Macrium Reflect

Discussion in 'backup, imaging & disk mgmt' started by Stigg, Nov 23, 2013.

  1. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    Bug fixes and Improvements v7.2.4744 - 18th February 2020

    • Alternative Locations
      The 'Alternative Locations' functionality could fail to work as expected and attempt to append to backup sets from the alternative location even if the primary location was available. This has been resolved.
      Note: When a backup runs, If the location contains an orphaned delta Incremental then the text '.error_loading' will be appended to the orphaned file name and the backup will continue. This will be indicated in the backup log as a warning.
     
  2. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    5,614
    Location:
    Milan and Seoul
    Thanks. No issues here.
     
  3. Bellzemos

    Bellzemos Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    219
    Hi,

    I have a bit of an off topic question. I am selling a laptop with a SSD as the system disk, running Windows 10 Pro OS. The buyer would like to use some special software that I was using so I'm leaving that on, intact, together with Windows, drivers etc. Now, I would like to wipe the SSD so that he won't be able to recover any of my deleted data files. I have deleted my files, then run Windows' own "Optimize" (trim) on the drive, but was afterwards still able to recover some files using Recuva's Deep scan.

    So, the question, should I use CCleaner's Wipe Free Space on the SSD or rather make a Macrium disk image (the Intelligent Sector Copy variant of course, so that it won't copy the delted fragments/files), then wipe the SSD properly (I would try the Parted Magic Eraser) and then recover the disk image back onto the SSD? How would you apporach this task?

    Thank you.
     
  4. TheRollbackFrog

    TheRollbackFrog Imaging Specialist

    Joined:
    Mar 1, 2011
    Posts:
    4,943
    Location:
    The Pond - USA
    First of all, I'm very surprised that RECUVA (or any other recovery tool) can find any of the file content that you have deleted under Windows 10 (the TRIM process can take a few minutes on some Systems)... something seems amiss there.

    Regardless, a REFLECT intelligent sector copy followed by a Parted Magic SECURE ERASE will surely blow that SSD away. Follow that with a simple blank disk recovery and you should be just fine.

    ...and remember, the SECURE ERASE function on Parted Magic will stop at a certain point and not let you select anything until you put the laptop to SLEEP followed by a WAKE UP... then all selections will be active.
     
  5. jphughan

    jphughan Registered Member

    Joined:
    May 3, 2018
    Posts:
    913
    Location:
    US
    I would never want to use a system from someone else without wiping it just in case there was malware on it, whether the original owner knew about it or not. Can you not just provide the software installer so you they can perform a clean Windows install and still use that software?

    If that's not an option, then yes if I were in your situation I'd capture a backup of your system, run a full wipe utility, and then restore the image. Another option since you have Windows 10 Pro system would be to enable BitLocker (make sure to choose the option to encrypt the entire drive, not just used space) and then turn it back off. At that point, virtually every sector of your SSD will have been overwritten due to the encryption and decryption process. Technically you won't have caught EVERYTHING though, because BitLocker wouldn't act on the sectors allocated to the hidden partitions on your disk, and due to SSD wear leveling, in theory the SSD might have written your old data to one flash cell originally but then directed the encryption/decryption writes of that logical sector to a different physical flash cell, leaving the old data intact in the original cell. But that's not something tools like Recuva would ever recover, because at that point the SSD would also have remapped that logical drive sector over to the new cell, so reading that original cell's data would require a tool that could dump the raw contents of the SSD flash cells, bypassing its logical sector to physical flash cell mapping.
     
    Last edited: Feb 21, 2020
  6. Bellzemos

    Bellzemos Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    219
    I think I'll go with a disk image, secure erase the SSD and then restore the image back on it. Maybe I'll try the CCleaner Wipe free space or Heidi Eraser first, if I'll find the time. Thank you both.
     
  7. WinterKnight

    WinterKnight Registered Member

    Joined:
    Oct 30, 2017
    Posts:
    108
    Location:
    USA
    Will Macrium Reflect work normally on laptops with Intel Optane Memory? Last year I saw some posts in the Macrium forum about problems related to Optane memory, and I was wondering if those issues have been resolved.
     
  8. jphughan

    jphughan Registered Member

    Joined:
    May 3, 2018
    Posts:
    913
    Location:
    US
    I'd make sure your Rescue Media has whatever drivers are appropriate to allow it to recognize the Optane device as a single drive rather than as separate components, but as long as you have that I don't see why it wouldn't work properly. Windows Setup runs on WinPE just like Rescue Media, and if those drivers allow you to install Windows onto an Optane device, I don't see why they wouldn't also allow Reflect to back up and restore that device. Maybe the issue was (is?) that Rescue Media Builder doesn't automatically detect the need to add an Optane driver? I'm not sure since I don't have an Optane system, but drivers can be added to a Rescue Media build manually.
     
  9. Bellzemos

    Bellzemos Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    219
    So, that was interesting... And disappointing. I made a disk image with Reflect first. Then I used CCleaner's Wipe Free Space which took a while but was afterwards still able to recover some files using Recuva - way less than after only issuing the Optimize (Trim) command.

    So I then used Parted Magic and did the Secure Erase. Tried booting the laptop just to see and there was no bootable source found - SSD erased. So then I restored the Reflect image back on to the drive, BUT - after running Recuva on this newly restored image on my securely erased SSD - Recuva found a lot of my deleted files, way more than after I run CCleaner's Wipe Free Space.

    I don't know it that means that the Secure Erase didn't do it's job or that Reflect imaged deleted files as well when imaging the file system. I find both very weird.

    I will run the Secure Erase on the SSD again and then install Windows 10 anew just so I can then run Recuva and see what's up, but I don't have any more time for this today...
     
  10. TheRollbackFrog

    TheRollbackFrog Imaging Specialist

    Joined:
    Mar 1, 2011
    Posts:
    4,943
    Location:
    The Pond - USA
    SECURE ERASE, by definition and specification, will drop an internal voltage to all of the NAND blocks of an SSD causing a complete erase of that disk... that's why it only takes a few seconds for the complete ERASE operation. Wipe Free Space operations (CCleaner, etc.) do nothing more than add additional unnecessary DATA WRITE operations to the SSD.

    Your "funny" files are in the REFLECT image. Are you sure you emptied your TRASH prior to imaging... files in the TRASH will always be available. And you might wanna take a look at some of the "content" of those so called recovered files... you may be surprised.
     
  11. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,126
    Location:
    U.S.A. (South)

    All these many years I thought I was the only user of Parted Magic.
    Guess eventually all these type of obscure programs get found and discovered how useful they really are.
     
  12. Bellzemos

    Bellzemos Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    219
    I think so too (deleted files being imaged - and not Secure Delete failing it's job) - but why? Yes, I don't even keep files in thrash, I empty the bin right after deletion of file(s)/folder(s). The state of a lot of deleted files in Recuva is shown as "excellent" and I was able to recover and open them. Word files, pics etc., fully restored and usable.
     
  13. jphughan

    jphughan Registered Member

    Joined:
    May 3, 2018
    Posts:
    913
    Location:
    US
    The way I've always seen Secure Erase's operation described has been that SSDs that support it always have hardware-level encryption running, even if they operate normally by storing the decryption key in the clear (unless you actually choose to enable their hardware-level encryption) and therefore Secure Erase simply forcibly overwrites the portion of the SSD that stores that decryption key beyond any possibility of recovery, instantly rendering the rest of the data unreadable.
     
  14. jphughan

    jphughan Registered Member

    Joined:
    May 3, 2018
    Posts:
    913
    Location:
    US
    When you captured the backup, did you use the "exact copy" mode instead of the default "intelligent sector copy"? If so, that would absolutely account for deleted data still being contained in an image, and the ability to retrieve such data is one of the express use cases of exact copy mode, in order to aid in forensics situations. Otherwise, I'm not entirely sure how to account for this outcome, and it's not what I would have predicted would happen, but my only guess is that somehow the NTFS file system and therefore Reflect's intelligent sector copy mechanism kept some sectors containing deleted data flagged as still being used for actual data at least for a while, which then caused Reflect to include those sectors in its backup even when using the intelligent sector copy mode.
     
  15. Bellzemos

    Bellzemos Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    219
    Absolutely not, I used the default Intelligent Sector Copy. I will probably look more into this over the weekend as I'm too busy now. But yes, I find it very weird.
     
  16. JohnBurns

    JohnBurns Registered Member

    Joined:
    Jul 4, 2004
    Posts:
    778
    Location:
    Oklahoma City
    Yes! MR is the only one I can find that does. It actually adds the driver for RST automatically now. FYI, my setup is:Acer Aspire TC-885-ACCFLi5O Desktop, 8th Gen Intel Core i5-8400, 8GB DDR4 + 16GB Optane Memory, 1TB HDD and MR works great on this config.
     
  17. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,881
    Location:
    Slovenia, EU
    Does anybody know if there is a way to identify which files are included in specific incremental backup file?
    Today I got large incremental backup file and want to figure out what caused it. Thanks in advance.
     
  18. jphughan

    jphughan Registered Member

    Joined:
    May 3, 2018
    Posts:
    913
    Location:
    US
    If it's an image backup and it's already been created, your best bet would be to mount the Incremental and the immediately previous backup at the same time and then use a file/folder comparison utility to show you the differences between those two versions of the original source data. I use WinMerge since its comparison method and results display can be configured in a variety of ways to suit different use cases, and it's free.

    You could also try something like TreeSize Free that just maps out a folder or drive to show you what's taking up space. You might find a significant discrepancy right away at a high level and could then drill down into subfolders to find which file(s) became significantly larger. But if the Incremental is large because a lot of files CHANGED rather than a net consumption increase having occurred, this won't work as well.
     
    Last edited: Feb 27, 2020
  19. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,623
    Location:
    USA
    It might seem overly simplistic but you could mount that incremental and open a file search utility and sort by modified date.
     
  20. jphughan

    jphughan Registered Member

    Joined:
    May 3, 2018
    Posts:
    913
    Location:
    US
    If you want to go this route, I can give you a line of PowerShell script that would say, "Show me all files with a Date Modified timestamp within the last X days" if you'd like.
     
  21. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,881
    Location:
    Slovenia, EU
    Thank you both for suggestions. I did something similar and found out it was Apps that got updated last night. Of course I disabled that option and removed most of them, since I don't use them anyway.

    But purely looking at Macrium image file I guess that there is no option to find out what exactly is stored in Differential or Incremental backup?
     
  22. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,638
    Minimalist,
    Not the answer you were looking for (I know, sorry), but if you would frequently run a file-integrity-checker like ADinf32, you would know which files were changed. It is not free, but it is cheap. I've posted several times about it; see here. Anyways, sorry for getting here off topic!
     
  23. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,881
    Location:
    Slovenia, EU
    Thnx FanJ for your suggestion.
    As you said I would probably have to run it fequently, since I wouldn't know when potential changes to system drive will happen. Since monitoring changes is not that important to me ( except in this specific occasion :) ) I will skip it for now.

    Thank you for your suggestion, nevertheless.
     
  24. jphughan

    jphughan Registered Member

    Joined:
    May 3, 2018
    Posts:
    913
    Location:
    US
    For image backups, there’s a registry setting you can enable that will cause Reflect to log all the files that have changes that required backing up, but Macrium warns that it severely reduces performance because of all of those reverse lookups to map data blocks to files. I’d have to try to find that post if you wanted it, but I remember seeing it at one point.

    For File & Folder backups, logs for files that were backed up and files that were deleted are generated automatically because that backup is a file-level operation anyway.
     
  25. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    23,933
    Location:
    UK
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.