How does WIM mounting work?

Discussion in 'Windows 10' started by cybrian, Aug 29, 2019.

  1. cybrian

    cybrian MDL Novice

    Oct 9, 2008

    I'm very interested in the low level operations of WIM mounting, as I really would like to know what's actually going on when I mount a WIM, when I alter it, and when I commit or discard it. Additionally, I wonder how much of this is reused when using WIMBOOT, or if it's a completely separate driver.

    I've tried looking up information online, but really the most that I could find is that unlike most disk image formats a WIM file's lowest level atomic piece of data is the file, not the block/sector, so maybe there's some sort of hashing involved or something?

    I'm going to have to use procmon to watch system calls while mounting, but perhaps someone else has done research/RE into this in the past? I figure this is probably the best forum to ask on.