For the most part, modifying the ConsentPromptBehaviour keys in registry worked to require UAC on most uninstalls. However I noticed theres still some apps that don't prompt UAC when uninstalling and...

So it seems to me that if I go: create intelligent image -> create file C -> restore with image, it will still be there and recoverable with recuva if it wasn't overwritten by the restore right......

I meant checking if blocks are the same for files that exist in the backup. The program part I can check with recuva or file recover programs

Yeah I'll probably do a test.
Any suggestions for programs to test with? Sure I can use recuva to check for the files but I'm not sure how to check the blocks...

I'm wondering if Macrium Reflect's intelligent copy will overwrite all sectors not in use?

Heres an example: A pc freshly formatted, with files A and B on it. Then I create an image with Macrium...

nope, no error in bcdedit

If you search for hklm drivers on google theres a few threads about it just up and disappearing after a bit of time.

I don't think you're understanding the issue...

and no sfc doesn't do anything.

Edit:

I've just checked in a VM by creating a brand new windows installation.
On boot, I am able to read...

It brings up the same dialog window as the "permissions..." on a loaded key, but no buttons, just an error (I forgot the error details) at the top. Again, probably cause it can't find the key/hive.
...

I am running as admin. It's not a permission error, it simply unloads the hive while I'm looking through it (in the case of \DRIVERS)
If I try to bring up the "permissions..." menu it'll show that...

Sometimes I'll select BCD00000000 and I'll be able to view the files. Other times it throws an error saying "Error opening key" and not open it, permissions also doesn't work so I assume it's somehow...

This does seem slightly nefarious from certain viewpoints. Though for me it was honestly just curiosity.
However, it does seem weird to me that the app settings and data are hidden somewhere else....

It's not that, thats something I didn't even know about til now.
I noticed that when you use the "reset" option for an app on the apps & features page, it will also change the install date to the...

In Apps & Features, usually there will be a date beside programs whether their UWP apps from Windows Store or not.

For those programs installed without Windows Store, they have registry keys at:...

Interesting. So it loads itself first, gives itself X:, then loads all other drives from C: forwards.
And then if you already have too many drives it just doesn't give them a letter (according to...

I noticed that a lot of recovery software/windows recovery gives itself the X drive letter. If you already have an X: drive what letter does recovery give itself? How about if you already used all...

Yep, I understand that much

What I'm saying is, I changed the ID from lets say xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx to yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy. On restart, what you wrote happens,...

I was under the impression that this simply changes the disk ID and that's it. However during my tests and messing around in a vm, I was unable to reverse this if used on the OS drive.

I would...

1.
HID Keyboard Device (001)
HID-compliant mouse (001)
HID Keyboard Device (002)

2.
HID-compliant vendor-defined device
HID Keyboard Device (001)
Microsoft Bluetooth LE Enumerator...

First time I've experienced something like this:

Put computer to sleep and it went into hibernation after some time. When waking from hibernation it gave me a BSOD with error code 0xc0000098, The...

Going to try this again with file changes view instead, maybe windows is modifying some settings file... if anyone has an idea please do let me know

note that restore point seems to undo this, but...

Even when the laptop supports modern standby, "When I close the lid" doesn't have that option and is set to "Sleep". Use "powercfg /a" in cmd to check for "Standby(S0 Low Power Idle)"

Yep, I checked and the device supports Modern Standby, and closing the lid is set to Sleep.

Now I suppose the question is whether Modern Standby counts as "turning off the computer" and...

Quick question about Windows Updates.

Does closing the lid on a laptop count for the "don't turn off your computer" message? The default option is "Sleep", but usually when you close the laptop...

I've read through all of this and I've come to the conclusion that yes, it is in a way a "forced shutdown". The computer would only know that it was working in the OS up til the point of your...

So everyone else has been doing these "forced shutdowns" huh... wonder if anyone's bricked a system by restoring