
copy etfsboot.com C:\winpe4

oscdimg -bC:\winpe4\etfsboot.com -n C:\winpe4\ISO C:\winpe4\winpe4_32bit.iso
Burn the iso with Imgburn, and boot up your computer (be sure to change the boot order to CD first in the bios

how to use this winpe
The winpe starts with a command prompt in the directory X:\Windows\System32

you have to type everything from within this directory, and push Enter-key after every command :

Type :   ex           and Explorer++ (a windows explorer-clone) will open
Type :  res           and you can adjust the resolution
Type : go            and Firefox will open
Type :  stop       if you want to shut down the winpe
Suppose you want to load drivers while you’re using the winpe, put the drivers for Windows 7
on a usb-stick (named F: for instance)  , like so F:\drivers\win7driver.inf
This is for a non-forensic winpe
Type this :
drvload “F:\drivers\win7driver.inf”
and the drivers will be loaded.

_______________________________________________________________________________________

Graphical winpe made from Windows 8 Developer Preview (but without Metro gui)
No need for the new Assessment and Deployment Kit, which only MSDN-subscribers get,
You only need the Windows 8 Developer Preview iso which you can download for free.
Be careful : the 64-bit dvd WITH DEVELOPER TOOLS will NOT fit on a normal DVD, but
needs a 9-gig dvd.
http://msdn.microsoft.com/en-us/windows/apps/br229516
You can make the winpe from within Windows 7, and it will contain the
new Internet Explorer 10.
You can make it with MultiPe-Leopard-winbuilder.You’ll find the description at the bottom of this webpage :
http://windowspowershell.wordpress.com
_______________________________________________________________________________________

All the instructions I gathered on this page are collected from
the following websites , with sincere thanks to all these people :

http://www.slideshare.net/ctin/ctin-windows-fe-1256287
http://www.twine.com/item/113421dk0-g99/windows-fe
http://forensicsfromthesausagefactory.blogspot.com/2008/07/windows-fe.html
http://multidisciplinary.wordpress.com/2009/01/27/create-a-custom-windows-pe-30-beta-image-useful-for-imagex-imagingbackup/
http://blog.brianleejackson.com/deployment-image-servicing-and-management-dism-winpe-3-0-boot-environment/comment-page-1#comment-459

The keyboard dlls and the codes, sorted by country :

Afghanistan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000463]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5159″
“Layout File”=”KBDPASH.DLL”
“Layout Text”=”Pashto (Afganistan)”

Albania

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000041c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5029″
“Layout File”=”KBDAL.DLL”
“Layout Text”=”Albanian”

Arab emirates

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000401]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5084″
“Layout File”=”KBDA1.DLL”
“Layout Text”=”Arabic (101)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020401]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5086″
“Layout File”=”KBDA3.DLL”
“Layout Id”=”0029″
“Layout Text”=”Arabic (102) AZERTY”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010401]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5085″
“Layout File”=”KBDA2.DLL”
“Layout Id”=”0028″
“Layout Text”=”Arabic (102)”

armenia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001042b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5121″
“Layout File”=”kbdarmw.dll”
“Layout Id”=”0025″
“Layout Text”=”Armenian Western”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000042b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5120″
“Layout File”=”kbdarme.dll”
“Layout Text”=”Armenian Eastern”

Azerbeidjan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000082c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5115″
“Layout File”=”KBDAZE.DLL”
“Layout Text”=”Azeri Cyrillic”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000042c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5117″
“Layout File”=”KBDAZEL.DLL”
“Layout Text”=”Azeri Latin”

belgium
________________________________________________________________________

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000080c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5002″
“Layout File”=”KBDBE.DLL”
“Layout Text”=”Belgian French”
wpeutil SetKeyboardLayout 080c:0000080c

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000813]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5001″
“Layout File”=”KBDBE.DLL”
“Layout Text”=”Belgian (Period)”
wpeutil SetKeyboardLayout 0813:00000813

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001080c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5089″
“Layout File”=”KBDBENE.DLL”
“Layout Id”=”001E”
“Layout Text”=”Belgian (Comma)”
wpeutil SetKeyboardLayout 1080c:0001080c
_______________________________________________________________________

belorussia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000423]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5052″
“Layout File”=”KBDBLR.DLL”
“Layout Text”=”Belarusian”

bosnia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts  000201a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5155″
“Layout File”=”KBDBHC.DLL”
“Layout Text”=”Bosnian (Cyrillic)”

Brazil

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000416]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5003″
“Layout File”=”KBDBR.DLL”
“Layout Text”=”Portuguese (Brazilian ABNT)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010416]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5126″
“Layout File”=”KBDBR.DLL”
“Layout Id”=”0010″
“Layout Text”=”Portuguese (Brazilian ABNT2)”

Bulgaria

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000402]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5053″
“Layout File”=”KBDBU.DLL”
“Layout Text”=”Bulgarian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0030402]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5180″
“Layout File”=”KBDBULG.DLL”
“Layout Id”=”00AA”
“Layout Text”=”Bulgarian (phonetic layout)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010402]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5054″
“Layout File”=”KBDUS.DLL”
“Layout Id”=”0004″
“Layout Text”=”Bulgarian (Latin)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020402]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5173″
“Layout File”=”KBDBGPH.DLL”
“Layout Id”=”00A3″
“Layout Text”=”Bulgarian (phonetic layout)”

Canada

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0011009]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5110″
“Layout File”=”KBDCAN.DLL”
“Layout Id”=”0020″
“Layout Text”=”Canadian Multilingual Standard”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000c0c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5005″
“Layout File”=”KBDFC.DLL”
“Layout Text”=”Canadian French (Legacy)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0001009]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5004″
“Layout File”=”KBDCA.DLL”
“Layout Text”=”Canadian French”

China

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000404]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5065″
“Layout File”=”KBDUS.DLL”
“Layout Text”=”Chinese (Traditional) – US Keyboard”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000804]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5072″
“Layout File”=”KBDUS.DLL”
“Layout Text”=”Chinese (Simplified) – US Keyboard”
————————————————————————

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010405]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5032″
“Layout File”=”KBDCZ1.DLL”
“Layout Id”=”0005″
“Layout Text”=”Czech (QWERTY)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000405]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5031″
“Layout File”=”KBDCZ.DLL”
“Layout Text”=”Czech”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020405]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5087″
“Layout File”=”KBDCZ2.DLL”
“Layout Id”=”000A”
“Layout Text”=”Czech Programmers”
————————————————————————

croatia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000041a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5030″
“Layout File”=”KBDCR.DLL”
“Layout Text”=”Croatian”

Danmark

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000406]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5007″
“Layout File”=”KBDDA.DLL”
“Layout Text”=”Danish”

Estonia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000425]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5042″
“Layout File”=”KBDEST.DLL”
“Layout Text”=”Estonian”

faroer islands

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000438]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5108″
“Layout File”=”KBDFO.DLL”
“Layout Text”=”Faeroese”

Finland

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 002083b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5142″
“Layout File”=”KBDSMSFI.DLL”
“Layout Id”=”002e”
“Layout Text”=”Sami Extended Finland-Sweden”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001083b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5137″
“Layout File”=”KBDFI1.DLL”
“Layout Id”=”002d”
“Layout Text”=”Finnish with Sami”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000040b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5009″
“Layout File”=”KBDFI.DLL”
“Layout Text”=”Finnish”

France

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000040c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5010″
“Layout File”=”KBDFR.DLL”
“Layout Text”=”French”

Georgia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000437]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5119″
“Layout File”=”kbdgeo.dll”
“Layout Text”=”Georgian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020437]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5181″
“Layout File”=”kbdgeoer.dll”
“Layout Id”=”00ac”
“Layout Text”=”Georgian (Ergonomic)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010437]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5182″
“Layout File”=”kbdgeoqw.dll”
“Layout Id”=”00ab”
“Layout Text”=”Georgian (QWERTY)”

Germany

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000407]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5011″
“Layout File”=”KBDGR.DLL”
“Layout Text”=”German”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010407]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5012″
“Layout File”=”KBDGR1.DLL”
“Layout Id”=”0012″
“Layout Text”=”German (IBM)”

Greece

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000408]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5046″
“Layout File”=”KBDHE.DLL”
“Layout Text”=”Greek”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020408]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5049″
“Layout File”=”KBDHE319.DLL”
“Layout Id”=”0018″
“Layout Text”=”Greek (319)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010408]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5048″
“Layout File”=”KBDHE220.DLL”
“Layout Id”=”0016″
“Layout Text”=”Greek (220)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0040408]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5051″
“Layout File”=”KBDHELA3.DLL”
“Layout Id”=”0011″
“Layout Text”=”Greek (319) Latin”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0050408]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5047″
“Layout File”=”KBDGKL.DLL”
“Layout Id”=”0019″
“Layout Text”=”Greek Latin”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0030408]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5050″
“Layout File”=”KBDHELA2.DLL”
“Layout Id”=”0017″
“Layout Text”=”Greek (220) Latin”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0060408]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5122″
“Layout File”=”KBDHEPT.DLL”
“Layout Id”=”001F”
“Layout Text”=”Greek Polytonic”

Greenland

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000046f]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5170″
“Layout File”=”KBDGRLND.DLL”
“Layout Text”=”Greenlandic”

Ireland

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0001809]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5014″
“Layout File”=”KBDIR.DLL”
“Layout Text”=”Irish”

Hungary

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000040e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5033″
“Layout File”=”KBDHU.DLL”
“Layout Text”=”Hungarian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001040e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5034″
“Layout File”=”KBDHU1.DLL”
“Layout Id”=”0006″
“Layout Text”=”Hungarian 101-key”

Iceland

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000040f]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5013″
“Layout File”=”KBDIC.DLL”
“Layout Text”=”Icelandic”

india

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010439]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5105″
“Layout File”=”KBDINHIN.DLL”
“Layout Id”=”000c”
“Layout Text”=”Hindi Traditional”

Iran

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000429]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5124″
“Layout File”=”KBDFA.DLL”
“Layout Text”=”Persian”

Israel

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000040d]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5083″
“Layout File”=”KBDHEB.DLL”
“Layout Text”=”Hebrew”

Italy

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000410]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5015″
“Layout File”=”KBDIT.DLL”
“Layout Text”=”Italian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010410]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5016″
“Layout File”=”KBDIT142.DLL”
“Layout Id”=”0003″
“Layout Text”=”Italian (142)”

Japan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000411]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5061″
“Layout File”=”KBDJPN.DLL”
“Layout Text”=”Japanese”

Kazakhstan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000043f]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5113″
“Layout File”=”KBDKAZ.DLL”
“Layout Text”=”Kazakh”

Korea

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000412]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5063″
“Layout File”=”KBDKOR.DLL”
“Layout Text”=”Korean”

Kyrgyzia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000440]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5128″
“Layout File”=”KBDKYR.DLL”
“Layout Text”=”Kyrgyz Cyrillic”

Laos

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000454]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5162″
“Layout File”=”KBDLAO.DLL”
“Layout Text”=”Lao”

Latvia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000426]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5043″
“Layout File”=”KBDLV.DLL”
“Layout Text”=”Latvian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010426]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5044″
“Layout File”=”KBDLV1.DLL”
“Layout Id”=”0015″
“Layout Text”=”Latvian (QWERTY)”

Lithuania

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000427]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5045″
“Layout File”=”KBDLT.DLL”
“Layout Text”=”Lithuanian IBM”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010427]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5088″
“Layout File”=”KBDLT1.DLL”
“Layout Id”=”0027″
“Layout Text”=”Lithuanian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020427]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5172″
“Layout File”=”KBDLT2.DLL”
“Layout Id”=”00a1″
“Layout Text”=”Lithuanian New”

Luxemburg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000046e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5168″
“Layout File”=”KBDSF.DLL”
“Layout Text”=”Luxembourgish”
Luxemburg uses the Swiss-French keyboard.
Their banks however use Belgian azerty

Macedonia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000042f]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5109″
“Layout File”=”KBDMAC.DLL”
“Layout Text”=”Macedonian (FYROM)”

Malaysia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000044c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5139″
“Layout File”=”KBDINMAL.DLL”
“Layout Text”=”Malayalam”

Malta

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000043a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5140″
“Layout File”=”KBDMLT47.DLL”
“Layout Text”=”Maltese 47-Key”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001043a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5141″
“Layout File”=”KBDMLT48.DLL”
“Layout Id”=”002b”
“Layout Text”=”Maltese 48-key”

Mongolia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000450]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5127″
“Layout File”=”KBDMON.DLL”
“Layout Text”=”Mongolian Cyrillic”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000850]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5158″
“Layout File”=”KBDMONMO.DLL”
“Layout Text”=”Mongolian (Mongolian Script)”

the Netherlands : querty

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000413]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5008″
“Layout File”=”KBDNE.DLL”
“Layout Text”=”Dutch”

Nnorway

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000414]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5018″
“Layout File”=”KBDNO.DLL”
“Layout Text”=”Norwegian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001043b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5143″
“Layout File”=”KBDSMSNO.DLL”
“Layout Id”=”002c”
“Layout Text”=”Sami Extended Norway”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000043b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5138″
“Layout File”=”KBDNO1.DLL”
“Layout Text”=”Norwegian with Sami”

Poland

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000415]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5035″
“Layout File”=”KBDPL1.DLL”
“Layout Text”=”Polish (Programmers)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010415]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5036″
“Layout File”=”KBDPL.DLL”
“Layout Id”=”0007″
“Layout Text”=”Polish (214)”

portugal

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000816]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5019″
“Layout File”=”KBDPO.DLL”
“Layout Text”=”Portuguese”

Romania – rumania

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000418]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5037″
“Layout File”=”KBDRO.DLL”
“Layout Text”=”Romanian (Legacy)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010418]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5175″
“Layout File”=”KBDROST.DLL”
“Layout Id”=”00a5″
“Layout Text”=”Romanian (Standard)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020418]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5176″
“Layout File”=”KBDROPR.DLL”
“Layout Id”=”00a6″
“Layout Text”=”Romanian (Programmers)”

russia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000419]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5055″
“Layout File”=”KBDRU.DLL”
“Layout Text”=”Russian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010419]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5056″
“Layout File”=”KBDRU1.DLL”
“Layout Id”=”0008″
“Layout Text”=”Russian (Typewriter)”

Serbia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000c1a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5057″
“Layout File”=”KBDYCC.DLL”
“Layout Text”=”Serbian (Cyrillic)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000081a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5038″
“Layout File”=”KBDYCL.DLL”
“Layout Text”=”Serbian (Latin)”

Slovakia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000041b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5039″
“Layout File”=”KBDSL.DLL”
“Layout Text”=”Slovak”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001041b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5040″
“Layout File”=”KBDSL1.DLL”
“Layout Id”=”0013″
“Layout Text”=”Slovak (QWERTY)”

Slovenia

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000424]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5041″
“Layout File”=”KBDCR.DLL”
“Layout Text”=”Slovenian”

Spain

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000040a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5020″
“Layout File”=”KBDSP.DLL”
“Layout Text”=”Spanish”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001040a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5021″
“Layout File”=”KBDES.DLL”
“Layout Id”=”0086″
“Layout Text”=”Spanish Variation”

Sweden

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000041d]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5022″
“Layout File”=”KBDSW.DLL”
“Layout Text”=”Swedish”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000083b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5144″
“Layout File”=”KBDFI1.DLL”
“Layout Text”=”Swedish with Sami”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 002083b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5142″
“Layout File”=”KBDSMSFI.DLL”
“Layout Id”=”002e”
“Layout Text”=”Sami Extended Finland-Sweden”

Switzerland

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000807]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5024″
“Layout File”=”KBDSG.DLL”
“Layout Text”=”Swiss German”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000100c]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5023″
“Layout File”=”KBDSF.DLL”
“Layout Text”=”Swiss French”

Syria

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000045a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5130″
“Layout File”=”KBDSYR1.DLL”
“Layout Text”=”Syriac”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001045a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5131″
“Layout File”=”KBDSYR2.DLL”
“Layout Id”=”000E”
“Layout Text”=”Syriac Phonetic”

Tadjikistan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000428]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5151″
“Layout File”=”KBDTAJIK.DLL”
“Layout Text”=”Tajik”

Thailand

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000041e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5079″
“Layout File”=”KBDTH0.DLL”
“Layout Text”=”Thai Kedmanee”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 002041e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5081″
“Layout File”=”KBDTH2.DLL”
“Layout Id”=”0022″
“Layout Text”=”Thai Kedmanee (non-ShiftLock)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001041e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5080″
“Layout File”=”KBDTH1.DLL”
“Layout Id”=”0021″
“Layout Text”=”Thai Pattachote”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 003041e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5082″
“Layout File”=”KBDTH3.DLL”
“Layout Id”=”0023″
“Layout Text”=”Thai Pattachote (non-ShiftLock)”

Tibet

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000451]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5154″
“Layout File”=”KBDTIPRC.DLL”
“Layout Text”=”Tibetan (People’s Republic of China)”

Turkey

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000041f]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5060″
“Layout File”=”KBDTUQ.DLL”
“Layout Text”=”Turkish Q”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001041f]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5059″
“Layout File”=”KBDTUF.DLL”
“Layout Id”=”0014″
“Layout Text”=”Turkish F”

turkmenistan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000442]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5150″
“Layout File”=”KBDTURME.DLL”
“Layout Text”=”Turkmen”

Ukraine

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000422]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5058″
“Layout File”=”KBDUR.DLL”
“Layout Text”=”Ukrainian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020422]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5179″
“Layout File”=”KBDUR1.DLL”
“Layout Id”=”00a8″
“Layout Text”=”Ukrainian (Enhanced)”

————————————————————————

United kingdom

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000452]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5145″
“Layout File”=”KBDUKX.DLL”
“Layout Text”=”United Kingdom Extended”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000809]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5025″
“Layout File”=”KBDUK.DLL”
“Layout Text”=”United Kingdom”

————————————————————————
United states of america

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0030409]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5027″
“Layout File”=”KBDUSL.DLL”
“Layout Id”=”001A”
“Layout Text”=”United States-Dvorak for left hand”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000409]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5000″
“Layout File”=”KBDUS.DLL”
“Layout Text”=”US”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010409]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5092″
“Layout File”=”KBDDV.DLL”
“Layout Id”=”0002″
“Layout Text”=”United States-Dvorak”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020409]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5026″
“Layout File”=”KBDUSX.DLL”
“Layout Id”=”0001″
“Layout Text”=”United States-International”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0050409]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5123″
“Layout File”=”KBDUSA.DLL”
“Layout Id”=”000B”
“Layout Text”=”US English Table for IBM Arabic 238_L”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0040409]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5028″
“Layout File”=”KBDUSR.DLL”
“Layout Id”=”001B”
“Layout Text”=”United States-Dvorak for right hand”
————————————————————————

Uzbekhistan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000843]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5114″
“Layout File”=”KBDUZB.DLL”
“Layout Text”=”Uzbek Cyrillic”

Vietnam

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000042a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5118″
“Layout File”=”KBDVNTC.DLL”
“Layout Text”=”Vietnamese”

———————————————–

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000420]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5129″
“Layout File”=”KBDURDU.DLL”
“Layout Text”=”Urdu”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000042e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5163″
“Layout File”=”KBDSORST.DLL”
“Layout Text”=”Sorbian Standard”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000439]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5096″
“Layout File”=”KBDINDEV.DLL”
“Layout Text”=”Devanagari – INSCRIPT”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000444]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5116″
“Layout File”=”KBDTAT.DLL”
“Layout Text”=”Tatar”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000446]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5101″
“Layout File”=”KBDINPUN.DLL”
“Layout Text”=”Punjabi”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000447]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5097″
“Layout File”=”KBDINGUJ.DLL”
“Layout Text”=”Gujarati”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000448]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5100″
“Layout File”=”KBDINORI.DLL”
“Layout Text”=”Oriya”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000449]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5102″
“Layout File”=”KBDINTAM.DLL”
“Layout Text”=”Tamil”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000044a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5103″
“Layout File”=”KBDINTEL.DLL”
“Layout Text”=”Telugu”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000044b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5098″
“Layout File”=”KBDINKAN.DLL”
“Layout Text”=”Kannada”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000044d]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5177″
“Layout File”=”KBDINASA.DLL”
“Layout Text”=”ASSAMESE – INSCRIPT”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000044e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5104″
“Layout File”=”KBDINMAR.DLL”
“Layout Text”=”Marathi”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000453]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5161″
“Layout File”=”KBDKHMR.DLL”
“Layout Text”=”Khmer”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000045b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5166″
“Layout File”=”KBDSN1.DLL”
“Layout Text”=”Sinhala”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000461]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5169″
“Layout File”=”KBDNEPR.DLL”
“Layout Text”=”Nepali”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000465]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5132″
“Layout File”=”KBDDIV1.DLL”
“Layout Text”=”Divehi Phonetic”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000046d]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5148″
“Layout File”=”KBDBASH.DLL”
“Layout Text”=”Bashkir”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000480]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5165″
“Layout File”=”KBDUGHR.DLL”
“Layout Text”=”Uighur”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000481]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5146″
“Layout File”=”KBDMAORI.DLL”
“Layout Text”=”Maori”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000485]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5160″
“Layout File”=”KBDYAK.DLL”
“Layout Text”=”Yakut”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000080a]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5017″
“Layout File”=”KBDLA.DLL”
“Layout Text”=”Latin American”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 000085d]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5156″
“Layout File”=”KBDIULAT.DLL”
“Layout Text”=”Inuktitut – Latin”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001042e]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5164″
“Layout File”=”KBDSOREX.DLL”
“Layout Id”=”009f”
“Layout Text”=”Sorbian Extended”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001042f]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5174″
“Layout File”=”KBDMACST.DLL”
“Layout Id”=”00A4″
“Layout Text”=”FYRO Macedonian”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010445]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5136″
“Layout File”=”KBDINBE1.DLL”
“Layout Id”=”002a”
“Layout Text”=”Bengali – INSCRIPT (Legacy)”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0020445]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5178″
“Layout File”=”KBDINBE2.DLL”
“Layout Id”=”00a9″
“Layout Text”=”Bengali – INSCRIPT”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0000445]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5135″
“Layout File”=”KBDINBEN.DLL”
“Layout Text”=”Bengali”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001045b]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5167″
“Layout File”=”KBDSW09.DLL”
“Layout Id”=”00a0″
“Layout Text”=”Sinhala – wij 9″

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 001045d]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5171″
“Layout File”=”KBDINUK2.DLL”
“Layout Id”=”00a7″
“Layout Text”=”Inuktitut – Naqittaut”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0010465]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5133″
“Layout File”=”KBDDIV2.DLL”
“Layout Id”=”000D”
“Layout Text”=”Divehi Typewriter”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard
Layouts 0011809]
“Layout Display Name”=”@C:\\Windows\\system32\\input.dll,-5125″
“Layout File”=”KBDGAE.DLL”
“Layout Id”=”0026″
“Layout Text”=”Gaelic”

11th of November 2011