One USB key instead of fifteen

I still meet engineers carrying a zipped case full of bootable USB keys: one per Windows version, one for the imaging tool, one for the rescue environment, and one whose contents nobody remembers. It works, until the day the key you need is the one you left on the last site.

A multiboot key gets rid of the case. One drive, a boot menu, and every system and utility you actually use, picked at startup.

What it is

A bootable USB key is one a machine can start from, to install an operating system, run a live system or run a utility outside the installed OS. A multiboot key holds several of them behind a boot loader that shows a menu.

I have tried most of the tools that build these. WinSetupFromUSB is, in my view, the most complete of the free ones. It puts Windows installers from 2000/XP onwards, Linux and BSD images and stand-alone utilities on the same drive, and builds the menu for you.

On mine, in practice, you will find the Windows and Linux installers I actually deploy; imaging and backup tools (Acronis, Todo Backup, and Ghost for the old machines); TestDisk and PhotoRec for partitions and data recovery; UBCD with its memory and disk tests; and a live Linux, which is often the quickest way to read a disk that refuses to boot.

For developers and integrators: the menu is a file

The boot menu is not fixed. With the GRUB4DOS-based build it is a plain text file (menu.lst) that you edit directly: rename entries, group them, set the default and the timeout, delete what you never use. Ten minutes of editing turns a generic menu into yours, in your order, with your names.

Three things to check before you trust it

• Legacy BIOS or UEFI. A key built the old way boots in legacy/CSM mode. Recent industrial PCs often ship UEFI-only, sometimes with CSM removed altogether. Build for UEFI, or accept that some machines will simply not see the key.
• Secure Boot. It blocks an unsigned loader. Either the tool supports a signed shim, or Secure Boot has to be switched off, and on a validated production machine that is a change with paperwork behind it, not a quick trip into the BIOS.
• Filesystem. FAT32 is the compatible choice, but it refuses any single file over 4 GB, and several current Windows installer images have one. NTFS solves the size problem and costs you some UEFI compatibility. Know which constraint you are choosing.

If you are building one today and do not need the fine control of menu.lst, have a look at Ventoy. You copy the ISO files onto the drive and it boots them as they are, in BIOS and UEFI, with Secure Boot support and no 4 GB limit. Less customisable, far less work to maintain.

One more obvious point: put only software you are licensed to run on that key. Several of the classic utilities in these menus are commercial products.

The part that matters on an industrial site

Once it exists, that key is the most dangerous object in your bag.

Removable media is one of the classic ways malware reaches OT networks, because it walks straight past every firewall you installed. A technician’s multiboot key goes into an office laptop in the morning and a production PC in the afternoon, and everyone trusts it because it belongs to the person holding it.

So if the key is going anywhere near production, a few habits are worth making non-negotiable. Keep a separate key for OT, one that never goes into an office or personal machine. Scan it before every use, on a dedicated scanning station if the site has one; if it does not, raise it, because malicious code protection at the points where media enter the system is an explicit requirement of IEC 62443-3-3, and it is the sort of control a NIS2 audit asks about. Write-protect it when you only boot from it, so it cannot carry anything home. And know what is on it.

That last one is where most keys fail. A key assembled over four years, by more than one person, from downloads nobody logged, has stopped being a tool; you no longer know what you are plugging in.

Here, convenience and control point the same way. One well-built, documented and controlled key is easier to carry, and much easier to defend, than a bag of fifteen you cannot inventory.

References

• WinSetupFromUSB, project site: supported sources and UEFI support.
• Ventoy, project site: features, Secure Boot and file-size support.