Rollback91 and Hot Imaging

I'm not a Rollback user but I'm confused by the way backup images have to be created outside of Windows. We all agree that is a pain compared with automatically creating images while Windows is running. No manual effort is required and you can keep using your computer while the image is being created.

I've developed a method of imaging the WinXP/Rollback partition while Windows is running and successfully restoring this image so Rollback works and all snapshots are present and functional. This method works whether restoring the image to the same HD or restoring to a new empty HD.

If this is old information let me know and I'll get on with other activities.

 

Hi Brian K,

I would like to learn and for me it is not old information!

Best regards,

KOR!

 

LOL.... phish.... ....

No...that is hot info !!
I've haven't used Rollback for years ...for many reasons

If you are onto something that can do as noted: might be worth a look again ??
Give it.
Regards

( 6 weeks to Niseko .. I'll be in touch.. )

 

I'm still testing but it is looking better with each test. You don't even need to do an all sector image backup. An ordinary "sectors in use" image backup works, even when restored to an empty new HD.

I've always thought Rollback was an app where you expended hours of time to save minutes later on. So I wasn't interested. But it is becoming more like something I could use.

 

Ha Ha Ha, pithy but fair.

Ya, maybe.

 

Brian,

If that's actually possible it would be revolutionary! .....is this method tied to IFW (with PHYLock)?

Happy New Year,
Aaron

 

Since when hot imaging was a problem with rollbackrx/eazfix?

The only problem was with maintaining all the snapsots but ifw can handle it with PHYLock enabled.

Panagiotis

 

I gather when you restore the backup image, Rollback no longer works and you have lost your snapshots. Is that true?

Most of my testing has been with IFW (and IFD for the restore) but I've tried DS and it works too.

 

True

Weird. Are you sure? Have you tried to revert to another snapshot?
If yes, it means that with the latest driver, windows can "see" the occupied space although it shouldn't...

Panagiotis

 

Panagiotis,

The problem was/is that hot-imaging using any disk-imaging program other than IFW with PHYLock does not capture all snapshots, only the current snapshot. Furthermore, upon restoring that image it is usually necessary to do a FIXMBR (or recover a standard Windows MBR) and finally, reinstall RB/EF!

In my post above, I asked Brian if his method was tied to IFW with PHYLock because I recall about a year ago, Markymoo reported that he was able to successfully capture all RB/EF snapshots via hot-imaging using IFW (with PHYLOCK) in RAW mode. While that worked, upon restore he still had to separately restore the MBR.

Happy New Year,
Aaron

 

Hi Aaron,

Yes, the snapshots are lost, but I never had to use fixmbr.
When you uninstall RB it automatically (unless you encountered a bug) restores the mbr backup it made during the installation.

If I remember correctly Mark tested it with Rolback 8 or 8.1. Some of those versions were extremely buggy on how they handled the mbr and how they presented it to the OS.

happy new year,
Panagiotis

 

This is what I noticed when I looked at the First Track (LBAs 0 to 62) with Disk Editor from DOS and with Roadkil’s SectEdit from BartPE. LBA–0 (the MBR) was special Rollback code. The standard MBR had been replaced. LBA-22 was a backup of the original MBR. LBA–23 was special Rollback code. Before installing Rollback I checked the First Track and noted all sectors beyond the MBR were zeroed.

But when you look at the First Track with Roadkil’s SectEdit from Windows, LBA–0 is a standard MBR and LBA–22 and LBA–23 are zeroed. So when the Windows/Rollback partition is imaged from Windows you are not imaging the special First Track that Rollback needs to boot before the OS boots. Rollback uses two First Tracks. One in Windows and one when Windows is offline.

My method involves backing up the offline First Track with MBRWork. I used a DOS boot floppy (containing MBRWork) because my test computer doesn’t boot from a USB device but a DOS USB flash drive will work. I know most people don’t have floppy drives anymore. The media needs to be writable because the backup is written to it. Using MBRWork is easy and the First Track only has to be backed up once. But keep the backup. If you change your partitions, backup the First Track again.

So finally. Do a normal hot image backup. An all sectors backup isn’t needed. When it is time to restore the image, do it as usual from the boot disk. Next, boot from your DOS disk and restore the offline First Track with MBRWork. Boot into Windows. All your snapshots will still work.

WinXP has been tested. I’m going on holidays later today and won’t have time to test Win7.

I hope the method works on your computers. Please let us know.

 

That seems to depend on the image backup program being used. When I used that method with ATI and DS, it was necessary to do so. I presume when using IFW for making a normal image via hot-imaging, you still have to reinstall RB/EF - correct?

That's another story - it's not the same as doing hot-imaging while RB is installed and running!

Aaron

 

Brian, If I'm sober enough, I'll try your method over the weekend and report back.

Fwiw, integrated image-backup of an RB/EF system environment is supposedly in development by HDS for RB v10.

Aaron

 

During the restore from the image you selected to restore the mbr, too? You shouldn't do that because RB presents to the not the real mbr.

I do not remember (the last time I tested this, was around February). I believe it identifies that it's prebootOS and system table are missing and it uninstalls itself, or asks to be uninstalled.

It isn't. As I said above it askes to be uninstalled/reinstalled, after the image is restored.

Panagiotis

 

@Brian

It seems that you took snapshots that are on the same tree. This should work as long as the image contains the sub structure (hidden filesystem) of RB. Have they made it visible from windows in this last version? For verifying you should restore to a different disk or you should zero first the disk and after restore.

happy new year,
Panagiotis

 

Panagiotis

You may have a point re not restoring the MBR - I'll try that method without restoring the MBR when restoring the image.

I misunderstood the final point you were making. I thought you were referring to uninstalling RB/EF before imaging.

The thing that's really difficult to grasp is that Brian was able to capture all of RB's snapshots by hot-imaging his RB system in normal mode rather than raw mode. While I don't use IFW, all disk-imaging programs that I have tried only backup Windows' used sectors in normal mode, ignoring all other sectors. Therefore, I don't understand how a normal mode image can possibly capture RB's snapshots which are on non-Windows sectors?

Aaron

 

It seems that Brian was lucky. The only way this is possible is if all the snapshots are made in a short period of time and each subsequent snapshot contained all the files of the previous snapshot. In this case all the visible occupied sectors are almost identical with the hidden ones.

And even if the subsystem of Rb was not backed-up, it shouldn't matter since during the restore those sectors where it resided were not touched/modified from the imaging program. But if he made an image and then took 1-2 more snapshots inside RB and after that restored, then the subsystem will not correspond anymore to the snapshots and rb will ask to be reinstalled.

edit: for understanding it a bit better, the easiest way is to copy some large files in the OS, take a snapshot, delete those files take another snapshot, and then take the image. In this case the restoration should give problems, even though the snapshots are on the same tree.

Panagiotis

 

That may explain it - so until a truly integrated and seemless disk-imaging system is implemented by the developers of RB/EF, I'll continue making 'PE - RawMode' image-backups (it helps of course that my C-partition is relatively small)! ...and most important, my restores are perfect and uneventful everytime.

Aaron

 

If you use a program like disk redactor before taking a raw, your images will be even smaller.
But why bother, unless you never update RB to newer versions, sooner or later you'll loose al the snapshots during the uninstall/reinstall.

Panagiotis

 

True, but aside from losing the snapshots because of a version update, I lose them (online) weekly. You see, I create a PE-RawMode image once/week and during the interim days I typically accumulate 7 to 12 snapshots. After I create my PE-RawMode image (capturing all snapshots of course) I update RB's baseline and start over fresh (so to speak) as I can always recover an old snapshot from an image if it becomes necessary.

Aaron

 

Returnil is running underneath Windows. Windows is sitting on top of Rollback. The Windows is in a protected environment. Kind of like Rollback is a virtualpc and the Windows is running inside the virtualpc(Rollback). Rollback is just presenting to Windows, the data sector layout Windows normally sees for that partition and one snapshot. Windows doesn't know any better. When Rollback rolls back to another snapshot, it presents the data sectors of that snapshot to Windows. Probably the reason it gets very fragmented with several snapshots is because data sectors are being protected for other unused snapshots, which the current Windows snapshot can't use.

 

Mark,

Although you may be right about the resulting fragmentation, I don't see that adversely affecting an 'RB-driven' system whatsoever. So as they say in basketball, "no harm, no foul".

Aaron

 

The technology is clever no doubt but the argument now is, in a time of fast pcs, faster hard drive storage with more reliable Windows with lots of other backup possibilities. Is it worth having your drive heavily fragmented? How often do you want to restore?

Due to the way it protects sectors, it ends up eating clusters for breakfast. I used latest version on older pc with 20GB space free after the 2nd snapshot. Only been using it 2 days and 3rd scheduled snapshot took all 20gb and I had hardly added any data. This is not the first time. This is not right. You might not of noticed on big drive.

Now if there was a software that stored the sector mapping in database files. This would solve the defrag problem but then it would take longer to restore.

I think you spend more time defragging your drive than backing up and restoring with conventional software. The less hardcore software you have installed on your pc, the less chance it go wrong anyway.

 

But I tried to point out in my last post that the fragmentation doesn't matter at all to RB. If not for RB, I would be reluctant to install all of trial software and freeware that I now do without any concern.

Mark, something is wrong there (and I don't think it's RB)! I'm running RB on my laptop protecting my 20GB C-partition and when my system changes are mimimal, so are my RB snapshots (200MB - 500MB). Are you sure that Windows' defrag isn't running to a schedule automatically? As you know, disk-defragging would account for unusually large RB snapshots!

As I already indicated, I don't spend any time defragging my drive, as the deframentation simply doesn't matter to RB.

Aaron