Image Backup and Restore Principles


cereberus

Well-known member
Guru
VIP
Local time
6:06 AM
Posts
5,677
OS
Windows 10 Pro + others in VHDs
This is a short guide on Image Backups and Restores.

It is not targeted at any specific tool, but is perhaps more slanted to Macrium Reflect Home as it is more feture rich than the other common tools like AOMEI, Easeus, Hasleo, Veeam etc

----------------------------------------------------------------------------------------------------------------------------

The sole purpose of this post is to basically provide understanding of the key principles of Image Backup and Restores, so:

Please do not reply with irrelevant comments such as "I only do fulls, "I do not trust incrementals" etc. This is not relevant to this post and will derail the post. Start your own thread!

Please do not add comments like Tool A is better than Tool B etc.

Please keep posts to clarifications e.g. to explain further or correct errors.

If you do post irrelevant comments, I shall bite back, and remember I have three heads so it will not be pretty!


----------------------------------------------------------------------------------

Three main topics are:


1) full, differential and incremental backups (sometimes called delta backups).

2) Full and Delta Restores

3) Related to Delta Restores - Changed Block Tracking.


First thing to understand is modern image tools usually work on a Sector basis not a file basis (although file backup/restores are an option)

A Sector is a section of the drive that can contain part, all or multiple files.

So the following is basically how they work. Bear in mind that this is a simplification of course.

1A) Full Backup

Suppose drive has 10 sectors A-J with data on sectors A, B,C & D and the D sector contains temporary files e,g, hiberfile.sys.
For simplification assume a Block and Sector are the same thing.

Normally, when you make an image backup, Sectors A, B, C will be written to an image file and usually compressed using Smart Sector Backup i.e. only actual written data. Sector D is not written or restored.

You can also (not all tools perhaps) do a "forensic backup" which will backup every Sector A-J (including D). This mode should only be used in special cases as deleted files in sectors are also backed up.

1B) Differential Backups. These Backup all Sectors changed sinced last full Backup.

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using differential backups:

Full would contain A, B, C
Diff 1 would contain E
Diff 2 would contain E, F

See how differentials grow

To restore to latest backup state, you need Full + Diff 2 (Diff 1 is not needed)

1C) Incrementals only backup changes since previous incremental

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using incremental backups:

Full would contain A, B, C
Inc 1 would contain E
Inc 2 would contain F

Incrementals take less space but to restore to latest backup state, you need Full + Inc 1 AND Inc 2.

Of course, blocks are not only added, they may be deleted.

So suppose (ignoring D as temporary),
Full add A,B,C
Inc 1 add E
Inc 2 Add F, Subtract B (lets call it -B)

PC final status A, C, E, F after backup of inc 2.

But then suppose we accidentally delete Sector A

PC status after acidental deletion C, E, F

------------------------------------------------------------------------------------------------------------------

2A) Full Restore
So we select to do a Full Restore which wipes target drive, up to latest backup using incrementals

A full restore just processes each full and incremental in turn
So drive is wiped
From Full A, B, C are restored, then E from inc 1 and then F from inc 2 and THEN B is deleted

PC final status A, C, E, F after Full restore up to inc 2.

Key Point - 5 sectors were restored and 1 deleted.

2B) Delta Restore
This is different - all sectors are compared in selected full/incs and only ones that have changed
By checking backup files, image tool works out Final Status should be A, C, E, F, but PC only has C, E, F as A has been deleted.
Delta Restore only restores A i.e. whole drive is not deleted,

Thus PC final status A, C, E, F after Delta restore up to inc 2.

Key Point - only 1 sector was restored.

In real life, there are thousands of sectors and a full restore will restore all of them as they are all deleted.
A Delta Restore does much less work.

However, there is an overhead in checking using Delta Restore, and if there are too many changes, Delta Restore may revert to Full Restore.

It is important to note that Delta Restore works on any Restore - full, differential or incrementals.

Even if you only do full backups, you can do Full or Delta Restores.

-----------------------------------------------------------------------------------------------------------

So, as you can see Delta Restores are much quicker, but that is not the full story.


3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.

However, the time saving is usually quite small, and there must be some overall performance overhead tracking changes. This function is primarily targeted at corporate users. Most domestic consumers do not nprmally use this option (as far as I can ascertain).
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0
This is a short guide on Image Backups and Restores.

It is not targeted at any specific tool, but is perhaps more slanted to Macrium Reflect Home as it is more feture rich than the other common tools like AOMEI, Easeus, Hasleo, Veeam etc

----------------------------------------------------------------------------------------------------------------------------

The sole purpose of this post is to basically provide understanding of the key principles of Image Backup and Restores, so:

Please do not reply with irrelevant comments such as "I only do fulls, "I do not trust incrementals" etc. This is not relevant to this post and will derail the post. Start your own thread!

Please do not add comments like Tool A is better than Tool B etc.

Please keep posts to clarifications e.g. to explain further or correct errors.

If you do post irrelevant comments, I shall bite back, and remember I have three heads so it will not be pretty!


----------------------------------------------------------------------------------

Three main topics are:


1) full, differential and incremental backups (sometimes called delta backups).

2) Full and Delta Restores

3) Related to Delta Restores - Changed Block Tracking.


First thing to understand is modern image tools usually work on a Sector basis not a file basis (although file backup/restores are an option)

A Sector is a section of the drive that can contain part, all or multiple files.

So the following is basically how they work. Bear in mind that this is a simplification of course.

1A) Full Backup

Suppose drive has 10 sectors A-J with data on sectors A, B,C & D and the D sector contains temporary files e,g, hiberfile.sys.
For simplification assume a Block and Sector are the same thing.

Normally, when you make an image backup, Sectors A, B, C will be written to an image file and usually compressed using Smart Sector Backup i.e. only actual written data. Sector D is not written or restored.

You can also (not all tools perhaps) do a "forensic backup" which will backup every Sector A-J (including D). This mode should only be used in special cases as deleted files in sectors are also backed up.

1B) Differential Backups. These Backup all Sectors changed sinced last full Backup.

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using differential backups:

Full would contain A, B, C
Diff 1 would contain E
Diff 2 would contain E, F

See how differentials grow

To restore to latest backup state, you need Full + Diff 2 (Diff 1 is not needed)

1C) Incrementals only backup changes since previous incremental

So supposing we have 2 on consecutive days, and we added Sector E 1st day, and Sector F on next day using incremental backups:

Full would contain A, B, C
Inc 1 would contain E
Inc 2 would contain F

Incrementals take less space but to restore to latest backup state, you need Full + Inc 1 AND Inc 2.

Of course, blocks are not only added, they may be deleted.

So suppose (ignoring D as temporary),
Full add A,B,C
Inc 1 add E
Inc 2 Add F, Subtract B (lets call it -B)

PC final status A, C, E, F after backup of inc 2.

But then suppose we accidentally delete Sector A

PC status after acidental deletion C, E, F

------------------------------------------------------------------------------------------------------------------

2A) Full Restore
So we select to do a Full Restore which wipes target drive, up to latest backup using incrementals

A full restore just processes each full and incremental in turn
So drive is wiped
From Full A, B, C are restored, then E from inc 1 and then F from inc 2 and THEN B is deleted

PC final status A, C, E, F after Full restore up to inc 2.

Key Point - 5 sectors were restored and 1 deleted.

2B) Delta Restore
This is different - all sectors are compared in selected full/incs and only ones that have changed
By checking backup files, image tool works out Final Status should be A, C, E, F, but PC only has C, E, F as A has been deleted.
Delta Restore only restores A i.e. whole drive is not deleted,

Thus PC final status A, C, E, F after Delta restore up to inc 2.

Key Point - only 1 sector was restored.

In real life, there are thousands of sectors and a full restore will restore all of them as they are all deleted.
A Delta Restore does much less work.

However, there is an overhead in checking using Delta Restore, and if there are too many changes, Delta Restore may revert to Full Restore.

It is important to note that Delta Restore works on any Restore - full, differential or incrementals.

Even if you only do full backups, you can do Full or Delta Restores.

-----------------------------------------------------------------------------------------------------------

So, as you can see Delta Restores are much quicker, but that is not the full story.


3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.

However, the time saving is usually quite small, and there must be some overall performance overhead tracking changes. This function is primarily targeted at corporate users. Most domestic consumers do not nprmally use this option (as far as I can ascertain).
What does the new "Windows backup" do in the latest DEV insider windows release. As soon as I installed the latest DEV release (236xxx...) - I was given a prompt -- do you want to take a backup.

I understand snapshots etc but does this Windows backup thing on Insider release DEV 23xxx actually do anything that you could use for a stand alone boot recovery for a "bare metal restore".

I understand your thread and not trying to hijack it - but this latest "Windows backup" included with the latest insider DEV versions just seems to throw even more confusion into the whole mess.

(on another note the Linux DD command just copies physical sectors irrespective of file systems etc -- also any errors too -- but that's another topic altogether).

Cheers
jimbo
 

My Computer

System One

  • OS
    Windows XP,7,10,11 Linux Arch Linux
    Computer type
    PC/Desktop
    CPU
    2 X Intel i7
Please delete this and start new thread. I made a post about this before.
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0
Please do not reply with irrelevant comments....
I think 'please don't reply by quoting the whole post' could be a useful addition.... :wink:

3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.
I thought the purpose of CBT was to speed up the image backup, and specifically only for NTFS volumes. CBT plays no part in a restore, Delta or Full. CBT keeps track of what has been changed since the last backup, so Reflect doesn't have to check through the disk itself to find out what has changed.
Macrium Reflect Changed Block Tracker (MRCBT) is a feature of Macrium Reflect. It reduces the amount of time it takes to perform incremental and differential images by monitoring the changes to an NTFS formatted volume in real-time.
 

My Computers

System One System Two

  • OS
    Windows 11 Home
    Computer type
    Laptop
    Manufacturer/Model
    Acer Aspire 3 A315-23
    CPU
    AMD Athlon Silver 3050U
    Memory
    8GB
    Graphics Card(s)
    Radeon Graphics
    Monitor(s) Displays
    laptop screen
    Screen Resolution
    1366x768 native resolution, up to 2560x1440 with Radeon Virtual Super Resolution
    Hard Drives
    1TB Samsung EVO 870 SSD
    Internet Speed
    50 Mbps
    Browser
    Edge, Firefox
    Antivirus
    Defender
    Other Info
    fully 'Windows 11 ready' laptop. Windows 10 C: partition migrated from my old unsupported 'main machine' then upgraded to 11. A test migration ran Insider builds for 2 months. When 11 was released on 5th October it was re-imaged back to 10 and was offered the upgrade in Windows Update on 20th October. Windows Update offered the 22H2 Feature Update on 20th September 2022. It got the 23H2 Feature Update on 4th November 2023 through Windows Update.

    My SYSTEM THREE is a Dell Latitude 5410, i7-10610U, 32GB RAM, 512GB ssd, supported device running Windows 11 Pro (and all my Hyper-V VMs).

    My SYSTEM FOUR is a 2-in-1 convertible Lenovo Yoga 11e 20DA, Celeron N2930, 4GB RAM, 256GB ssd. Unsupported device: currently running Win10 Pro, plus Win11 Pro RTM and Insider Beta as native boot vhdx.

    My SYSTEM FIVE is a Dell Latitude 3190 2-in-1, Pentium Silver N5030, 4GB RAM, 512GB NVMe ssd, supported device running Windows 11 Pro, plus the Insider Beta, Dev, and Canary builds as a native boot .vhdx.
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell Lattitude E4310
    CPU
    Intel® Core™ i5-520M
    Motherboard
    0T6M8G
    Memory
    8GB
    Graphics card(s)
    (integrated graphics) Intel HD Graphics
    Screen Resolution
    1366x768
    Hard Drives
    500GB Crucial MX500 SSD
    Browser
    Firefox, Edge
    Antivirus
    Defender
    Other Info
    unsupported machine: Legacy bios, MBR, TPM 1.2, upgraded from W10 to W11 using W10/W11 hybrid install media workaround. In-place upgrade to 22H2 using ISO and a workaround. Feature Update to 23H2 by manually installing the Enablement Package. Also running Insider Beta, Dev, and Canary builds as a native boot .vhdx.

    My SYSTEM THREE is a Dell Latitude 5410, i7-10610U, 32GB RAM, 512GB ssd, supported device running Windows 11 Pro (and all my Hyper-V VMs).

    My SYSTEM FOUR is a 2-in-1 convertible Lenovo Yoga 11e 20DA, Celeron N2930, 4GB RAM, 256GB ssd. Unsupported device: currently running Win10 Pro, plus Win11 Pro RTM and Insider Beta as native boot vhdx.

    My SYSTEM FIVE is a Dell Latitude 3190 2-in-1, Pentium Silver N5030, 4GB RAM, 512GB NVMe ssd, supported device running Windows 11 Pro, plus the Insider Beta, Dev, and Canary builds as a native boot .vhdx.
I think 'please don't reply by quoting the whole post' could be a useful addition.... :wink:


I thought the purpose of CBT was to speed up the image backup, and specifically only for NTFS volumes. CBT plays no part in a restore, Delta or Full. CBT keeps track of what has been changed since the last backup, so Reflect doesn't have to check through the disk itself to find out what has changed.

Yeah perhaps I did not explain that well. CBT is a continuous process keeping track of changed blocks since last backup. If used then it is not necessary to compare current pc state against imagege backups when restoring. I will update post.
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0
Check the amount of space you have available to store backups. In some cases, you will have to switch from differential to incremental. Also, if you do automatic maintenance, like keeping a set number of backups, you will also have to limit that number give space available.

Hopefully, you can have at least one full image available and not erased (which is an option in some apps) in case something goes wrong with the backup set.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom Build
    CPU
    i5-13400F
    Motherboard
    Gigabyte B-760M
    Memory
    16 GB
    Graphics Card(s)
    RTX 4060
    Sound Card
    internal
    Monitor(s) Displays
    AOC 27 gaming
    Screen Resolution
    1920 x 1080
    Hard Drives
    Kingston 2 TB M.2
    PSU
    Thermaltake 700W
    Case
    DarkFlash C285P
Short Guide, but useful, at least for a beginner like me, Who do not like to read long documents such as knowledge base ;-)
3) Changed Block Tracking (Block is a subset of sector)
In Macrium Reflect, it can track changes as it goes along, so it does not have the overhead of working out changes when doing the Delta Restore. This makes Delta Restore faster.

However, the time saving is usually quite small, and there must be some overall performance overhead tracking changes. This function is primarily targeted at corporate users. Most domestic consumers do not nprmally use this option (as far as I can ascertain).
I used this feature because I wanted to get things done as quickly as possible, but I did not know that most people do not use it


If you do post irrelevant comments, I shall bite back, and [B]remember I have three heads[/B] so it will not be pretty!
😂😅
 

My Computer

System One

  • OS
    windows 11 23H2
    Computer type
    PC/Desktop
    CPU
    Intel Core i5-12400
    Motherboard
    GIGABYTE B660
    Memory
    DDR4 Ram,16GB (2 x 8GB) 3200MHz CL16
    Hard Drives
    Samsung 980 500GB M.2 NVME

Latest Support Threads

Back
Top Bottom