MAN page from Other wimtools-1.7.3-1.x86_64.rpm


Section: User Commands (1)
Updated: November 2014


wimlib-imagex-capture, wimlib-imagex-append - Create or append a WIM image 




The wimlib-imagex capture and wimlib-imagex append commandscreate a Windows Imaging (WIM) image from a directory tree. Thewimlib-imagex capture command creates a new WIM file containing thecaptured image, while the wimlib-imagex append command appends thecaptured image to an existing WIM file.These commands are also available as simply wimcapture and wimappendif the appropriate hard links or batch files are installed.

Background information: A WIM image is an independent directory tree in a WIMfile. A WIM file may contain any number of separate images. WIM files aresingle-instancing with regards to file data, so a file is stored only one timein the entire WIM, regardless of how many images the file appears in.

SOURCE specifies the location of the files to create the new WIM imagefrom. If SOURCE is a directory, the WIM image is captured from thatdirectory (see DIRECTORY CAPTURE (UNIX) or DIRECTORY CAPTURE(WINDOWS)). Alternatively, if the --source-list option is specified,SOURCE is interpreted as a file that itself provides a list offiles and directories to include in the new WIM image. Stillalternatively, only on UNIX-like systems, if SOURCE is aregular file or block device, it is interpreted as an NTFS volume fromwhich a WIM image is to be captured using libntfs-3g (see NTFS VOLUME CAPTURE(UNIX)).

IMAGE_NAME and IMAGE_DESCRIPTION specify the name and description togive the new WIM image. If IMAGE_NAME is not specified, it defaults tothe base name (excluding path to parent directory) of SOURCE, but if thisname already exists in WIMFILE, a unique suffix is added. Otherwise,IMAGE_NAME must be either a name that does not already exist as an image inWIMFILE, or the empty string to create an image with no name. IfIMAGE_DESCRIPTION is not specified, no description is given to the newimage.

As a special case, if WIMFILE is "-", the --pipable option isassumed and the WIM file is written to standard output in a special pipableformat. See the documentation for --pipable for more details. 


This section documents how wimlib-imagex captures files from adirectory tree on UNIX-like systems. See DIRECTORY CAPTURE (WINDOWS) forthe corresponding documentation for Windows.

On UNIX-like systems, when SOURCE specifies a directory or a symbolic linkto a directory, the WIM image will be captured from the directory tree rooted atthis directory. This directory can be on any type of filesystem, and mountpoints are followed recursively. However, it is important to keep in mind thatthe WIM format was designed for Windows, so it cannot store all possiblemetadata from filesystems used on UNIX-like systems. The main information thatwill not be stored is:

UNIX file owners, groups, modes, and device IDs (major and minor numbers),unless the --unix-data option is specified. By default (without--unix-data), files that are neither regular files, directories, norsymbolic links, such as device nodes and FIFOs, will be excluded.
Extended attributes. This mainly includes extensions to the traditional UNIXsecurity model, such as SELinux security labels, POSIX ACLs, and capabilitieslabels.
Linux file attributes, as can be changed using the chattr (1) utility.

Notes: Timestamps are stored with 100 nanosecond granularity and include lastmodification time (mtime) and last access time (atime), but not last statuschange time (ctime). Hard links and symbolic links are supported by the WIMformat and are stored. Symbolic links are turned into "native" Windowssymbolic links, or "reparse points"; this process is fully reversible, e.g.automatically by wimlib-imagex apply, unless the symbolic link targetcontains backslash characters.

Pedantic note: A limitation of the WIM format prevents the unusual case where asingle symbolic link file itself has multiple names (hard links); in thisunlikely case, each symbolic link is stored as an independent file. 


This section documents how wimlib-imagex captures files directly froman NTFS volume image on UNIX-like systems.

On UNIX-like systems, a special image capture mode is entered when SOURCEis a regular file or block device. In this mode, SOURCE is assumed to bean NTFS volume or volume image, and wimlib-imagex will capture a WIMimage containing the full contents of the NTFS volume, including NTFS-specificdata. This is done using libntfs-3g.

Please note that the NTFS volume capture mode is not entered ifSOURCE is a directory, even if an NTFS filesystem is mounted onSOURCE using ntfs-3g. You must specify the NTFS volume itself (and itmust be unmounted, and you must have permission to read from it).

The NTFS volume capture mode attempts to capture as much data and metadata aspossible, including:

All data streams of all unencrypted files, including the unnamed data stream aswell as all named data streams.
Reparse points, including symbolic links, junction points, and other reparsepoints.
File and directory creation, access, and modification timestamps, using thenative NTFS resolution of 100 nanoseconds.
Windows security descriptors, including all components (owner, group, DACL, andSACL).
DOS/Windows file attribute flags.
All names of all files, including names in the Win32 namespace, DOS namespace,Win32+DOS namespace, and POSIX namespace. This includes hard links.

However, the main limitations of this NTFS volume capture mode are:

Encrypted files are excluded by default. Although ntfs-3g can read their data,they need to be stored in the WIM file in a special format that wimlib does notyet support (except on Windows, where wimlib can treat the data as opaque andhand it off to the appropriate API function).
The sparse attribute on sparse files will be saved, but the data stored will bethe full data of the file rather than the "sparse" data. (The data is, however,subject to the WIM format's compression.)


On Windows, wimlib-imagex capture and wimlib-imagex appendnatively support Windows-specific and NTFS-specific data. They therefore actsimilarly to the corresponding commands of Microsoft's ImageX or DISM. For bestresults, the directory being captured should be on an NTFS volume andwimlib-imagex should be run with Administrator privileges; however,non-NTFS filesystems and running without Administrator privileges are alsosupported.

On Windows, wimlib-imagex capture and wimlib-imagex appendtry to archive as much data and metadata as possible, including:

All data streams of all files.
Reparse points, including symbolic links, junction points, and other reparsepoints, if supported by the source filesystem. (Note: see --rpfix and--norpfix for documentation on exactly how absolute symbolic links andjunctions are captured.)
File and directory creation, access, and modification timestamps. These arestored with Windows NT's native timestamp resolution of 100 nanoseconds.
Security descriptors, if supported by the source filesystem and --no-aclsis not specified. However, beware that unless --strict-acls is specified,the security descriptors for individual files or directories may be omitted oronly partially captured if the user does not have permission to read them, whichcan be a problem if wimlib-imagex is run as a non-Administrator.
File attributes, including hidden, sparse, compressed, encrypted, etc.Encrypted files will be stored in encrypted form rather than in plain text.Transparently compressed files will be read as uncompressed and stored subjectto the WIM's own compression. There is no special handling for storing sparsefiles, but they are likely to compress to a small size.
DOS names (8.3) names of files; however, the failure to read them is notconsidered an error condition.
Hard links, if supported by the source filesystem.

Note: the capture process is reversible, since when wimlib-imagexapply (on Windows) extracts the captured WIM image, it will extract all ofthe above information, at least to the extent supported by the destinationfilesystem. One exception is that since encrypted files are stored asencrypted, their data will not be available if restored on a Windows systemthat does not have the decryption key.

Pedantic note: since Windows is not fully compatible with its own filesystem(NTFS), on Windows wimlib cannot archive certain files that may exist on a validNTFS filesystem but are inaccessible to the Windows API, for example two fileswith names differing only in case in the same directory, or a file whose namecontains certain characters considered invalid by Windows. If you run intoproblems archiving such files consider using the NTFS VOLUME CAPTURE(UNIX) mode from Linux. 


Specifies that the new image is to be made the bootable image of the WIM archive.
For wimlib-imagex append, before performing the append operation,check the integrity of WIMFILE if an integrity table is present.Furthermore, include an integrity table in the new WIM file(wimlib-imagex capture) or the modified WIM file (wimlib-imagexappend). If this option is not specified, no integrity table is included ina WIM file created with wimlib-imagex capture, while a WIM fileupdated with wimlib-imagex append will be written with an integritytable if and only if one was present before.
Specifies the compression format for the new WIM file. TYPE may be"none", "XPRESS" (alias: "fast"), "LZX" (alias: "maximum"), or "LZMS" (alias:"recovery"). TYPE is matched case-insensitively. The default is "LZX".
You can optionally also specify an integer compression LEVEL. Thecompression level specifies how hard the compression algorithm for the specifiedcompression TYPE will work to compress the data. The values are scaled sothat 20 is quick compression, 50 is medium compression, and 100 is highcompression. However, you can choose any value, and not just these particularvalues. The default is 50.
Be careful if you choose LZMS compression. It is not compatible with wimlibbefore v1.6.0, WIMGAPI before Windows 8, DISM before Windows 8.1, and 7-Zip.
Set the WIM compression chunk size to SIZE bytes. Larger chunks mean largerLZ77 dictionaries and better compression ratios on sufficiently large files, butslower random access. Using this option is generally not recommended becauseof the compatibility limitations detailed in the next paragraph. But if youdecide to use this option regardless, you may choose a chunk size that isallowed by the compression format. All formats only allow power-of-2 chunksizes. For LZX ("maximum") compression the maximum allowed chunk size is 2^21(2097152), for XPRESS ("fast") compression the maximum allowed chunk size is2^16 (65536), and for LZMS ("recovery") compression the maximum allowed chunksize is 2^30 (1073741824).
Beware that Microsoft's implementation has limited support for non-default chunksizes. Depending on the version, their software may refuse to open the WIM, oropen it and crash, or open it and report the data is invalid, or even extractthe data incorrectly. In addition, wimlib versions before 1.6.0 do not supportalternate chunk sizes.
Create a "solid" archive that compresses multiple unique streams ("files")together, rather than each unique stream ("file") independently. This canresult in a significantly better compression ratio, but this format greatlydecreases the performance of random access to the data, as may occur on a WIMmounted with wimlib-imagex mount. Also, WIMs created using thisoption use a different version number in their header and are only compatiblewith WIMGAPI Windows 8 and later, and DISM Windows 8.1 and later.
The default compression type and chunk size in solid blocks is LZMS with 2^25(33554432) byte chunks. This is independent of the WIM's main compression typeand chunk size.
Like --chunk-size, but set the chunk size used in solid blocks. Thedefault is LZMS compression with 2^25 (33554432) byte chunks. This option onlyhas an effect when --solid is also specified. For maximum compatibilitywith the Microsoft implementation, do not use either of these options.
Like --compress, but set the compression type used in solid blocks. Thedefault is LZMS compression with 2^25 (33554432) byte chunks. This option onlyhas an effect when --solid is also specified. For maximum compatibilitywith the Microsoft implementation, do not use either of these options.
Number of threads to use for compressing data. Default: autodetect (number ofavailable CPUs).
For wimlib-imagex append: rebuild the entire WIM rather than appending the newdata to the end of it. Rebuilding the WIM is slower, but will save a little bitof space that would otherwise be left as a hole in the WIM. Also see wimlib-imagexoptimize(1).
Specify a string to use in the <FLAGS> element of the XML data for the newimage.
(UNIX-like systems only) Follow symbolic links and archive the files they pointto, rather than archiving the links themselves.
Specifies a configuration file (UTF-8 or UTF-16LE encoded; plain ASCII alsoworks) for capturing the new image. The configuration file specifies files thatare to be treated specially during the image capture.
The format of the configuration file is INI-style; that is, it is arranged inbracketed sections. Currently, only the following sections are recognized:
[ExclusionList] --- contains a list of path globs to exclude from capture. Ifa directory is matched, both the directory and its contents are excluded.
[ExclusionException] --- contains a list of path globs to include in thecapture, even when the file or directory also matches a glob in [ExclusionList].
[PrepopulateList] --- this does not affect capture, but if the image is appliedlater with --wimboot, these are globs of files that shall be extractednormally, not as WIMBoot "pointer files". If a directory is matched, all filesand subdirectories are also matched recursively.
Any unrecognized sections will be ignored, with a warning printed. Sectionsdealing with compression (e.g. [CompressionExclusion]) are not particularlyimportant.
Path globs may contain the '*' and '?' meta-characters. Relative globs (e.g.*.mp3) match against a filename in any directory. Absolute globs (e.g./dir/file), are treated as paths starting at the main directory being captured,or the root of the NTFS volume for NTFS volume capture mode. Do not use driveletters in the paths; they will be ignored. Path separators may be eitherforwards slashes or backwards slashes.
Lines beginning with the '#' or ';' characters are treated as comments andignored. Globs with whitespace in them need not be quoted; however, if theyare, both double and single quotes are accepted.
If this option is not specified the following default configuration file isused:
[ExclusionList]\$ntfs.log\hiberfil.sys\pagefile.sys\swapfile.sys\System Volume Information\RECYCLER\Windows\CSC
However, special behavior applies if --wimboot is also specified. Bydefault, with --wimboot specified, the fileWindows/System32/WimBootCompress.ini in the directory being captured will beused as the configuration file. However, this can be overridden using--config; and this also causes the specified configuration file to besaved in the WIM image as Windows/System32/WimBootCompress.ini, overriding anythat may be present on the filesystem.
(UNIX-like systems only) Store the UNIX owner, group, mode, and device ID (majorand minor number) of each captured file. As of wimlib v1.7.0, you can backupand restore not only the standard UNIX file permission information, but alsocharacter device nodes, block device nodes, named pipes (FIFOs), and UNIX domainsockets.
wimlib stores UNIX data by adding a special tagged metadata item to eachdirectory entry of each file that contains this information. This extrainformation is ignored by the Microsoft implementation. Note: UNIX data storedby wimlib before v1.7.0 used a different format that is no longer supported. Ifyou have old WIM files with UNIX data, apply them with v1.6.2 and recapture themwith v1.7.0 or later.
Do not capture files' security descriptors.
Fail immediately if the full security descriptor of any file cannot be read. OnWindows, the default behavior without this option is to first try omitting theSACL from the security descriptor, then to try omitting the security descriptorentirely. The purpose of this is to capture as much data as possible withoutalways requiring Administrator privileges. However, if you desire that allsecurity descriptors be captured exactly, you may wish to provide this option,although the Administrator should have permission to read everything anyway.
--rpfix, --norpfix
Set whether to fix targets of absolute symbolic links (reparse points in Windowsterminology) or not. When enabled (--rpfix), absolute symbolic links thatpoint inside the directory tree being captured will be adjusted to be absoluterelative to the root of the directory tree being captured. When disabled(--norpfix), absolute symbolic links will be captured exactly as is.
The default behavior for wimlib-imagex capture is equivalent to--rpfix. The default behavior for wimlib-imagex append will be--rpfix if reparse point fixups have previously been done onWIMFILE, otherwise --norpfix.
In the case of a multi-source capture, (--source-list specified), passing--norpfix is recommended. Otherwise, reparse point fixups will bedisabled on all capture sources destined for non-root locations in the WIMimage, while capture sources destined for the WIM root will get the defaultbehavior from the previous paragraph.
wimlib-imagex capture and wimlib-imagex append supportcreating a WIM image from multiple separate files or directories. When--source-list is specified, the SOURCE argument specifies the nameof a text file, each line of which is either 1 or 2 whitespace separated filepaths. The first file path, the source, specifies the path to a file ordirectory to capture into the WIM image. It may be either absolute or relativeto the current working directory. The second file path, if provided, is thetarget and specifies the path in the WIM image that this file or directory willbe saved as. Leading and trailing slashes in the target are ignored, except ifit consists entirely of slashes (e.g. "/"), which indicates that the directoryis to become the root of the WIM image. If omitted, the target string defaultsto the same as the source string.
An example source list file is as follows:
# Make the WIM image from the 'winpe' directorywinpe   /# Send the 'overlay' directory to '/overlay' in the WIM imageoverlay /overlay# Overlay a separate directory directly on the root of the WIM image./data/stuff     /
Subdirectories in the WIM are created as needed. Multiple source directoriesmay share the same target, which implies an overlay. In the event that thisresults a nondirectory file being added to the WIM image multiple times, thelast version (as listed in the source list file) overrides any earlier version.
File paths containing whitespace may be quoted with either single quotes ordouble quotes. Quotes may not be escaped.
Lines consisting only of whitespace and lines beginning with '#' preceded byoptional whitespace are ignored.
As a special case, if SOURCE is "-", the source list is read from standardinput rather than an external file.
The NTFS volume capture mode on UNIX-like systems cannot be used with--source-list, as only capturing a full NTFS volume is supported.
Create a "pipable" WIM, which can be applied fully sequentially, including froma pipe. An image in the resulting WIM can be applied with wimlib-imagexapply, either normally by specifying the WIM file name, or withwimlib-imagex apply - to read the WIM from standard input. Seewimlib-imagex apply(1) for more details.
For append operations, this option will result in a full rebuild of the WIM tomake it pipable. For capture operations, the captured WIM is simply created aspipable. Beware that the more images you add to a pipable WIM, the lessefficient piping it will be, since more unneeded data will be sent through thepipe.
When wimlib creates a pipable WIM, it carefully re-arranges the components ofthe WIM so that they can be read sequentially and also makes several othermodifications. As a result, these "pipable" WIMs are not compatible withMicrosoft's software, so keep this in mind if you're going to use them. Ifdesired, you can use wimlib-imagex optimize --not-pipable to re-writea pipable WIM as a regular WIM. (wimlib-imagex export also providesthe capability to export images from a pipable WIM into a non-pipable WIM, orvice versa.)
For the most part, wimlib operates on pipable WIMs transparently. You canmodify them, add or delete images, export images, and even create split pipableWIMs. The main disadvantages are that appending is (currently) less efficient(--rebuild is always implied), and also they aren't compatible withMicrosoft's software.
wimlib-imagex capture and wimlib-imagex append can bothwrite a pipable WIM directly to standard output; this is done automatically ifWIMFILE is specified as "-". (In that case, --pipable is assumed.)
Ensure the resulting WIM is in the normal, non-pipable WIM format. This is thedefault for wimlib-imagex capture, except when writing to standardoutput (WIMFILE specified as "-"), and also for wimlib-imagexappend, except when appending to a WIM that is already pipable.
Declares that the image being captured or appended from SOURCE is mostly the same asthe existing image IMAGE in WIMFILE, but captured at a later pointin time, possibly with some modifications in the intervening time. This isdesigned to be used in incremental backups of the same filesystem or directorytree. IMAGE can be a 1-based index or name of an existing image inWIMFILE. It can also be a negative integer to index backwards into theimages (e.g. -1 means the last existing image in WIMFILE).
When this option is provided, the capture or append of the new image will beoptimized by not reading files that, based on metadata such as timestamps,appear not to have been modified since they were archived in the existingIMAGE. Barring manipulation of timestamps, this option only affectsperformance and does not change the resulting WIM image.
As shown, the full syntax for the argument to this option is to specify the WIMfile, a colon, and the image; for example, "--update-of mywim.wim:1". However,the WIM file and colon may be omitted, in which case the WIM file will defaultto the WIM file being appended to for append operations, or the WIM file fromwhich a delta is being taken (only if --delta-from is specified exactlyonce) for capture operations.
For wimlib-imagex capture only: capture the new WIM as a "delta" fromWIMFILE. Any streams that would ordinarily need to be archived in the newWIM are omitted if they are already present in the WIMFILE on which thedelta is being based. The new WIM will still contain a full copy of the imagemetadata, but this is typically only a small fraction of a WIM's total size.
This option can be specified multiple times, in which case the resulting deltaWIM will only contain streams not present in any of the specified base WIMs.
To operate on the resulting delta WIM using other commands such aswimlib-imagex apply, you must specify the delta WIM as the WIM file tooperate on, but also reference the base WIM(s) using the --ref option.Beware: to retain the proper functioning of the delta WIM, you can only add, notdelete, files and images to the base WIM(s) following the capture of a deltafrom it.
--delta-from may be combined with --update-of to increase thespeed of capturing a delta WIM.
As an example, consider the following backup and restore sequence:
(initial backup)$ wimcapture /some/directory bkup-base.wim(some days later, create second backup as delta from first)$ wimcapture /some/directory bkup-2013-08-20.dwm \        --update-of bkup-base.wim:-1 --delta-from bkup-base.wim(restoring the second backup)$ wimapply bkup-2013-08-20.dwm --ref=bkup-base.wim 1 \        /some/directory
However, note that as an alternative to the above sequence that used a deltaWIM, the second backup could have simply been appended to the WIM as new imageusing wimlib-imagex append. Delta WIMs should be used only if it'sdesired to base the backups or images on a separate, large file that is rarelymodified.
Note: unlike "pipable" WIMs (created with the --pipable option), "delta"WIMs (created with the --delta-from option) are compatible withMicrosoft's software. For example, you can use the /ref option of ImageX toreference the base WIM(s), similar to above.
Additional note: wimlib-imagex is generalized enough that you can infact combine --pipable and --delta-from to create pipable deltaWIMs. In such cases, the base WIM(s) must be captured as pipable as well as thedelta WIM, and when applying an image, the base WIM(s) must be sent over thepipe after the delta WIM.
Mark the image as WIMBoot-compatible. See Microsoft'sdocumentation for more information about WIMBoot. This option will, by default,set the compression type to XPRESS and the chunk size to 4096 bytes; thesecan, however, still be overridden through the --compress and--chunk-size parameters, respectively. In addition, this option will, bydefault, set the configuration file toSOURCE\Windows\System32\WimBootCompress.ini if present and accessible;however, this may still be overridden through the --config parameter.


wimlib-imagex append does not support appending an image to a split WIM.

It is safe to abort an wimlib-imagex append command partway through;however, after doing this, it is recommended to run wimlib-imagexoptimize to remove any data that was appended to the physical WIM file butnot yet incorporated into the structure of the WIM, unless the WIM was beingfully rebuilt (e.g. with --rebuild), in which case you should delete thetemporary file left over.

wimlib-imagex creates WIMs compatible with Microsoft's software(WIMGAPI, ImageX, DISM), with some caveats:

With wimlib-imagex on UNIX-like systems, it is possible to create aWIM image containing files with names differing only in case, or files withnames containing the characters ':', '*', '?', '"', '<', '>', '|', or '\',which are valid on POSIX-compliant filesystems but not Windows. Be warned thatsuch files will not be extracted by default by the Windows version ofwimlib-imagex, and (even worse) Microsoft's ImageX can be confused bysuch names and quit extracting the image partway through. (It perhaps is worthpointing out that Windows' own default filesystem, NTFS, supports thesecharacters, although Windows does not!)
Pipable WIMs are incompatible with Microsoft's software. Pipable WIMs arecreated only if WIMFILE was specified as "-" (standard output) or ifthe --pipable flag was specified.
WIMs captured with a non-default chunk size (with the --chunk-size option)or as solid archives (with the --solid option) or with LZMScompression (with --compress=LZMS or --compress=recovery) havevarying levels of compatibility with Microsoft's software. Generally, morerecent versions of Microsoft's software are more compatible.


First example: Create a new WIM 'mywim.wim' with LZX ("maximum") compressionthat will contain a captured image of the directory tree 'somedir'. Note thatthe image name need not be specified and will default to 'somedir':

wimlib-imagex capture somedir mywim.wim

or, if the wimcapture hard link or batch file has been installed, theabbreviated form can be used:

wimcapture somedir mywim.wim

The remaining examples will use the long form, however. Next, append the imageof a different directory tree to the WIM created above:

wimlib-imagex append anotherdir mywim.wim

Easy enough, and the above examples of imaging directory trees work on bothUNIX-like systems and Windows. Next, capture a WIM with several non-defaultoptions, including XPRESS ("fast") compression, an integrity table, no messingwith absolute symbolic links, and an image name and description:

wimlib-imagex capture somedir mywim.wim --compress=fast \

--check --norpfix "Some Name" "Some Description"

Capture an entire NTFS volume into a new WIM file and name the image "Windows7". On UNIX-like systems, this requires using the special mode described inNTFS VOLUME CAPTURE (UNIX) where SOURCE is a file or block devicecontaining an NTFS filesystem:

wimlib-imagex capture /dev/sda2 windows7.wim "Windows 7"

or, on Windows, to capture a full NTFS volume you instead need to specify theroot directory of the mounted volume, for example:

wimlib-imagex capture E:\ windows7.wim "Windows 7"

Same as above example with capturing an NTFS volume from wimlib-imagexrunning on a UNIX-like system, but capture the WIM in the wimlib-specific"pipable" format that can be piped to wimlib-imagex apply:

wimlib-imagex capture /dev/sda2 windows7.wim "Windows 7" \


Same as above, but instead of writing the pipable WIM to the file"windows7.wim", write it directly to standard output through a pipe into someother program "someprog", which could, for example, be a program or script thatstreams the data to a server. Note that --pipable need not be explicitlyspecified when using standard output as the WIM "file":

wimlib-imagex capture /dev/sda2 - "Windows 7" | someprog







This document was created byman2html,using the manual pages.