Windows

1. Create a staging folder on your Windows computer (for example, C:\USBEFR_STAGING) and copy the downloaded EFR image and PAN-OS images into it.
2. Verify the SHA-256 checksum of the EFR image using PowerShell:

   Get-FileHash C:\USBEFR_STAGING\<EFR_IMAGE_FILE.img.gz> -Algorithm SHA256

   Compare the output against the checksum from the Customer Support Portal.
3. Extract the compressed EFR image.

   Use a tool that supports .gz extraction, such as 7-Zip or a similar utility. Right-click the .gz file, choose your extraction tool, and extract to the staging folder.

   This produces an uncompressed file: <EFR_IMAGE_FILE.img> (approximately 8 GB).
4. Connect the USB flash drive to your Windows computer.
5. Write the EFR image to the USB drive using Rufus or a similar raw disk imaging tool.

   1. Download and launch Rufus.
   2. For Device, choose your USB drive. Confirm the drive letter and size carefully — writing to the wrong device will overwrite its contents.
   3. For Boot selection, choose Disk or ISO image, then click SELECT and navigate to your extracted <EFR_IMAGE_FILE.img> file.
   4. Leave all other settings at their defaults and click START.
   5. When prompted, choose Write in DD Image mode, then click OK to confirm.

      All data on the USB drive will be erased. Confirm you have selected the correct device before proceeding.
   6. Wait for Rufus to complete. The status bar displays READY when finished.
6. After Rufus completes, use Windows File Explorer to verify the USB drive contains an IMAGES folder with a README file.

   Windows may only show one partition of the USB drive. This is expected — the EFI and boot partitions are not visible in File Explorer but are present and required for the EFR boot process.