Image Backup and Restore Principles

This is a short guide on Image Backups and Restores.

It is not targeted at any specific tool, but is perhaps more slanted to Macrium Reflect Home as it is more feture rich than the other common tools like AOMEI, Easeus, Hasleo, Veeam etc

----------------------------------------------------------------------------------------------------------------------------

The sole purpose of this post is to basically provide understanding of the key principles of Image Backup and Restores, so:

Please do not reply with irrelevant comments such as "I only do fulls, "I do not trust incrementals" etc. This is not relevant to this post and will derail the post. Start your own thread!

Please do not add comments like Tool A is better than Tool B etc.

Please keep posts to clarifications e.g. to explain further or correct errors.

If you do post irrelevant comments, I shall bite back, and remember I have three heads so it will not be pretty!


----------------------------------------------------------------------------------

Three main topics are:


1) full, differential and incremental backups (sometimes called delta backups).

2) Full and Delta Restores

3) Related to Delta Restores - Changed Block Tracking.


First thing to understand is modern image tools usually work on a Sector basis not a file basis (although file backup/restores are an option)

A Sector is a section of the drive that can contain part, all or multiple files.

So the following is basically how they work. Bear in mind that this is a simplification of course.

1A) Full Backup

Suppose drive has 10 sectors A-J with data on sectors A, B,C & D and the D sector contains temporary files e,g, hiberfile.sys.
For simplification assume a Block and Sector are the same thing.

Normally, when you make an image backup, Sectors A, B, C will be written to an image file and usually compressed using Smart Sector Backup i.e. only actual written data. Sector D is not written or restored.

You can also (not all tools perhaps) do a "forensic backup" which will backup every Sector A-J (including D). This mode should only be used in special cases as deleted files in sectors are also backed up.

1B) Differential Backups. These Backup all Sectors changed sinced last full Backup.

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using differential backups:

Full would contain A, B, C
Diff 1 would contain E
Diff 2 would contain E, F

See how differentials grow

To restore to latest backup state, you need Full + Diff 2 (Diff 1 is not needed)

1C) Incrementals only backup changes since previous incremental

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using incremental backups:

Full would contain A, B, C
Inc 1 would contain E
Inc 2 would contain F

Incrementals take less space but to restore to latest backup state, you need Full + Inc 1 AND Inc 2.

Of course, blocks are not only added, they may be deleted.

So suppose (ignoring D as temporary),
Full add A,B,C
Inc 1 add E
Inc 2 Add F, Subtract B (lets call it -B)

PC final status A, C, E, F after backup of inc 2.

But then suppose we accidentally delete Sector A

PC status after acidental deletion C, E, F

------------------------------------------------------------------------------------------------------------------

2A) Full Restore
So we select to do a Full Restore which wipes target drive, up to latest backup using incrementals

A full restore just processes each full and incremental in turn
So drive is wiped
From Full A, B, C are restored, then E from inc 1 and then F from inc 2 and THEN B is deleted

PC final status A, C, E, F after Full restore up to inc 2.

Key Point - 5 sectors were restored and 1 deleted.

2B) Delta Restore
This is different - all sectors are compared in selected full/incs and only ones that have changed
By checking backup files, image tool works out Final Status should be A, C, E, F, but PC only has C, E, F as A has been deleted.
Delta Restore only restores A i.e. whole drive is not deleted,

Thus PC final status A, C, E, F after Delta restore up to inc 2.

Key Point - only 1 sector was restored.

In real life, there are thousands of sectors and a full restore will restore all of them as they are all deleted.
A Delta Restore does much less work.

However, there is an overhead in checking using Delta Restore, and if there are too many changes, Delta Restore may revert to Full Restore.

It is important to note that Delta Restore works on any Restore - full, differential or incrementals.

Even if you only do full backups, you can do Full or Delta Restores.

-----------------------------------------------------------------------------------------------------------

So, as you can see Delta Restores are much quicker, but that is not the full story.


3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.

However, the time saving is usually quite small, and there must be some overall performance overhead tracking changes. This function is primarily targeted at corporate users. Most domestic consumers do not nprmally use this option (as far as I can ascertain).

cereberus said:

This is a short guide on Image Backups and Restores.

It is not targeted at any specific tool, but is perhaps more slanted to Macrium Reflect Home as it is more feture rich than the other common tools like AOMEI, Easeus, Hasleo, Veeam etc

----------------------------------------------------------------------------------------------------------------------------

The sole purpose of this post is to basically provide understanding of the key principles of Image Backup and Restores, so:

Please do not reply with irrelevant comments such as "I only do fulls, "I do not trust incrementals" etc. This is not relevant to this post and will derail the post. Start your own thread!

Please do not add comments like Tool A is better than Tool B etc.

Please keep posts to clarifications e.g. to explain further or correct errors.

If you do post irrelevant comments, I shall bite back, and remember I have three heads so it will not be pretty!


----------------------------------------------------------------------------------

Three main topics are:


1) full, differential and incremental backups (sometimes called delta backups).

2) Full and Delta Restores

3) Related to Delta Restores - Changed Block Tracking.


First thing to understand is modern image tools usually work on a Sector basis not a file basis (although file backup/restores are an option)

A Sector is a section of the drive that can contain part, all or multiple files.

So the following is basically how they work. Bear in mind that this is a simplification of course.

1A) Full Backup

Suppose drive has 10 sectors A-J with data on sectors A, B,C & D and the D sector contains temporary files e,g, hiberfile.sys.
For simplification assume a Block and Sector are the same thing.

Normally, when you make an image backup, Sectors A, B, C will be written to an image file and usually compressed using Smart Sector Backup i.e. only actual written data. Sector D is not written or restored.

You can also (not all tools perhaps) do a "forensic backup" which will backup every Sector A-J (including D). This mode should only be used in special cases as deleted files in sectors are also backed up.

1B) Differential Backups. These Backup all Sectors changed sinced last full Backup.

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using differential backups:

Full would contain A, B, C
Diff 1 would contain E
Diff 2 would contain E, F

See how differentials grow

To restore to latest backup state, you need Full + Diff 2 (Diff 1 is not needed)

1C) Incrementals only backup changes since previous incremental

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using incremental backups:

Full would contain A, B, C
Inc 1 would contain E
Inc 2 would contain F

Incrementals take less space but to restore to latest backup state, you need Full + Inc 1 AND Inc 2.

Of course, blocks are not only added, they may be deleted.

So suppose (ignoring D as temporary),
Full add A,B,C
Inc 1 add E
Inc 2 Add F, Subtract B (lets call it -B)

PC final status A, C, E, F after backup of inc 2.

But then suppose we accidentally delete Sector A

PC status after acidental deletion C, E, F

------------------------------------------------------------------------------------------------------------------

2A) Full Restore
So we select to do a Full Restore which wipes target drive, up to latest backup using incrementals

A full restore just processes each full and incremental in turn
So drive is wiped
From Full A, B, C are restored, then E from inc 1 and then F from inc 2 and THEN B is deleted

PC final status A, C, E, F after Full restore up to inc 2.

Key Point - 5 sectors were restored and 1 deleted.

2B) Delta Restore
This is different - all sectors are compared in selected full/incs and only ones that have changed
By checking backup files, image tool works out Final Status should be A, C, E, F, but PC only has C, E, F as A has been deleted.
Delta Restore only restores A i.e. whole drive is not deleted,

Thus PC final status A, C, E, F after Delta restore up to inc 2.

Key Point - only 1 sector was restored.

In real life, there are thousands of sectors and a full restore will restore all of them as they are all deleted.
A Delta Restore does much less work.

However, there is an overhead in checking using Delta Restore, and if there are too many changes, Delta Restore may revert to Full Restore.

It is important to note that Delta Restore works on any Restore - full, differential or incrementals.

Even if you only do full backups, you can do Full or Delta Restores.

-----------------------------------------------------------------------------------------------------------

So, as you can see Delta Restores are much quicker, but that is not the full story.


3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.

However, the time saving is usually quite small, and there must be some overall performance overhead tracking changes. This function is primarily targeted at corporate users. Most domestic consumers do not nprmally use this option (as far as I can ascertain).

Click to expand...

What does the new "Windows backup" do in the latest DEV insider windows release. As soon as I installed the latest DEV release (236xxx...) - I was given a prompt -- do you want to take a backup.

I understand snapshots etc but does this Windows backup thing on Insider release DEV 23xxx actually do anything that you could use for a stand alone boot recovery for a "bare metal restore".

I understand your thread and not trying to hijack it - but this latest "Windows backup" included with the latest insider DEV versions just seems to throw even more confusion into the whole mess.

(on another note the Linux DD command just copies physical sectors irrespective of file systems etc -- also any errors too -- but that's another topic altogether).

Cheers
jimbo

Please delete this and start new thread. I made a post about this before.

cereberus said:

Please do not reply with irrelevant comments....

Click to expand...

I think 'please don't reply by quoting the whole post' could be a useful addition....

cereberus said:

3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.

Click to expand...

I thought the purpose of CBT was to speed up the image backup, and specifically only for NTFS volumes. CBT plays no part in a restore, Delta or Full. CBT keeps track of what has been changed since the last backup, so Reflect doesn't have to check through the disk itself to find out what has changed.

Macrium Reflect Changed Block Tracker (MRCBT) is a feature of Macrium Reflect. It reduces the amount of time it takes to perform incremental and differential images by monitoring the changes to an NTFS formatted volume in real-time.

Click to expand...

Bree said:

I think 'please don't reply by quoting the whole post' could be a useful addition....


I thought the purpose of CBT was to speed up the image backup, and specifically only for NTFS volumes. CBT plays no part in a restore, Delta or Full. CBT keeps track of what has been changed since the last backup, so Reflect doesn't have to check through the disk itself to find out what has changed.

Macrium Reflect Changed Block Tracker

Macrium Software - the creators of Macrium Reflect backup, imaging and cloning software.

blog.macrium.com

Click to expand...

Yeah perhaps I did not explain that well. CBT is a continuous process keeping track of changed blocks since last backup. If used then it is not necessary to compare current pc state against imagege backups when restoring. I will update post.

Check the amount of space you have available to store backups. In some cases, you will have to switch from differential to incremental. Also, if you do automatic maintenance, like keeping a set number of backups, you will also have to limit that number give space available.

Hopefully, you can have at least one full image available and not erased (which is an option in some apps) in case something goes wrong with the backup set.

Short Guide, but useful, at least for a beginner like me, Who do not like to read long documents such as knowledge base

3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.

However, the time saving is usually quite small, and there must be some overall performance overhead tracking changes. This function is primarily targeted at corporate users. Most domestic consumers do not nprmally use this option (as far as I can ascertain).

Click to expand...

I used this feature because I wanted to get things done as quickly as possible, but I did not know that most people do not use it


If you do post irrelevant comments, I shall bite back, and [B]remember I have three heads[/B] so it will not be pretty!