July 20th, 2020

A brief introduction to booting with UEFI

If you've been keeping up with developments in the PC world any time in the past 15 years, chances are that you've at least heard of UEFI (Unified Extensible Firmware Interface) and are aware that it is, among other things, a relatively new way to boot a PC in contrast to the old so-called "BIOS" method of booting, in which the BIOS just starts executing the code on the boot sector of the boot drive. UEFI has been both praised and criticized, and although I've generally been wary of it because it is, by nature, something which limits the user's ability to control their own computer, my point here isn't to provide an exhaustive list of the pros and cons of UEFI (Wikipedia already does a decent job of this in its article on UEFI; check the "Criticism" section). Instead, this is a quick look at how booting with UEFI works, for the simple reason that UEFI isn't going to go away, and if it's going to plague us for the rest of humanity's existence, then we might as well at least have an idea of how it works.

I'm feeling a bit opinionated today. I'm here writing a textfile for the Internet about something I found out about computers, and I'm here to tell you what I think of it as well, so to make this a little more fun, I've dialled my brain back a bit to have the mentality of a 12-year-old typing some k-k00l g-phile which he intends to upload to his local BBS when his parents go to sleep tonight. So here we go. Let's write a real textfile like it's the 1980s again. Let's explain exactly how booting from UEFI works, from the Windows perspective, since Windows is, sadly, more ubiquitous than atoms.

If you look at any Windows computer which is fairly current (running a version of Windows from the last few years, not Windows 95 or something like that), if you look in "Disk Management" under "Computer Management", you'll probably see three partitions on the hard drive. One of these will be the main C: partition which takes up most of the drive, but what are the other two? I always assumed that these were just some random garbage which Windows puts on the drive and didn't pay too much attention to them. Well, it turns out that I was half-right: The "Recovery Partition" which is probably the larger of the two remaining partitions (typically around 500 MB) is indeed something from Windows and can technically be deleted. It's only used by Windows to do a "reset" of the system, whatever that means--some Windows trash which isn't properly documented, as usual. This should not be confused with a restore partition which is provided by some PC OEMs (like Dell, Lenovo, etc.) to do a full system restore in case your boot partition really gets thrashed. Because the Windows "Recovery Partition" is only used for a "reset", it can technically be deleted without compromising the normal functionality of the computer. It's probably better to leave this partition in place, though, as Windows may break someday, and being able to do a "reset" (still no idea what this actually entails as I do not have any source code for this process) may fix it. Or maybe not. You never know with closed-source software.

The other partition, however, is potentially more interesting. Though Windows often calls it simply a "System" partition, technically it is an EFI (Extensible Firmware Interface) partition. The first interesting thing about this partition is that it's basically a FAT partition. That's right, PCs are still using FAT in the year 2020. You see? There are still some things left to love about the world.

The partition itself is actually called an EFI System Partition (ESP; don't you love it when acronyms are further embedded into other acronyms?), and to distinguish it from a normal FAT partition which has a partition type of 01 for FAT12 (used on floppy disks), 04 or 06 for FAT16, or 0B or 0C for FAT32, an EFI System Partition has a partition type of EF, which I find aesthetically pleasing because of its obvious mnemonic properties. There's also a partition type EE which is used on MBR boot systems to indicate that the MBR is followed by an EFI header. Nice!

What's possibly even more awesome is that the ESP can be in FAT12, FAT16, or FAT32 format, so if you want to be super cool and go booting a UEFI system using FAT12, this is technically possible. The point is that in terms of its actual structure, the ESP is basically a FAT partition, but it's marked as partition type EF to indicate that it is not a normal data partition, but rather, it contains a file which in turn contains the boot table. That's how UEFI booting works: When the BIOS wants to boot through UEFI, it actually looks for an ESP, and if it finds one, it tries to read the files there to find out what operating systems it can boot. That's kind of cool, isn't it? A whole list of selectable operating systems to boot via an index file and a set of boot loaders on a FAT partition which the BIOS is aware of. When you understand that this is how booting with UEFI works, you start to appreciate that maybe it has some virtue to it after all.

Now comes the question which you've probably been asking for a while already: How do you see what's on the ESP? To see what's on the EFI partition, run DISKPART from Windows and then type list partition to see the partitions on the drive. You should see one which Windows just calls a "System" partition; typically it's 100 MB. If you see it, that's your target. By the way, going back to how much garbage Windows is: Technically your hard drive is likely to have a fourth partition which doesn't even show up in "Disk Management", called an MSR (Microsoft Reserved Partition). The MSR is only a few megabytes (in Windows 10, it starts at 16 MB), but the joke is that it literally doesn't contain anything at all. Windows just reserves this space in case it might suddenly want to use another partition someday. I'm not even joking; that is literally why the MSR exists. Windows creates it and then hides it from you so you don't wonder why Windows is just consuming disk space for no reason. It does show up in DISKPART if you run list partition, but not in "Disk Management". So yeah, EFI/UEFI might be okay in some ways, but Windows in the 21st century is still the worst thing to ever happen on Earth.

Getting back to DISKPART, if you type list volume, you'll see a list of "volumes" which Windows recognizes, which is usually the partitions minus Windows' "Recovery Partition" and the MSR, which Windows doesn't treat as "volumes". This is important, because to access the ESP, you'll need to treat it as a "volume", even though this is a bogus word invented by Windows, and not a "partition", which is what it really is. In the output from list volume, you should be able to see the volume number of the ESP, so type sel vol X where X is the ESP's volume number, and now you've selected the ESP as the "active volume". I'm "using" a lot of "quotation marks" because that is a stupid thing to do, just like using Windows. Now you can do something pretty awesome: Type assign letter=x: where x is the drive letter you want to assign to the ESP, then look in Windows Explorer (which means clicking on that yellow folder on the taskbar; Windows Explorer, not Internet Explorer, which is a (bad) web browser). Now you'll have a visible drive with a drive letter in Windows that represents your EFI boot partition!

Not so fast, though: If you try to double-click on that drive in Windows, chances are that you'll get an "access denied" error. Yes, Windows never stops trying to oppress its users and prevent them from doing anything with the computer which they paid money for. Even if you're an "Administrator" on this computer, Windows won't let you read the data on your own disk drive! This is further evidence that, like voting in elections, being an "Administrator" in Windows is a false sense of emancipation, a pacifier which our oppressors give to us to maintain an illusion that we have control over our own environments, when in reality every choice we make is actually the only choice which Microsoft offers to us. So remove the drive letter which you've created by typing remove in DISKPART. You don't even need to specify the drive letter, because assuming the EFI partition is still the "active", "selected" one (which it should be if you haven't selected a different one), then Windows implicitly assumes that that's where you want to remove the drive letter, and does so without further prompting.

Go ahead and type exit to get out of DISKPART. Make sure that you're running a command line with Administrator permissions (do "Run as administrator" on cmd.exe if you're not) and run the following command instead: mountvol x: /s where x is, again, the drive letter you want to assign to the EFI partition. Now you can access the EFI partition through the command line! It won't work in Windows Explorer, but then again, if you've gotten this far, you're an intelligent person, so why would you want to use something stupid?

Once you've taken a look in the EFI partition for a while, you'll probably notice that while it's good fun to take a look around, you don't want to make any changes there without really knowing what you're doing, so when you're finished looking for now, run mountvol x: /d (where x is the letter of the EFI drive you created) to remove the drive letter and keep it out of temptation's way.

I'm getting to the end of this brief introduction to booting with UEFI, but you might have started reading this because you have the question of how to create or recreate an EFI partition for Windows in case the existing one got damaged (or never existed in the first place). If you have an entirely new drive which has no EFI partition and you want to create one manually, this is something you should probably leave up to your operating system's setup program, but if you really want to try doing it manually, you can go back to DISKPART and use the following commands:

list disk (you'll see the drives in this system)
select disk x (where x is the number of the drive where you want to create the EFI partition)
If this disk is completely new and not configured in the GPT format, you may need to run the following command to convert it to GPT format:
convert gpt
Now it's time to make the EFI partition with the following command:
create partition efi size=100 (the size is in megabytes)
Specifying the size of the EFI partition is important, because otherwise DISKPART will try to fill the whole entire drive with the EFI partition, which is a little like building a traffic light which fills the entire intersection, leaving no room for cars to drive through.
Note that the "create partition efi" command automatically makes the new EFI partition the "active" one, so that the following command formats the correct partition! If you have made a different partition active in the meantime, make sure to select the right one with select partition BEFORE you run a format!
format fs=fat32 (obviously you can use FAT12 or FAT16 if you want, but let's be practical now)

Now you have a usable EFI partition on the drive. You can verify this with list partition. If everything looks good, now you need to get Windows to put its files in the EFI partition so that the BIOS knows how to boot Windows. Windows has a bcdboot command for this, BCD standing for "boot configuration data", but the bcdboot command requires the EFI partition to have its own drive letter, so while in DISKPART, go ahead and once again run assign letter=x: so that you can reference the EFI partition using a drive letter. Now you can exit DISKPART with the exit command and run bcdboot like this: bcdboot C:\Windows /S D: /F ALL /V where C:\Windows is the path to the source Windows files and D: is the drive where you want to configure the EFI partition. (This should be a drive letter on the EFI partition which you created in DISKPART with assign letter=x: and NOT the main partition on the target drive!)

That's all. Hopefully it was interesting. Call my cool BBS and post some messages or upload some files. Thanks!