Thursday, November 22, 2012

Windows 8 ESD file


ESD is an Encrypted WIM file, “Encrypted Storage Disk” or “Encrypted System Disk” perhaps.

While installing Windows 8 I came across an ESD file which I had never encountered before, and the investigation began.
The Windows 8 Upgrade Assistent began downloading WinPayload.esd to “D:\Users\GravyCode\AppData\Local\Microsoft\WebSetup\Download\WinPayload.esd”.
Looking into memory I found some interesting XML data of which I will share a few abstracts below:

< WimTargetPath>D:\Users\GravyCode\AppData\Local\Microsoft\WebSetup\Download\WinPayload.esd.decrypt</WimTargetPath>
< RemoteSourcePath>[somedata]/Windows8-ProESDwithApps-64bit-EnglishUnitedKingdom-X1816623.esd?t=[somevariable]</RemoteSourcePath>
< CryptoKey>[..............CUT..............]<CryptoKey>
< FileHash>[file hash]</FileHash>

So in theory it’s an encrypted WIM file of some sort.

< LayoutPath>C:\ESD\Windows</LayoutPath>

Looking further it seems that it will be extracted to “C:\ESD\Windows” which is a hidden folder created by the update assistant which will now contain a nice “setup.exe”.
Windows 8 ESD WinPayload.esd
I’ll assume it stands for “Encrypted Storage Disk” or “Encrypted System Disk”.
After the updater completing the download it will give you the option to create an ISO, create a boot-able thumb disk or leave it till another time. Don’t wait till another time. =]


No comments:

Post a Comment

I would be glad to know if this post helped you.