Macrium Reflect

Yes, I did have it right. However to me what is NOT clear is this.
I understand that I do a Full Image. Then I can run DIFF's as often as I want. However, as I understand it I have the full image and the ever increasing diff size file, but still it is only 1 diff. My concern is if I have the full image and have done 10 diffs, I know I still have the one bigger and bigger diff, but can I go back during a restore and select a DATE to go back to in this one diff? For extra credit can we mount the diff and select a time to go back and get 1 file?

 

It's b-a-c-k! Dammit! Once again I'm seeing RunOnce commands for the Macrium ReflectMonitor utility under [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] in my Windows registry. That makes two RunOnce commands I seen for it now:

"Application Restart #0"="C:\\Program Files\\Macrium\\Common\\ReflectMonitor.exe /RestartByRestartManager:BFE3BC9B-630E-484a-A556-06056A42540E /RestartByRestartManager:B0F3B651-F18E-4c0d-B7A8-74564AF1EF26 /RestartByRestartManager:25CC7829-1FE6-4598-B2C3-9C83259CDB9B /RestartByRestartManager:045BC033-4E0D-4403-837D-499E28EFE138"

"Application Restart #1"="C:\\Program Files\\Macrium\\Common\\ReflectMonitor.exe /RestartByRestartManager:30A6A7F8-6767-46ac-8EB6-0C648D5B7913 /RestartByRestartManager: 319D470D-991F-4076-BC04-61D356355EDC /RestartByRestartManager: DC278043-C06D-45fa-8E4D-70C74E5D74F1 /RestartByRestartManager:484A9827-D79C-46f4-92DF-4A9412DC0FB8"

In neither case was the Reflect application invoked or running at any time during the Windows session in which those RunOnce commands showed up in my HKCU registry hive for no apparent reason. So I have no explanation for why they appeared there nor for what purpose. If anyone else does, I'd be grateful for any relevant information about it.

 

No, you didn't "have it right" I'm sorry to say. Contrary to how you "understand it", running multiple differential backups does NOT result in "one bigger and bigger diff" backup image. Multiple differential backup operations result in multiple differential backup images any one of which can be restored in order to revert the target of the restoration to the same status as it was at the precise time that particular image was created. Same for incremental backups provided the complete incremental 'chain' remains intact within the backup set.

I don't know where your misunderstanding of Reflect comes from (not from anything I've said, I hope) but you would do yourself a huge favour if you'd just avoid all such groundless self-troubling speculation about how things work. Simply read the information provided in the Reflect User Guide carefully, follow its instructions exactly as written, and you'll see for yourself that the results are precisely as they are explained there in great detail.

 

Sorry, but my questions come from the Manual! I understood that you create a full image as I always do. Then each DIFf gets bigger and bigger until you just create a new full image and start over. So, I asked if the diff can get you to a previous save of that 1 growing diff. I had thought that each DIFF would add to the existing diff. An INC, however will create separate INC's so you can go back in time provided that you have the full image and the INC's up to then. Where am I wrong?

I was going to copy paste from the pdf but can't. I guess my understanding IS wrong if a diff is NOT added to but is created new. In other words, I have the full image. Then a DIFF each day creates a NEW diff for that day and does not add to the existing DIFF. That makes sense as to how we can go back in time but the Manual made it seem, to me, that only 1 ever increasing DIFF was created...not a new one each time I did a DIFF.

So, do I have it correct now?

 

You are not alone.
Right after upgrading to the Fall Creators Update i can see a similar entry for one of my security applications.
I am monitoring the registry and such an entry is being created (in my case it is created by the process C:\Windows\System32\csrss.exe) right before the PC is rebooting or while it is shutting down...
I don't know why this is happening, but i know for sure that it began after i have upgraded to the Fall Creators Update.

 

@MPSAN maybe this picture will help you:



Image with 00-00 is FULL
Images 03-03, 10-10 and 17-17 are DIFFERENTIAL
All others are INCREMENTAL
You can restore whichever you want as long as you have whole chain to specific backup image.

EDIT:
About restore:
if you want to restore 02-02, you need 00-00, 01-01 and 02-02
if you want to restore 14-14, you need 00-00,10-10,11-11,12-12,13-13 and 14-14
and so on...

 

More or less,,,,,,,,,, to summarize,,,,,,,

The differentials once they are created do not change. Each new differential is bigger than the last because it has to account for more data being incorporated into it (its adding the data created since the previous differential - if you do not use your PC between differentials the increase in size will be minimal, if you do a lot of work the increase in size of the differential will be greater).

Also, you can mount any diff or full as a virtual drive so as to access specific files (copy and move to C: drive or open etc).

You might want to do a google search of differentials . Once you fully understand how differentials work you should be clear as to this aspect of Macrium Reflect.

I hope this helps.

 

No, sorry, they don't come from anything that the manual actually says. Nowhere does the Reflect User Guide say that any one differential backup image "gets bigger and bigger until you just create a new full image and start over." It does say (as I have also said) that differential backup images (i.e., each and every one of them) will capture and store all of the changes that have been made to the imaged file system since the last full image. And, for exactly that reason, it also says that only one differential backup image is required together with the full backup image in order to fully restore the system to the state it was in at the time that particular differential backup was created. But there is no implication at all that only one of them is or can be created and that one just keeps on growing. You're reading or inferring things that just aren't there. In fact, it also says quite clearly and specifically that "subsequent differentials [plural] can be taken."

I really don't know if you have it correct now. I sincerely hope so. I've tried more than once to explain it to you as clearly as I know how and I've referred you to the most authoritative source on the subject that I know about. If that's not enough, I would urge you once again to just try a few things for yourself. Creating some backups of your own for testing purposes isn't going to hurt your machine in any way and you'll learn more more quickly through just a little direct experience than by agonizing over and asking countless questions about every speculative possibility imaginable.

 

Thanks, @mood . It's somewhat comforting at least to know that it's not some peculiarity of my own setup. I'm beginning to wonder if it might be some kind of compatibility adjustment initiated by Windows itself as I updated the Windows 10 installation to v1709 at about the same time. Thanks again.

 

OK, I believe I have it now. Mini's pic is a great help and I am sorry if ARVY thinks I can not read. We are all good at something, and sometimes we read something into a manual that is not meant to be taken that way. It does not mean we can't learn. I just thought it was saying that the diff would grow. Yes, I understood that but somehow I just read into it that the 1 diff would grow. Sorry for everyone's time!

 

Yes, I believe I have it now and my only issue was thinking that ONE Diff would grow and that another diff was not being created.

 

Thanks to @puff-m-d.

I tested with MR v6 Home v6.3.1835 and I have no BSOD issue. Looks like another reason for me to stay away from V7.

 

Hello @paulderdash,

You are most welcome ...

In all fairness to Macrium, the actual issue was with a BETA version of HitmanPro.Alert, not with Reflect itself. See the post here: HitmanPro.Alert BETA. Macrium Support was very quick to respond to my support request with troubleshooting tips to help me isolate the issue.

 

Point taken. But the HMPA issue appears not to affect MR V6.

 

Unexpected behaviour from an MR incremental restore ...

All my MR backups are full disk backups.

I wanted to do some partition work with @Brian K, and took an incremental backup (within my GFS scheme) beforehand. See https://www.wilderssecurity.com/threads/how-to-clean-up-redundant-partitions-on-system-drive.397518/

The partition work did not go as expected, so I restored the incremental, but it did not retore my disk to the prior partition config, but I ended up with some sort of 'hybrid'.

However, a slightly earlier differential backup restore did exactly what was expected.

Mystified.

Edit: I also tried a full AOMEI disk restore, which looked OK, but when I tried to image that I got an Error code 6 - MFT corrupt. I then did the MR differential restore and all seems as before, and OK.

 

The MR incremental backup was a full disk backup (as are all my my MR image backups).

I remember your comments on AOMEI disk vs system restores. In my case the disk backup restore was bootable, but I noticed two funnies 1) Some folders added to Libraries were lost 2) MR image of AOMEI restored image gave MFT corruption error, and don't have an additional system backup. I hadn't ever really tested AOMEI restores before, but now I don't really trust AOMEI (Pro), and even have questions around MR incremental after partition work, as stated earlier, so I may look at buying latest Terabyte stuff.

(I also have Acronis 2017, but I am not sure if I defined that to be whole disk or just system partition, and didn't try restoring that).

 

@paulderdash -- When creating MR backup task definitions or when running MR backups manually, selecting the correct Reflect operational option on the initial UI screen is critically important. Inadvertently selecting the 'Create an image of the partition(s) required to backup and restore Windows' option instead of the 'Image selected disks on this computer' option is easy to do unintentionally. And if you do, Reflect will override the selection of drives and partitions you choose yourself on that same UI screen and substitute its own selection of what it thinks is essential. Depending on your current partitioning set-up, Relect's own selections in that case won't always be all-inclusive of everything that you would have chosen yourself.

Not saying that's what actually happened in your case, but it's certainly a possibility that needs to be kept in mind.

__
P.S.: If a backup image (regardless of type) that included only some partitions were restored to a drive with partitions additional to those included in that image, that could certainly cause some unexpectedly mixed results.

 

Maybe I should set up my GFS task definition again.

 

You very definitely should if any changes at all are made to partitioning of the drive that is being backed up. All of Reflect's backup task definitions rely on numerically ordered partition specifications for choosing which ones are included. And both incrementals and differentials can only work when they match up to the original full in that respect and others. That's what the warning about W10's additional WinRE partition was about.

 

I will make sure that I select 'Image selected disks on this computer'.

I was pretty sure that is how it is now, but I'll start again to make sure.

 

i have been restoring macrium incrementals for years, never had any problems. did it monday when i had what i hope is my last volsnap.sys error and it got into the endless repair cycle. luckily the current 17025 rs4 build fixed the problem (i hope). took two and a bit minutes to restore the incremental system disk partitions on my ssd. did a full backup of the new os build. took 25 minutes. my fulls are about 45gb, the incrementals about 10gb and take just a couple minutes every night (i do a full every friday). if you do FILE backups instead of disk images, a restore will not restore any system files and you will likely have a mixed result. if you select partitions yourself, as noted above, you also take a risk of not backing up all of them, the way windows works with uefi, you may have hidden partitons with stuff in them you need. i also always use changed block tracking and delta indexing since they were added. i haven't made a microsoft backup in years either. waste of time. same with restore points. for me at least. macrium is miles better.

 

I only do image (not file) backups, and intend to select full disk every time.

I also have never had issues restoring from incrementals, but then usually only C: changes, the position or content of other partitions, like Win RE partitions don't change so that would explain it.

In this case those did change and I had unexpected results.

But I will redefine my GFS scheme and make doubly sure all is correct.

 

You're probably right about that, but it's wise to recreate the task definition anyhow in view of the various attempts to modify the drive's partitioning layout. Any changes will prevent any new differentials (or incrementals) based on the existing full backup image, and so you'll almost certainly need to create a new full backup before the GFS plan can resume its previous pattern.