REFInd USB Drive (for emergency boot)

The rEFInd boot manager, forked by Rod Smith many years ago from a prior project called rEFIt.

It's one of the finest pieces of Linux programming that never caught on. Part of the problem is that, because rEFInd only works in UEFI, it isn't suitable for default installation on distros supporting BIOS boot (which of course is most, including Debian). If one has UEFI, there's a lot to be said for replacing Grub with rEFInd, but I'm not going to tackle that here. In this tutorial, I'm only going to explain how to install rEFInd to USB drive, which is particularly useful as an emergency boot tool.

Note: It's easier to create a rEFInd USB drive in advance, obviously, but can be improvised after the excrement has hit the fan. The drive can be setup from a live session, virtual machine or any almost computer running Linux. Doesn't matter which Linux or desktop. All it does is provide a platform to format an EFI partition, download a zip file, and run an installer script directed at an external drive.

How it works

What makes rEFInd useful for emergency boot is that the Linux kernel is bootable in its own right, without need for a separate boot loader. This means rEFInd on USB drive can boot kernel images of an installed system, even if Grub and/or NVRAM have been damaged or misconfigured. It also can boot Windows (using its boot loader) even if Grub is damaged. Someone taught me this trick early in my Linux journey and I've had a rEFInd USB drive sitting next to my computer ever since. By the way, once booted, you can remove the rEFInd drive, freeing up the port.

Select target

rEFInd needs to be installed to an EFI partition. Simplest solution is to dig out an old 2.0 flash drive, put rEFInd on it and don't worry about the remaining space. Or you can create two (or more) partitions, one for rEFInd and another for something else (e.g., data files). Or you can clear a little space on a backup drive and put the EFI partition there. My personal preference is a full install USB drive with rEFInd instead of Grub.

EFI Partition. Can be very small; the rEFInd files are only about 2 MB. Anything less than 100 MB sometimes draws squawks from partitioning tools, though, so that's what I use. Partition needs to be FAT format, with boot/esp flags. For GUI, use GParted or Gnome Disks. For CLI, use fdisk or gdisk. If you're new to partitioning, plenty of tutorials are available on the internet.

Download files

rEFInd is available in several formats. For this tutorial, you want the binary zip file, download links here. Files are hosted at SourceForge; current version is 0.14.2, uploaded Apr'24. Extract zip file. Can use the Downloads folder or move first to another. Downloads is fine if planning to delete folder after creating the USB drive (always can download again, if needed).

Install

The zip file includes a script for installing rEFInd to the EFI partition. Open Terminal in the extracted folder. For example, double-click in file manager, then right-click and select Open in Terminal; or open Terminal then cd to the appropriate folder. Run command in this form (notice dot): ./refind-install --usedefault /dev/sdxn --alldrivers , where sdxn = target EFI partition (e.g., sdb1); sudo not needed, but will be prompted for password.

Ventoy

If you use Ventoy, there's an even simpler option. On download page (link above), there's also a CD-R image file. Again, it's a zip file. Once extracted, there will be a .img file in the folder. Copy this to your Ventoy images folder. Ventoy will boot directly from the rEFInd img file, same as if it were an ISO.

How to Use

Attach USB drive, power up and select USB drive from firmware boot menu. If secure boot is enabled, you'll need to disable it,* but can re-enable later (after having fixed whatever is causing you to use rEFInd in the first place). rEFInd scans the computer for bootable objects, including boot loaders and Linux kernel images. Will present a horizontal row of icons with available options, first boot loaders, then kernel images. (Second row has tools.) Arrow-key to desired option, then Enter to select. To access backup kernels, similar to advanced boot options in Grub, press F2, Insert or Tab; use arrow keys to select desired kernel, then Enter to boot.

* Well, there is a way to leave secure boot enabled, provided you do the work ahead of time. You would copy rEFInd's secure boot certificate (and those of all installed systems) to the internal drive's EFI partition, then register the certificates with MOK. Only worth the trouble, though, if planning to use the USB drive for everyday boot, in which event might as well install rEFInd to the computer (see next paragraph). In any event, there's no way to certify the USB drive itself, so it will be secure boot qualified on all systems.

Replacing Grub

If you like the USB drive and decide to replace Grub on the installed system with rEFInd, I recommend the repo method (installs packages which, in turn, install rEFInd to the internal drives's EFI partition). As mentioned, unlike a USB drive, it's possible to endorse installed rEFInd so it's secure boot compatible. There are many configuration options, not particularly useful for a USB drive but handy if using rEFInd as main boot manager. Also, you will want to freeze Grub updates (sudo apt-mark hold) or even remove the Grub packages altogether. rEFInd's website (link above) discusses in detail all these issues and more.

This article was posted by pbear: https://forums.debian.net/viewtopic.php?t=163086