In the past I've talked about useful rescue boot drives you can make in case your operating system
ever breaks and becomes unusable. But there is one super exclusive official Windows bootable
recovery toolkit created by Microsoft called DaRT, or Diagnostic and Recovery Toolset.
And this is actually included in something else called the Microsoft Desktop Optimization Pack,
or MDOP, and it actually has some pretty cool tools that aren't available anywhere else.
I had actually known about this Microsoft DaRT toolkit for a while, but I could never get my
hands on it because it's typically only available to certain enterprise customers who have volume
licensing. Until now that is. That's right, I was finally able to get my hands on it so
I can check it out, and of course show you all how it works, and show you the tools within it.
Now how did I get it? Well it turns out because I'm part of Microsoft's MVP program,
if you don't know about that, I have access to it. You see,
Microsoft MVPs are given a Visual Studio Enterprise subscription
that apparently gives you access to almost literally every program Microsoft has ever made.
Everything from the latest Office apps, to this random little GIF animator program they released
in 1996. But as I just recently found out, it also has that Desktop Optimization Pack
I mentioned before that includes DaRT. If you're curious, I'll put a link in the description where
you can download an Excel list of all the software for different Visual Studio plans,
and let me know if there's any other weird or cool programs you think I should talk about.
The specific plan I have is Visual Studio Enterprise NFR, or Not For
Resale. So anything that has a checkbox in that column I'll be able to check out.
Now I already know many of you are going to ask if I can upload this toolkit somewhere
so everyone can download it, and the answer is definitely no, I cannot.
It would break several piracy laws and several agreements I am beholden to. This is not
free software, it's technically paid behind several licenses, so I can't just give it out
obviously. So the best I can do is just show you it, but all that being said, don't worry.
Besides the cool factor, while some of the tools aren't available anywhere else, they don't really
do anything unique, and you could easily find some free alternatives if you really wanted to.
Anyway, enough chit chat, let's get to the fun stuff. So like I said,
the DaRT toolkit is a bootable recovery image. So what I'll do is show you the process of creating
this bootable image and all the additional features and stuff you can choose to add to it,
and then of course I'll show you the toolkit itself when you do boot it up how it works.
So to get this toolkit set up and create the bootable image,
it requires a few things to get started. First you need the MS DaRT installer of course,
and that's found within that Microsoft Desktop Optimization Pack ISO. It gets downloaded as an
ISO file. And there's actually several versions, the latest is 10, and when you go into it there's
lots of languages, you can choose 32 or 64 bit, and it's just an MSI installer.
It also requires you to have installed the Windows Assessment and Deployment Kit or ADK,
though this anyone can download, it's free, and specifically you need the Windows 10 ADK. You'll
also need the Windows PE or Pre-Installation Environment add-on for the Windows ADK,
and you'll also need a copy of a Windows 10 Installation Media ISO.
Oh and for some reason it doesn't work on Windows 11, so I have to run it in a Windows
10 virtual machine. Then you can actually install DaRT, and it comes with a few things,
but the one we care about is this DaRT Recovery Image Creator, and then once it's installed we
can just run that. And now we can get on to the process of actually creating the bootable image.
First it just asks you to select the mounted location for the installation media, and
then it lets you choose which tools to actually include. Now, we can go over these later when I
actually show you them working, but we obviously want them all, so I'm just going to keep them
all checked. Then there's an option to include a tool that lets you access the computer remotely,
but as you'll see it just shows up as another tool, so I can include that.
Next are some advanced options. So here you can manually add drivers that you know you might need,
but might not be pre-installed with Windows. There's also the WinPE tab
for including additional components from the pre-installation environment. I'm not sure
what most of these do to be honest, but you can include things like PowerShell,
this one for supporting encrypted drives, and this other one just as an example.
You can also increase the scratch space size, like if there is somehow no room on the hard drive,
although it only goes up to 512. Then the Crash Analyzer tab just
lets you choose which debugging tools the Crash Analyzer tool will use,
and I'm just going to select use the ones on the computer, but you should probably
download it yourself and include it because most computers probably won't actually have them.
But the thing is it does require you to install Visual Studio, which is a huge download,
and I didn't feel like going through all that. Next you can choose what formats to
make the image. So here it will create as an ISO and a Windows imaging format,
another type of disk image, and also create a PowerShell script that will let
you automatically recreate the image using the settings you just picked.
There's also this option to edit the image to add more stuff,
and we'll see that in a second. Then you just hit prepare and off it goes,
starting to create this image. But before it finishes, there is one last step if you
selected that edit image option. And here you can open the temporary directory with what it
will include in the final image, and you can add your own files or programs, whatever you want.
You can see it looks like a regular Windows directory structure. And
I assume any programs you include would have to be portable versions,
though it even also has a users directory, maybe if you wanted to be able to copy
over certain regular files or documents, you can just include anything in there.
And then finally once you have it all set up you can hit create and let it finish. Finally
it gives you an option to make a bootable USB or CD out of the ISO. Though I'm instead going to
use a program called Ventoy, which is a program I made a video about a while ago. I'll have it pop
out and it just makes it really easy to put a bunch of bootable images on one USB drive.
Anyway, you can see it put both the images and the PowerShell script in a folder. And I think
this boot.wim file is actually also included in the ISO file anyway. At least I assume so,
it's the exact same size. So after doing all that we now have the bootable image
file ready to go. So let's go over to the computer, boot this up, and check it out.
Alright, so when you first boot it up it will ask you if you want to initialize network connectivity
in the background. I'm just going to hit yes. And then you give it a second to load. Here it's going
to ask you for the keyboard layout. And then this looks like the usual Windows recovery environment.
But if you go to troubleshoot now you'll see this new option for Microsoft Diagnostics and
Recovery Toolkit. If you go to the advanced options again it's the same stuff you're
usually used to. But obviously we want to go into this one. Then you can choose the
operating system. I guess if you have multiple installed, you'll be able to select from it.
And here we go. So these are all the tools we selected in the menu when we
were creating the image. And why don't we just quickly go through all these. So we
can start off with the registry editor. This is what you've seen before. It's
the typical registry editor already built into Windows. Nothing really special here.
Explorer. This actually looks different from the Windows Explorer. This has
this on the left this tree view. And basically the C drive is the
Windows installation that's on the actual computer that you're trying to recover
and mess with. D drive, this is the USB drive basically that was booted from. And then boot X.
This is like a temporary RAM disk that is like the virtual version of Windows
you're running from. And you can see here this is going to have all the stuff if we
were to add some of those custom items like I mentioned. If we wanted to add
some documents or whatever to one of these folders. I'm betting it would show up here.
We got the Windows System32 with a lot of stuff you'd typically expect. But other
than that there's nothing really special. It just lets you browse
the disks. Next we have Locksmith. This lets you reset local account passwords.
So if you have a Microsoft account it's not going to work with that. But if it's
a local password then you can reset any of them and you just type in a new one.
This is not anything special. There's plenty of tools that
will also do this that are freely available, so nothing special here.
Solution Wizard. It really just walks you through and will help you choose which
tool you want to use if you're not sure what's going on. So "System will not start correctly."
Let's see, perform a repair. And it actually asks quite a few questions. Didn't realize. So
it'll kind of help you if you have no idea what to choose. But usually there's not that many tools,
I think you could probably figure out what you wanted to do. Then we
have this Crash Analyzer. This will allow you to analyze crash dumps.
I don't think there's any crashes on this computer anyway. But this
will ask you for where to point to the debugging tools. And you have to
have it either on the computer you're debugging or like I showed you before,
include it. Which does require Visual Studio to be installed which I didn't feel like doing.
TCP IP config. This is just the usual properties menu basically for any network adapter you can
bring up in Windows normally. So nothing new here at all. File restore. This one is
kind of interesting and self-explanatory. Let's just try typing in a star so it'll
find anything. I guess I didn't really delete that much on this virtual machine.
But you can see some are coming up and you get the idea. And interestingly it'll
also show this folder structure. So you can actually look to see if there's any
deleted files in a specific location. Which is kind of cool. You can also specify when
it was last modified if you're looking for a size. So you can narrow it down a bit.
You'll also notice on the right if you scroll over it'll tell you the recoverability,
probability I guess. So this one says unlikely. You can look at the file properties,
that sort of thing. So pretty cool. Hotfix uninstall. So this allows you to uninstall any
little updates or hotfixes that Windows Update may have installed and messed something up.
So you can see if we hit next, it'll search for all of them. Alright so
here you can see all the hotfixes that have been installed. I think most of these are
probably installed along with Windows I guess because they're all around the same
time. But if you wanted to you could, let's uninstall the Windows Media Player package.
You can see some details about it. Shows you all that. Next. And it'll just uninstall it. And then
it says succeeded. Next we have Disk Commander and this lets you recover master boot record,
GUID partition table, recover volumes that may have been deleted. So this one's actually a
really cool tool. If the boot loader or whatever, boot record is corrupted you can just run it.
Although you don't really have too many options. It literally just says it's going
to overwrite it. So probably only use this if you're sure that it's messed up. I'm just
going to hit no. If you accidentally deleted a partition this will apparently let you recover
that. That's kind of cool. And also I guess you can save the current partition tables.
So maybe if you want to back things up before doing anything it lets you do
that too. And it looks like if you go and recover volumes it'll have you back up if
you want the current partition table to a file. I'll just hit no and then see
what happens. It looks like it didn't actually find any, which makes sense.
I didn't actually delete any partitions. Then we have SFC Scan and this one's interesting
because normally you run SFC Scannow from the command line. This basically seems
to be a GUI version of it. So you can have it scan and repair automatically,
which is the usual thing it does, or scan and prompt you.
I'll just hit that and we can see what happens afterwards. All right,
that took a lot longer than expected and it says no corrupt system files were detected as
expected. Next we can take a look at disk wipe. This one is pretty self-explanatory
and you can choose the volume or an entire disk, which would include multiple volumes.
And you can choose either a single pass and overwrite with pseudo random data or four passes,
which is standard by the Department of Defense, I guess. So yeah, if you wanted to completely wipe
a drive and make sure it's not recoverable, you could do it like this. Now we can look at search.
Self-explanatory. It looks similar to the file recovery one. And this one again requires you
to use wildcards if you don't want to search it directly. So I know there's
some files named DaRT. We can put that in. Again, you get some parameters if you want.
Let's just hit search and a whole bunch come up. So you can see it's searching the whole drive.
There's nothing really special here. I think you get the idea. It shows you a little bit of
info about the file that it found. There's no other options besides these parameters
here. So pretty straightforward. Now we can look at Computer Management,
which is a cool one. And this is basically going to show you a lot of management
consoles that are sort of available in regular Windows, but a couple of them are different.
So the Event Viewer, you're probably familiar with that one. You can obviously look at that
in regular Windows. So you have the Windows logs,
pretty much what you'd expect, the same stuff as you'd see in the regular one. You can look
at the system information. So it'll tell you all the names of all the stuff, the specs.
Then there's Autoruns. This one's cool. So this looks really similar to what you'd see in the
sysinternals Autoruns, although it doesn't look like it's quite as robust as that, but it still
shows you a whole bunch of stuff. So startup programs set by the system, the user. There's
not much here, obviously, because I don't have anything installed on the virtual machine really.
The local service, network service. So you can see just things that are starting up,
where the registry keys are that are causing it to be started up.
And you can even see stuff that's from the shell. So not just necessarily programs,
but also shell extensions, stuff like that. So pretty cool. And then Services and Drivers.
So services, this is I think the same as the services.msc menu you can bring up in
Windows. So nothing new here. Although this one, drivers, I don't remember seeing this
anywhere. You can tell me if I'm wrong, but this seems to be kind of a hybrid between running the
sc.exe and querying the drivers and also like the Device Manager and sorting by drivers.
Seems like you get a lot of that information, except in a GUI. I haven't seen this particular
management console anywhere, but again, you can let me know. So it'll tell you all
the possible drivers, I guess, that are installed currently in Windows,
and you can see some properties about them. And also startup type.
This is another thing I've not seen in the context of drivers. You know,
usually you see the startup for services type. You can do it automatic,
but I've never seen it for drivers before. So that's definitely interesting. You have
some different types. So that's kind of cool. And then finally, we have Disk Management.
This is the same as the disk partition manager that is also in Windows. In the settings up here,
there's nothing special. So that's about it. Then finally, we have remote connection. Remember,
this was the optional checkbox we had, and it will basically allow you to have the help desk,
they say, I guess if you're at a company, access the computer.
So it'll show you the ticket number, the local IP address,
the port to connect to, and then it just says waiting for connection. I
tried to connect to it with the remote desktop program from my current computer,
but it wasn't working. So I don't know what the deal is, but yeah it's there if you need it.
And then finally, there's Help, which just shows you a page of some instructions and
stuff so you can see to start the tools. Although I think if you're already gotten to this point,
you're pretty good on that. One thing that's interesting though,
it says open a command prompt, the command prompt tool. I do not actually see that here.
I know you can open up the Explorer and you could search through
System32. I looked and it is in here, but I'm kind of surprised that really there's no tool
showing the command prompt. I know usually you can also hit Shift F10. That doesn't
also bring it up. So yeah, that's basically it. There's nothing else really to look at.
If you hit close, it just brings you back to this. And I guess you would use this to
get to the command prompt is what you do. So actually that kind of makes sense. So yeah,
the usual stuff is in here. And then if you need to access whatever tool,
you just launch it through that. All right. So hopefully you guys found this video pretty cool.
Let me know what you think down in the comments. Maybe there's some free alternative bootable
tools that you could recommend that are alternatives to this. If you did enjoy it,
of course give it a big thumbs up for the YouTube algorithm. It really helps out.
And also maybe consider checking out some other videos I've made.
And if you like what you see, be sure to subscribe. I make videos
usually Wednesday and Saturday. If you want to keep watching,
I'll put two videos here I recommend. One is talking about that Ventoy program I mentioned
before. And another one is also about some bootable rescue USB drives that you can make.
So I'll put both those links right there. Probably the Ventoy one is worth watching first. So be sure
to check those out. So thanks so much for watching, and I'll see you in the next one.