Tools to Backup and Restore UEFI Variables

Managing Unified Extensible Firmware Interface (UEFI) variables is critical for maintaining boot order, Secure Boot keys, and hardware configurations. This article provides a direct overview of the primary command-line utilities, kernel interfaces, and operating system tools used to back up and restore UEFI non-volatile memory (NVRAM) variable states directly from within Linux and Windows environments.

Linux Tools and Interfaces

1. The efivarfs Filesystem Modern Linux kernels expose UEFI variables through the efivarfs kernel module, typically mounted at /sys/firmware/efi/efivars. Each variable is represented as a distinct file containing attributes and data.

  • Backup: You can back up variables using standard file-copy commands or archives. For example:

    tar -czvf uefi_vars_backup.tar.gz /sys/firmware/efi/efivars/

  • Restore: Restoring via efivarfs requires care. Many variables have immutable file attributes applied by the kernel to prevent accidental corruption. Before writing a file back to this directory, the immutable attribute must be cleared using chattr -i <filename>, the data written back, and the attribute restored with chattr +i <filename>.

2. The efivar CLI Utility The efivar tool is a dedicated userspace utility for manipulating UEFI variables without manually interacting with raw file nodes.

  • Backup: It can export the raw binary contents of specific variables using:

    efivar -n <GUID-VariableName> --export > variable_backup.bin

  • Restore: Variables can be imported back into NVRAM using the --import flag:

    efivar --import variable_backup.bin

3. Canonical Firmware Test Suite (FWTS) The fwts tool includes tests and utilities designed to dump UEFI tables and variable states. Running fwts uefidump dumps the entire contents of UEFI NVRAM variables into a human-readable and structured log format, useful for auditing and state tracking.

Windows Tools and Interfaces

1. OEM Deployment and Configuration Utilities Windows does not provide a native, full-featured CLI tool for raw NVRAM variable dumping and restoring equivalent to efivarfs. Instead, the most reliable way to back up and restore UEFI configurations is through manufacturer-specific tools:

  • Dell Command | Configure: Allows administrators to export the entire UEFI/BIOS settings profile to a .cctk file and re-apply it across systems.
  • HP BIOS Configuration Utility (BCU): Captures current firmware states into a text configuration file and reapplies them using native Windows commands.
  • Lenovo BIOS Deployment Tool: Offers scriptable WMI interfaces to read, save, and apply BIOS/UEFI variable states.

2. Windows API via PowerShell Windows exposes the GetFirmwareEnvironmentVariable and SetFirmwareEnvironmentVariable Win32 APIs. Administrators with SE_SYSTEM_ENVIRONMENT_NAME privileges can utilize custom PowerShell scripts or C/C++ utilities leveraging these functions to read and write arbitrary variable states. Built-in PowerShell cmdlets like Get-SecureBootUEFI allow read-only export of specific Secure Boot-related variables.

Key Considerations During Restoration

  • Volatile vs. Non-Volatile: UEFI variables have attribute flags (e.g., runtime access, boot service access, non-volatile). Tools must preserve these original attributes during restoration, or the firmware may discard the variable on reboot.
  • Hardware-Bound Variables: Restoring variables across different motherboard models or differing firmware versions can lead to boot failure, as certain variables contain platform-specific memory mappings or hardware references.