ID #1038

Initial setup for a large MOA-USB-disk


I need a nice demo-MOA for the VMworld congress in Kopenhagen ....

This is a walkthrough ...

For demonstration at a VMware meeting I of course want all the VMware related bells and whistles that MOA can do.
So the final result should be able to:

run MOA 2.4.1 based on BartPE - including WS 6.5.4 , Converter and latest ViClient
another MOA 2.4.1 option - this time not loading into RAM so it is suitable for low memory systems
run Slax - Linux 32 bit with WS 6
run Debian  - Linux 64 bit with latest WS
run ESXi 3.5 in stateless mode for recovery purposes
run ESXi 4 in stateless mode for recovery purposes

and additionally - still experimental  - run WS 7 running on top of PE 3 - 64 bit mode.

As I expect to use MOA 2.4.1 most of the times the "moahome" partition will be the largest one - it will also be used to store the virtual machines ...

Drive-layout - creating the partitions ...


It starts with a fresh new Western Digital USB disk with a capacity of 250 Gb - such a device is available for 60 Euros or cheaper.
I recommend to do the partitioning on XP or 2003 - so the new disk looks like this in diskmanagement.

new disk in diskmanagement

Next I delete the existing partitions and create 7 new ones.

partitioned disk

I start by creating three primary ones - then one extended that covers the rest of the free space.
Once the extended one is created I continue with logical partitions inside the extended one.

# type size filesystem used for ..
1 primary 2047 Mb FAT used to install grub4dos
2 primary 6000 Mb unformatted will be used for Slax
3 primary 8000 Mb unformatted will be used for Debian 64 bit
4 logical 500 Mb FAT will be used for ESXi 3.5
5 logical 500 Mb FAT will be used for ESXi 4
6 logical 3000 Mb unformatted will be used as a Linux swap space
7 logical all the rest NTFS will be used as "moahome" drive

At this time it is not necessary to format the Linux - partitions so just leave them unformatted.

Downloads ...

for convenience sake here is a list of the files that must be downloaded.
At this time driveletters will be different for different users so paths are given using the
partition number instead of a driveletter.

Required to make the disk bootable - extract in the root of part1 - extract and save the directory as part7\programs\syslinux
hdhacker - extract and save the directory as part7\programs\hdhacker
winimage - extract and save the directory as part7\programs\winimage

Required to build MOA 2.4.1
(- download and store  this files in part7\moa241build)

Required for the Debian 64 boot-option
(- download and store in the root of part1)

Required for dotnet support
(- download and store in part7\src)


VMware files
(- download and store in part7\src)
VMware Workstation 6.5.4 for Windows

Nice to have ISO-files
VMware-ESXi 4 setup iso- download and store in part7\images
VMware-ESXi 3.5 setup iso- download and store in part7\images
Windows 7 32 bit Recovery CD
Windows 7 64 bit Recovery CD

Step 1 - make the drive bootable

Step 2 - build MOA 2.4.1

open partition 7 with explorer and create a directory "moa241build" in the root of the empty drive.

and store the files in the new directory just created

doubleclick the MOA-setup

click "I agree" and then launch "create moa core" from the menu.

The  setup is very easy to use - it just asks a few question ... first one is this one

answer "big" here.
The next option is only needed for forensic investigators so say "No" here

The next option enables a Multi-processor kernel

In case you only want a coldclone CD click OK

For this example we want all the bells and whistles so we add WMI-support.
This is not enabled by default so do not click "OK" now - instead open the file
moa241build\pebuilder\plugin\wmi-support\wmi-support.inf with notepad

and set Enable=1 - save the file.

Now click"OK" and let Pebuilder do its job.
When Pebuilder is done a last question pops up.

Probably you want to say "Yes" here - but you can also add Converter at any later time.
So don't worry if the extraction of Converter fails at this moment.

When you see the next screen the build is finished.

Click "Exit" now.


Step 3 - create boot-images and ISO-files

launch the MOA-setup again -

launch the postprocessing three times so that you finally have this iso-files

The moa24-std.iso is usefull for booting on hosts with little RAM only ... < 512 MB
The moa24-bandit.iso can be used on hosts that do not boot from USB or inside VMs ...
The moa24-max.iso is used for development work only - it allows installation of large apps on the fly
but needs a lot of RAM to boot. Use on hosts with 1024 b RAM or more ...



Step 4 - prepare the "moahome" partition

go to the directory moa241build\pebuilder\BartPE\moahome and copy all directories

and paste those directories in the root of the partition.
Finally create a tag file named "moa-is-at-home.tag"

The partition now should look like this


Step 5  - add MOA to the boot-options

go to the directory moa241build\ram-images\bandit
and copy the files BANDIT.IMG and WINNT.SIF to the root of partition1.

go to the directory moa241build\ram-images\bandit\I386 and copy the files

"SETUPLDR.BIN" and "NTDETECT.COM" to the root of partition1.
Rename the file "SETUPLDR.BIN" to "ntldr"

Your partition 1 now should look like this.

Congrats - all done.


This USB-disk can now be used all by itself.
You no longer need the building host.

All further customisations are done with MOA itself.


Tags: MOA, setup, USB-disk

Related entries:

You can comment this FAQ

Comment of boluak:
Mix up in these links


2. hdhacker

both points to the same file:

which is the hdhacker download

3. WindowsServer2003-KB926139-v2-x86-ENU.exe

4. esx-tools-016.exe

both points to the same file:

which is the esx download
Added at: 2011-01-07 20:33

Comment of Ulli Hankeln:
Hi boluak

sorry for the bad links - I just fixed them

for the esxi-iso files you must be logged in to the VMware-site - can't give direct links here

Added at: 2011-01-10 17:01