diff --git a/OS/BACKUP/Readme.md b/OS/BACKUP/Readme.md
new file mode 100644
index 0000000..4578fef
--- /dev/null
+++ b/OS/BACKUP/Readme.md
@@ -0,0 +1,243 @@
+# Restoring Windows on ASUS T101HA
+
+Complete guide to reverting from Xubuntu back to the original Windows installation.
+
+---
+
+## What you have
+
+| Item | Location | Purpose |
+|---|---|---|
+| `t101ha.img.zst` | PC: `E:\git\02 cSharp using mono\main\EARS-LINUX\OS\BACKUP\`<br>USB: BACKUP partition | Full byte-exact disk image, 17GB compressed |
+| `parts.txt` | Same locations | Partition table reference |
+| `window-key.txt` | Same locations | Windows product key |
+
+**Verified:** SHA256 `CBD4348ACB6777D5110D00F15FD67A6CBABE96152B628E503A8F2F6127E4EB63` (both copies identical)
+
+**Image expands to:** 62,537,072,640 bytes — exact match to device size
+
+---
+
+## Device reference
+
+- **Internal eMMC:** `/dev/mmcblk1` — ~58GiB (62,537,072,640 bytes)
+- **Firmware:** 64-bit UEFI (confirmed via `fw_platform_size`)
+- **Original layout:** ESP, Microsoft reserved, Windows (`p3`), recovery (`p4`)
+
+> **WARNING:** Verify the device with `lsblk` every time. Device names can shift between boots.
+
+---
+
+## Method 1 — Full image restore (recommended)
+
+Restores the exact original system: Windows activated, ASUS recovery partition, everything.
+
+### Preparation
+
+If the image lives on the PC, copy it back to the USB stick's BACKUP partition first. Restoring over a network is not recommended.
+
+### Steps
+
+**1. Boot the Ventoy live session**
+
+Power off fully. Hold F2, tap power, keep holding. Confirm Secure Boot is disabled, boot from USB, select the Xubuntu ISO, choose "Try Xubuntu".
+
+**2. Identify the devices**
+
+```bash
+lsblk -o NAME,SIZE,FSTYPE,LABEL,MOUNTPOINT
+```
+
+Confirm:
+- eMMC = the **~58GiB** device (`mmcblk1`)
+- USB = the **~115GiB** device with Ventoy/VTOYEFI/BACKUP partitions
+
+**3. Mount the backup**
+
+```bash
+sudo mkdir -p /mnt/backup
+sudo mount /dev/sda3 /mnt/backup
+ls -lh /mnt/backup
+```
+
+Adjust `sda3` to match the BACKUP partition from step 2.
+
+**4. Verify the image before writing**
+
+```bash
+zstd -t /mnt/backup/t101ha.img.zst
+```
+
+Must complete without error. If it fails, use the PC copy instead — do not proceed with a corrupt image.
+
+**5. Restore**
+
+```bash
+sudo blockdev --getsize64 /dev/mmcblk1
+```
+
+Confirm this prints `62537072640`. Then:
+
+```bash
+zstd -dc /mnt/backup/t101ha.img.zst | sudo dd of=/dev/mmcblk1 bs=4M status=progress
+sync
+```
+
+> **WARNING:** `of=` is the destructive direction. Everything on that device is erased. Read the command twice before pressing Enter.
+
+Takes 1–2 hours. Do not interrupt it, and do not run anything else — 2GB RAM.
+
+**6. Finish**
+
+```bash
+sync
+sudo umount /mnt/backup
+sudo poweroff
+```
+
+Remove the USB stick. Power on. Windows should boot, activated, exactly as it was.
+
+### With a progress bar
+
+```bash
+sudo apt install -y pv
+sudo sh -c 'zstd -dc /mnt/backup/t101ha.img.zst | pv -s 62537072640 | dd of=/dev/mmcblk1 bs=4M'
+```
+
+---
+
+## Method 2 — Recover files only (non-destructive)
+
+To extract files from the Windows image without wiping Xubuntu. Requires ~58GB free space.
+
+```bash
+zstd -d /path/to/t101ha.img.zst -o /tmp/full.img
+sudo losetup -fP --show /tmp/full.img
+```
+
+Note the loop device it prints (e.g. `/dev/loop0`), then:
+
+```bash
+sudo mkdir -p /mnt/win
+sudo mount -o ro /dev/loop0p3 /mnt/win
+```
+
+Windows lives on partition 3. Browse `/mnt/win`, copy what you need.
+
+Cleanup:
+
+```bash
+sudo umount /mnt/win
+sudo losetup -d /dev/loop0
+rm /tmp/full.img
+```
+
+If mount fails with a BitLocker error, the partition is encrypted — you'll need the recovery key from https://account.microsoft.com/devices/recoverykey
+
+---
+
+## Method 3 — Clean Windows install (image lost)
+
+Last resort. The product key is stored in firmware (ACPI MSDM table), so a clean install self-activates without entering anything.
+
+1. Download the Windows 10 ISO from Microsoft on the PC
+2. Write it to USB with Rufus — **GPT**, **UEFI** target
+3. Boot the tablet from it, install to the internal eMMC
+4. Activation happens automatically from firmware
+
+**Caveats:**
+- The ASUS recovery partition is not restored
+- Cherry Trail drivers may need manual installation from ASUS support
+- **Windows 10 is past end of support (October 2025), and this hardware cannot run Windows 11** — a restored image is a supported-nothing situation either way, but a clean install is strictly worse
+
+---
+
+## Recovering the product key
+
+From Linux, on the running tablet:
+
+```bash
+sudo strings /sys/firmware/acpi/tables/MSDM | tail -1
+```
+
+From the saved file:
+
+```bash
+cat /mnt/backup/window-key.txt; echo
+```
+
+From Windows:
+
+```powershell
+(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey
+```
+
+**Note:** viewing `window-key.txt` in Notepad may show CJK garbage — it's an encoding guess, not corruption. Read it on Linux with `cat`, or open it in VS Code and set encoding to UTF-8.
+
+---
+
+## Verifying image integrity
+
+Quick check (structural):
+
+```bash
+zstd -t t101ha.img.zst
+```
+
+Full check (byte count vs device):
+
+```bash
+DEV=$(sudo blockdev --getsize64 /dev/mmcblk1)
+IMG=$(zstd -dc /path/to/t101ha.img.zst | wc -c)
+echo "device: $DEV"
+echo "image:  $IMG"
+test "$DEV" = "$IMG" && echo MATCH || echo MISMATCH
+```
+
+Compare copies (PowerShell):
+
+```powershell
+Get-FileHash 'path\to\t101ha.img.zst' -Algorithm SHA256
+```
+
+> **WARNING:** `[ "$DEV" = "$IMG" ]` requires spaces inside the brackets. Without them the shell reports "command not found" and prints MISMATCH regardless of the actual values. Use `test` to avoid this.
+
+---
+
+## Troubleshooting
+
+**Restore finishes but won't boot**
+
+Check Secure Boot in BIOS — re-enable it, since the original Windows install expects it. Confirm the boot order lists Windows Boot Manager.
+
+**`dd` reports "No space left on device"**
+
+Wrong target device. Verify with `lsblk` that you're writing to the ~58GiB eMMC.
+
+**Image fails `zstd -t`**
+
+Use the other copy. If both fail, fall back to Method 3.
+
+**Progress appears frozen**
+
+Check it's actually stalled before interrupting:
+
+```bash
+ps -eo pid,stat,cmd | grep -v grep | grep -E 'dd|zstd'
+sudo dmesg | tail -30
+```
+
+STAT `D` plus `mmc` errors in dmesg indicates bad sectors. STAT `R`/`S` with a clean dmesg means it's just slow — eMMC on this tablet throttles when warm.
+
+**"read kernel buffer failed"**
+
+`dmesg` needs root here: `sudo dmesg`
+
+---
+
+## Notes
+
+- Keep both copies of the image. The USB stick is a single point of failure.
+- Restoring reverts to the disk state as of **27 July 2026**. Nothing created in Xubuntu survives.
+- Do a full `zstd -t` on whichever copy you plan to use *before* wiping anything.
+- Original image created with: `sudo zstd -1 -T0 -f -o /mnt/backup/t101ha.img.zst /dev/mmcblk1`
\ No newline at end of file