My purchase

I purchased a refurbished Lenovo Miix 320 in July 2021 from eBay paying less that GBP £100. This is my new ultra portable solution for go-anywhere, always-on computing, to replace my aging 32-bit Dell Venue 8 Pro which I had updated to Windows 10.
I was delighted with the purchase; it arrived in good cosmetic order and the vendor had performed a factory reset back to the stock Windows 10 version of 1703.

My usual setup method

However, I prefer to install my own operating system from scratch on new devices rather than use the vendor-supplied image as reflects the zero-trust approach I often use professionally, and vendor images are typically full of bloatware. Furthermore, for refurbished kit, I like to securely wipe hard disks to ensure all traces of it's former life are well and truly gone.

As a precaution, before I remove a working image I capture drivers from a running system with Export-WindowsDriver -Online -Destination "c:\drivers" in an elevated PowerShell, which I copy to a pendrive, just in case of problems with driver detection later on.
So, for any other piece of equipment I would boot ShredOS, or a live Debian-based Linux, do apt-get install nwipe -y and then wipe the disks with three passes of random overwrites, followed by re-installation from the latest Windows 10 media.

Setup challenges

My standard approach to wiping and setting up was not going to work with the Miix. The first challenge was to work out how to access the Miix UEFI firmware - boot the device holding the Power and Volume Up buttons.

Work-around for secure erasure problems

Wiping the disk was the first job. I booted from my Ventoy USB pendrive and tried invoking Ultimate Boot CD, System Rescue 7, Ubuntu Mate 20.04 and Darik's Boot and Nuke (DBAN); all failed to boot on the Miix.

Note also that to boot reliably, a bootable USB pendrive must be attached to the USB C micro port on the tablet section, and not a USB socket on the keyboard section. For me, this meant I had to use a selection of adapters to present the pendrive to the Miix.

Eventually, I resorted to cryptographic deletion using the extant Windows 1703. I encrypted the entire disk with bitlocker, discarded the key, unencrypted the disk, and repeated the process a further two times leaving the disk encrypted on the final iteration. This effectively overwrites the entire disk multiple times with pseudo-random data.

Windows 10 Setup

Next, it was time to setup my own trusted copy of Windows 10, and here is where things really got difficult.
Again, I booted from my Ventoy USB pendrive and tried invoking Windows 10 21H1. Upon entry to the GUI portion of the installer, the screen corrupted to such an extent that I could not proceed. Apparently, this is a known issue and the workaround is to first install an older Windows build.

So, next I tried invoking Windows 10 1909 written to a pendrive with Rufus. This booted the GUI setup portion without screen distortion. I had to attach a USB mouse, and the direction of pointer travel was rotated 90 degrees. Unfortunately, the installer failed to identify the storage device, even when I presented the *.inf files from the earlier driver export. By this time I was starting to get frustrated.

A bit of research found that Lenovo produce a recovery image for this device called a Lenovo USB Recovery Key. So, to obtain, I followed the link to 'submit recovery media order, download Lenovo Recovery Media Creator tool' and registered a support account with Lenovo. I supplied the serial number of my device when prompted and downloaded the tool that can then be used to download the recovery image.

Upon invocation, the tool failed to download the recovery image due it wanting to use ports other than 21, 80 or 443, meaning the outbound connection was blocked by my lab firewall. Undeterred, I joined a device to a more permissive network and downloaded the recovery image without the firewall restriction, wrote it to a 16GB pendrive and used it to boot the Miix.

The recovery process started well and began writing the recovery image to the Miix. However, about 20 minutes into the recovery, the process stopped with an unexpected error relating to the installation of bundled McAfee bloatware. According to this forum post, the failure occurs because this particular piece of bloatware is time limited, and will not install beyond an unspecified date. So, how did I get around this?

What I should have done is reset the Miix, entered the UEFI firmware and set the system date to 1/1/2018. This would have prevented the McAfee installer from detecting that it had expired and the installation would have proceeded without error. Following install, it would have been a trivial task to correct the date.

What I actually did is press ctrl-alt q on the error screen to get access to the shell, and then ctrl-c to escape the failed command and allow the installer to continue. I had to press enter on the PowerShell window a few times to coax the script back into life, but after three to four hours the recovery was done.

After the final reboot, I was back to a brand new factory image of Windows 10 1703, albeit full of broken bloatware. I then re-inserted my Ventoy USB pendrive, mounted the Windows 10 21H1 ISO and ran it's installer to perform an upgrade. When prompted, I elected to keep nothing from the current Windows 10 setup, and following the upgrade and updates I had a fresh, up to date and bloatware-free stock Windows 10 build.

At last, all that was left to do was apply bitlocker and install my desired applications.

Perform an image backup

I was keen to avoid all this time and trouble should I need to recover the Miix again in the future, so I decided to make my own recovery image following the conclusion of my setup. I have some imaging tools on my Ventoy USB Pendrive, so I tried CloneZilla, Paragon Backup and Recovery and Macrium Reflect, but all failed to boot or work.
However, RescueZilla, which is a CloneZilla implementation with a pretty GUI, booted and I could write a CloneZilla disk image to a network share on my lab NAS. Of course I have not yet attempted to recover the RescueZilla image, but I'll update this post with the result should I ever try...