root@thehacksparrow:~/writeups$ SYSTEM ONLINE
root@sparrow:~/writeups$ cat guia-usb-de-rescate.md
// tools

Build the Perfect Rescue USB

22 Jul 2026 · 6 min read

A well-built rescue USB is what saves you when Windows won't boot, you suspect malware the infected system itself can't clean, or you need to recover files off a drive that no longer boots. The trick to making it "universal" isn't burning a single ISO — it's using Ventoy to fit several tools on the same USB and pick which one to boot depending on the problem.

HardwareUSB 3.0, 32-64 GB (16 GB minimum)
BaseVentoy (multiboot)
Time~30-45 min the first time, then just update ISOs

1. Why Ventoy instead of Rufus for this

Rufus burns one ISO per USB — great for a one-off task, but forces you to carry several USBs to cover several scenarios. Ventoy installs a bootloader once and, from then on, you just copy-paste .iso files onto the USB — no re-burning anything. On boot, Ventoy shows a menu with every ISO you've added.

2. Installing Ventoy

  • Download Ventoy from ventoy.net (Windows and Linux)
  • Plug in the USB (it will be fully wiped — back up anything on it first)
  • Run Ventoy2Disk (Windows) or ./Ventoy2Disk.sh (Linux), select the USB and click "Install"
# Linux
sudo ./Ventoy2Disk.sh -i /dev/sdX   # replace sdX with your USB (double-check with lsblk first)

Always confirm the device with lsblk before running this — point it at the wrong drive and you'll wipe the wrong disk.

3. Which ISOs to add — the full kit

ToolWhat it's forWhen to use it
Windows installer (official Microsoft ISO)Clean install or boot repairReinstalling from scratch, or "Repair startup" from the recovery menu
Hiren's BootCD PEA Windows PE environment with dozens of utilities: partition manager, registry editor, password reset, file recovery, antivirusWindows won't boot but you want to diagnose/fix without reinstalling
A Linux live distro (Ubuntu or Linux Mint)A full working system without touching the disk — browse, copy files, mount partitionsRecovering files off a Windows install that won't boot at all
Memtest86+Thorough RAM stress testRandom crashes, blue screens with no clear pattern — rules out bad RAM
An antivirus rescue disk (ESET SysRescue / Kaspersky Rescue Disk)Scans the drive from outside the infected OSMalware/ransomware the infected Windows itself can't clean
ClonezillaFull disk cloning/imagingBacking up the entire disk before any risky repair

With Ventoy you don't "burn" each one — you just download each tool's .iso and copy it onto the USB's partition, exactly like copying any other file.

4. Decision tree — what to boot based on the symptom

Doesn't power on / doesn't reach the BIOS
  -> Hardware problem, the USB won't help here

Powers on but Windows won't boot
  -> Hiren's BootCD PE: partition manager + boot repair
  -> If Hiren's doesn't fix it: Windows ISO -> "Repair your computer" -> Startup Repair

Windows boots but is very slow / acting strange / pop-ups
  -> Antivirus rescue disk (ESET SysRescue / Kaspersky Rescue Disk) from the USB

You need files off a drive that won't boot at all
  -> Linux live distro -> mount the Windows partition -> copy to a USB/external drive

Random crashes, blue screens with no pattern
  -> Memtest86+ (let it run several passes, at least 1 hour)

About to do a risky repair (partitioning, reinstalling)
  -> Clonezilla first, to have a full backup before touching anything

5. Booting from the USB on the target machine

StepDetail
1Restart and hit the boot-menu key (F12, F2, Esc, or Del depending on the manufacturer) before Windows starts loading
2Select the USB from the list of boot devices
3If it doesn't show up, Secure Boot may be blocking Linux-based ISOs — temporarily disable it in the BIOS/UEFI
4Ventoy shows the menu with every ISO — pick the one that matches the problem

Keeping the USB up to date

  • Update the Windows ISO and the antivirus rescue disk every few months — definitions and patches go stale fast
  • Always leave some free space on the Ventoy partition for the next ISO you'll want to add
  • Keep a copy of the ISOs on your computer or in the cloud, not just on the USB — if the USB fails, you don't want to re-download everything from scratch

⚠️ Tools like Hiren's password reset are exactly as powerful used for good as for bad — only use them on your own machines or with the owner's explicit authorisation.