PE vs Live mode¶
The same RECON shell runs in two situations, and it adapts to each. It detects which automatically and shows the mode in the dock (next to the clock).
WinPE mode (booted from the USB)¶
You booted the machine from the RECON USB. The installed Windows is offline — not running.
- The target of a repair is an offline drive you pick; RECON scans for a Windows install and confirms the drive before acting.
- Repairs run through RECON's offline action scripts (edit the offline system, reset a local password by editing the offline SAM, clean junk off a volume that isn't running, etc.).
- This is the mode for data recovery off a machine that won't boot, and for anything that can't be done while Windows is running.
How it's detected: WinPE's system drive is X: and wpeutil.exe is present.
Live mode (run on the booted Windows)¶
You're running RECON off the USB on the customer's normally-booted Windows. The system is live.
- The target is the running Windows itself.
- Repairs use the machine's own built-in Windows tools: Disk Cleanup, Programs and Features,
sfc /scannow+DISM /Online /RestoreHealth, and User Accounts — because the offline scripts can't safely touch a running system. - The Start menu lists the live Windows tools (Device Manager, Services, Event Viewer, and so on).
How it's detected: anything that isn't WinPE is a booted Windows.
Why it matters¶
Some jobs only make sense in one mode:
| Job | WinPE | Live |
|---|---|---|
| Recover data from a PC that won't boot | ✅ best | — |
| Reset a local password | ✅ (offline SAM) | use User Accounts |
| Repair system files | offline servicing | sfc + DISM /Online |
| Remove a program from a dead Windows | ✅ offline | Programs and Features |
In both modes the safety boundaries are identical — encryption is never bypassed, and only local accounts can be reset.