Rollback91 and Hot Imaging

@Panagiotis

A unlocked drive in Windows? zWhat you mean,refer to exactly? Do you mean without Rollback running?


Saving the MBR long time and forget you changed partition sizes at later date can be byebye data on restore.,. Fine if you dont change but as Aaron said it simpler to do a whole partition backup inc. MBR outside of Windows regardless. ? ?

 

As they say in Oman, inshallah!

Best regards,

KOR!

 

Panagiotis,

I truly don't mind being wrong (especially in this matter) - but may I suggest that you conduct the following test (preferably on a test system):

1. Make an external copy of the MBR (of your RB system partition).
2. After doing that, delete 1 or 2 RB snapshots and create a few new ones (make note of the snapshots).
3. Create a hot-image backup of your RB system partition.
4. Now wipe your entire partition including all of track 0 (fwiw, I used Paragon Disk Wiper to do this).
5. Restore your copy of the MBR and your hot-image.

If you get a 100% successful restore (including RB and the snapshots that were in existence when you created the hot-image) I'll gladly eat crow!

Aaron

 

I agree. I'm one of those that rarely resize/modify their partitions. But with RBRx installed it is very unwise to modify your partition table.

Panagiotis

 

If I hadn't tested it, I would not have writen about this. (although I haven't zeroed the track 0).

But in the test that you describe even an offline image with DriveSnapshot would fail, since it does not copy all the 63 sectors of the track 0.Does it?

ps. RBRx subsystem resides versus the end of the last protected partition, ususally inside the last 2 gigabytes. If you use zero your free space beforing installing it and use a hex editor you'll see it. During the update of the baseline, it gets recreated/updated.

Panagiotis

 

I really didn't mean to imply that you hadn't done any testing, I was just suggesting a thorough test.

Indeed it does, but DS does not restore it by default - you have to enable DS' option to also restore the Partition Structure.

Best regards,
Aaron

 

@Panagiotis
You said any decent imaging software that can take raw image ion unlocked drives can copy all Rollback snapshots.s. Then said some imaging, referring to same software, struggle to lock to be able to copy the data to a image, aka unlocked drive. How can they copy fully, if they can't lock? They not decent either then are threy, if they can't do that. You are suggesting because they can't lock they can copy all snapshots. How so?

I stick to one imaging program mostly, used to have that problem of not locking in past with older software. I do not switch to different imaging programs, back and forth, like it the new flavour of the month so I wouldn't know now. As I own IFW/IFD as well as DS I backup with both for good measure. THe added advantage you can run both together from DOS or WinPE.

Indeed it does too. I'm referring to DS. There is no option not to take MBR. It takes(images) it by default from sector 0. How else NOT when there is option to restore the MBR.

 

"Track 0" is not the same with "Sector 0"/"LBA 0"/MBR.
"Track 0" = "LBA 0-62" = the first 63 sectors on the disk.
http://en.wikipedia.org/wiki/Track0
http://en.wikipedia.org/wiki/Logical_block_addressing

The partition table is part of the MBR.
http://en.wikipedia.org/wiki/Master_boot_record
http://mirror.href.com/thestarman/asm/mbr/PartTables.htm

Panagiotis

 

When a program cannot lock the drive it does not mean that it cannot take a raw. It only means the partition will be in inconsistent state.
But with RBRx installed it means that only the current snapshot will be in inconsistent state. All the others will be fine.
IFW is one example, if you do not use PHYlock or VSS. Just take a look at the attached images.

Panagiotis

 

Panagiotis,

Terminology is a fragile thing, especially with language barriers.

First of all, I used Tom Ehlert's terminology 'Partition Structure' (Tom is the developer of Drive Snapshot). Please note that I did not use the term 'Partition Table'. Btw, another disk-imaging program I know of refers to Track 0 as the 'Disk Header', and there's probably other names that are used to refer to Track 0.

As far as I am aware, Tom's use of the term 'Partition Structure' (in DS) refers to all of Track 0. You see, when restoring a DS image, one has the option to restore the entire Partition Structure (Track 0) or just the MBR (which as you know includes the Partition Table). By default, neither one is restored (unless the associated option box is checked).

Aaron

PS. If you wish to pursue this further you can email Tom Ehlert: te@drivesnapshot.de, but I for one would like to get back to the topic of Rollback Rx & Hot Imaging.

 

Hi Aaron,

I just checked it out. (a quick test)

DS does not backup the track 0. But it does backup the first 32 sectors (LBA 0-31) which is the GPT (Guid Partition Table).
And the functions "Restore MBR" and "Restore Partition Structure" do the exact same thing, they restore those 32 sectors.

Panagiotis

 

I agree.

 

Thanks for the lesson, i know track 0, which is really 62 usable sectors. Yes DS does only default backup the first 32 sectors.

You are technically 100% correct on both. Nice work.

But it doesn't matter DS can't backup all 63 sectors, for several reasons. Because 99.9% of the software that use it, only use a small percentage at the beginning, which is mostly by boot managers. I still refer to it as the first track, because it always images enough of the first track that contains the data.

You said Drive Snapshot will fail the test, backing up track 0. In this case, it's Aaron's test of Rollback RX. Rollback hardly uses any. No Rollback code lives in the sectors between 33-62. So DS test will pass.

All software, boot managers i know, all fall within the first 32 sectors. Even advanced boot manager Grub doesn't use more than 15-20. If Tom thought it so important to backup the full 63 sectors as default, he would of made sure of it.

So it not a big deal! Drive Snapshot is no less a failure.

DS MBR and Partition Structure features, both replace the first valid 32 sectors, or can i say track .

Find me software that lives between sector 33-62 and i gladly eat crow too.

 

Mark, would you like mustard with your black crow?

Ghost 2003 puts code in LBA-62 when it marks the HD. This is important for Ghost to find the HD when restoring from an image on optical media.

 

I should of said common decent software that you want to use. That is around the time Norton tried to turn it into something else and it went downhill. Why would you even use that version, when there are better versions before and after, and that are not greatly compatible with todays OS. So you install NG03 and backup with Drive Snapshot?? Why would you even need NG03 if you have DS?

Spit feathers. Anyways, the software list is rare for the average user, and for this thread it's a moot point.

Besides my Drive Snap that incorporates MBRWiz can backup/restore all of track 0 if need be, and you can also view the MBR or whole track. MBRWiz can back up any track or sector or a whole range. Now v3 is out with more options. So all 3 software together make a powerful ally.

If you could backup all snapshots within Windows then Rollback would be attractive to more users.

 

TrueCrypt
PLoP boot manager
Wee
Xorldr
(Also DiskCryptor, if the disks are dynamic)

 

Thanks for the images and info.

That is not a plus that's a minus. You couldn't keep doing that. It more straight forward to image outside of Windows and get all. If it cannot be locked, it usually means there is disk activity still going on. That is detrimental to any kind of consistent 100% system data backup. Even worse if multi-tasking at same time.

 

Mark,

When you restore the First Track using Drive Snap can you omit restoring the Partition Table? That's how I'd prefer it. But if we know in advance we can cope with it either way.

 

@mark
you are welcome.
The "lesson" would be unnecessary if you have responded me that DS restores the first 32 sectors; and you would have saved me time from testing...
If for you this is a track, is fine by me. But is not the standard terminology used by the hdd manufacturers.
http://www.dewassoc.com/kbase/hard_drives/hard_disk_sector_structures.htm
http://en.wikipedia.org/wiki/Track_(disk_drive)
As for the "...is really 62 usable sectors", it is true but only for the mbr disks, since the first track is used for the mbr; but for the gpt disks, only 31 are really usable.

PLoP bootmanager, for example, use all the 63 sectors.
-----------------------------------------------------
Anyway, back to the question/testbed of Aaron.
https://www.wilderssecurity.com/showpost.php?p=1829381&postcount=53
The answer is yes. 100% successful restore with any imaging program that supports raw imaging on unlocked drives, except for the current snapshot that can be corrupted (if the program supports locking and taking a raw is better, since all the snapshot even the current will be fine).

RBRx occupies the following sectors:
LBA-0 RBRx MBR
LBA-22 Original mbr
LBA-23 Backup of RBRx MBR

You can either backup those from windows with a hex editor that allows direct access, e.g. winhex, or from outside windows with BOOTICE and backing up 24 sectors. And this is a one time deal (I was wrong previously). Those 3 sectors remain unchanged even when the RBRx baseline shield is updated.

Panagiotis

 

From Tom Ehlert (re Drive Snapshot v1.4):

Aaron

PS... Can we please get back to the subject of Rollback Rx & Hot Imaging.

 

Then it has a bug, because (when run from within windows) both "Restore MBR" and "Restore Partition Structure" always restore the first 32 sectors; "Restore Partition Structure" also restores the extended boot records, when an extended partition is present, but does not restore the entire track 0.

Panagiotis

 

I had option in there to repair the first 446 bytes of a XP/2000/2003 MBR. This left the partition table and disk signature unchanged. I didn't have that feature because at the time there were enough features in there already, and wouldn't want to start changing partitions, once a established regular backup plan in place. Disk signatures are a big deal now, and GPT is using them.

To update 446 bytes+signature+rest of track, would of meant 3 commands and hadn't any need for it at the time. Now that Vista, Windows 7 is established. DriveSnap needs badly updating, and i will update it with the type of feature you mention.

There is a DOS restore option in DS that is not mentioned on the website or help, which replaces MBR but not ptable, it's /MBR. to do the whole MBR it's /MBRALL.

 

Never saw your post until after, in the meantime you had done a quick test. If you see, I never even mentioned track in the first place. I said DS images from sector 0. I didn't go into details but as i said later it 62 available sectors that can be used. My focus has been on Rollback at moment.

No not a full track of course but glad you called me up on it. In fact even some techys wrongly used to call it the first head. Glad to see members, better informed these days .

 

Aaron. I did some testing with Rollback first time in a long long time. I backup in Windows and restore in WinPE, to see all snapshots back working . I can restore back and forth between the snapshots fine.

This is what i did for my testing.

After base line snapshot taken, which i keep as default 1. I create a folder called 2 on system c and fill it with 50GB of data of various files and take a snapshot, calling it 2. I then create another folder of large files and call it 3, then take another snapshot and so on. Until i have 6 different snapshots, 6 folders full of data at different timelines. I flick, reboot between the snapshots to check there working fine. I then take a full sector(RAW) backup with IFW in Windows 7 and Windows XP(seperate testing). I then boot into WinPE and zero every single byte, which includes the entire first 63 sectors of the system partition. I then restore with IFW, boot up first time with all snapshots in place. It boots into the same snapshot i was in, just before i backed up. I can restore any snapshot. I restore to snapshot 3 and just folders 2 and 3 are there. I restore to snapshot 5 and just 2-3-4-5 folders, files are there. This is all correct and all files are working. It looks to be perfect, like i never used restore. Wonderful. During the tests the defragmenter ran a couple of times from the boot console.

Can you say that is a fair test?

I will do a similar test with Drive Snapshot, this time with more data.

PS. Don't try to copy this, as it will not work for you.

 

Mark, yes that was a very good and objective test that you did. I just have the following question and comments:

1. You say you used IFW from a WinPE to restore your IFW image. How did you manage to get IFW to work from WinPE?

2. I will be extremely interested in whether or not you are able to reproduce those good results using DS!

3. Rest assured that I will not attempt to reproduce your results until you make me aware of the exact procedure!

Aaron