Can ATI save *physical* images?

Discussion in 'Acronis True Image Product Line' started by Vanguard, Sep 14, 2005.

Thread Status:
Not open for further replies.
  1. Vanguard

    Vanguard Registered Member

    Joined:
    Aug 27, 2003
    Posts:
    69
    Can True Image read sector-by-sector a partition and save it that way (i.e., a physical image)? Or does it only save a logical image by having to read through the file system of the OS?

    I'd like to find out if True Image can save a physical image. That means:

    - No OS is running in the system that was started from the hard drive or any partitions within it. Only the boot media's OS is running and is NOT associated or dependent on *anything* in any of the hard drive's partitions.

    - The physical image program doesn't give a gnat's fart about what OS is installed because that OS is *never* loaded during the image save process.

    - The physical image program doesn't care what file system is used (FAT, NTFS, HPFS, Mac, whatever) because it doesn't use any OS, even its own on bootup, to read through that file system. That means ALL file systems are supported because NO file system is ever used.

    The image program simply reads every byte in a sector and saves a [compressed] record on the sector(s). Compression may extend across multiple sectors to provide maximum compression, like for unused sectors. Only sectors within a partition are saved, not those that are unallocated (but may also be an option to include unallocated sectors). The image program, like the BIOS, merely reads the partition table from the MBR to find the offset to a partition and its length and saves those sectors, hopefully compressed to reduce the number of media or free space needed for the backup device.

    From I read of True Image's imaging, it seems dependent on the OS, the file system, and perhaps even what is resident in memory for other processes. I'd like to make exact physical images of my partitions (or the entire drive if only 1 partition is present or include all partitions in the saved image if there is more than 1 partition). Obviously I would have to use bootable media and an OS runs from there to load and execute the imaging program, but it never delves into what OS or file system is used within the hard drive's partition because it reads that partition sector-by-sector (i.e., at a hardware level rather than through an OS). I wouldn't matter which OS is in a partition, which file system was used, if it was corrupted, if it was empty, if it was a hidden partition only containing data and there are no OS partitions anywhere in the host. It just reads and saves the sectors within a partition.

    I like many of the features of Acronis. It seems oriented as a logical imaging program. Does it also have a component that permits using it only as a *physical* imaging program? This might similar to many drive-to-drive cloning programs but instead an image file is saved for later restore, and with compression the image would be smaller than having to clone the drive to another drive, and I would get more choices on what type of media on which to store the images. ATI has its Drive Clone tool but that is described as cloning drives, not for saving physical images of the drive, and cloning probably won't use compression because it isn't saving an image file but instead writing the non-compressed bytes to another drive or partition. There are lots of nifty features available in ATI for logical imaging, but I also require a physical imager. Can I use their Drive Clone tool to save an image rather than just write to another drive to clone to it, and can that image be compressed, and can it be used for restores?

    Oh, one more question, is the first backup media, like for CD-R or DVD-R, bootable and loads the restore program? That way, I can just use the backup media to perform a restore rather than hunt around or remember to lug along the installation media or separate bootable discs.
     
  2. Menorcaman

    Menorcaman Retired Moderator

    Joined:
    Aug 19, 2004
    Posts:
    4,661
    Location:
    Menorca (Balearic Islands) Spain
    Hello Vanguard,

    True Image uses a sector based imaging mechanism that doesn't care about files or folders. Images can be created either whilst still in Windows (this <Acronis technical article> explains how this is achieved) or after booting into the standalone, Linux based, rescue environment. In image can be stored on a variety of media as a compressed or uncompressed file.

    Note that True Image also incorporates an entirely separate, sector based, drive-to-drive cloning feature.

    No, the removable backup media created by TI isn't bootable. However, either of the three methods detailed in this previous thread titled <How to Create Bootable Rescue DVD(s):> provide a suitable workaround.

    Regards
     
  3. Vanguard

    Vanguard Registered Member

    Joined:
    Aug 27, 2003
    Posts:
    69
    Thanks for the info. One of the reasons that I asked was when EFS (Encryption File System) is used. Drive Image reads sectors, too, for saving its image fileset. That way, on a restore, the EFS certificate that was created in that instance of Windows is still there and the EFS-encrypted files are still usabled. With Ghost (before Symantec bought Powerquest and now uses the DI engine), the default was to save logical image filesets. The image would save okay but restores would fail on EFS-encrypted files. The EFS certificate was either not yet installed or it didn't matter since the OS wasn't up and running yet to handle the EFS-encrypted files, and Ghost doesn't know anything about the EFS certificate, either. So a restore would fail on the EFS-encrypted files.

    Symantec's "solution" was that I remove EFS from every file before saving the image and then restore EFS on all those files. No thanks, that solution sucks, it is manual, it is error prone, and causes a large delay in getting the image saved and obviously wouldn't work for scheduled image saves. The other solution was to use the /IA command-line switch to force Ghost to save a physical image rather than a logical one. However, when doing physical images using Ghost, it consumed far more backup media than did Drive Image.

    It sounds like Acronis can save physical images. Does it save a physical image everytime, or only when running it outside of the OS? I'm wondering if TI is ran while Windows is up if maybe it isn't using the file system and saving logical images at that time, and the only way to save a physical image would be to reboot, use the bootable TI disc, and never load the OS, and then save the image.

    Thanks for the info.
     
  4. Menorcaman

    Menorcaman Retired Moderator

    Joined:
    Aug 19, 2004
    Posts:
    4,661
    Location:
    Menorca (Balearic Islands) Spain
    Hi Vanguard,

    When I said that TI uses a sector based imaging mechanism, I should have been more precise and said it uses an in-use sector based imaging mechanism. True Image only falls back to true sector-by-sector imaging if it can't recognise the file system or the hard drive is corrupt. Check out this previous thread titled <Password and encryption, TI and encrypted harddisks> for Acronis Support's position regarding encrypted disks.

    Sorry I can't provide a more positive answer as I have never used TI to backup or restore an EFS protected hard drive.

    Regards
     
  5. Vanguard

    Vanguard Registered Member

    Joined:
    Aug 27, 2003
    Posts:
    69
    I'm not using DriveCrypt, SafeBoot, or other disk-based encryption software. I know Safeboot allows chaining of multiple MBR boot programs and would thus probably still be compatible with TI's recovery manager boot program, but anything else that wants to use the 160-byte MBR bootstrap program area in sector 0 of track 0 would result in a conflict.

    I'm not encrypting the disk. I encrypt some files. EFS, like CDFS, is an installable file system and you need to generate a security certificate to use with it (so you can transport it or import it later after a recovery). Ghost's problem was that it was reading the files, by default, through the file system (which would include EFS) to save the files into its image fileset. It did a logical file image. However, on a restore, EFS files couldn't be read by Ghost so it failed to retrieve those EFS-encrypted files. I remember hitting the problem back in Ghost 7 but only vaguely remember it was still a problem in Ghost 8, and Ghost 9 dumped the old code and usurped the Drive Image engine that they got by buying out Powerquest. Drive Image did physical image saves and so it never had a problem with EFS-encrypted files.

    EFS is a file-based encryption scheme, not a disk-based scheme. If I forced Ghost to do a physical image using its /IA command-line switch then its physical restore worked okay since nothing of the OS was required to write a sector. Drive Image worked because it read and wrote sectors, not files. Although True Image appears to run under Windows (that's one way) and save images, presumably it reads and writes sectors instead of files. It may also use the file system to determine which clusters are allocated and hence which sectors are used or free (so it doesn't waste time to save the contents of unused sectors). I don't remember how Drive Image did the same thing where it would excluded unused sectors. It's been too long since looking at hardware formatting of hard disks to remember if there is a signature byte at the beginning of a sector to denote whether or not it is used within whatever file system is employed.

    The potential problem that I see is that a sector that was unused before might become used later while True Image is still running since Windows and applications are still running, and the same for sectors that were used and become unused during the image creation. That's why I've never ran an software imager while the OS is still running that access that partition. I want to make sure all sectors are quiescent (i.e., not altered) while creating the image. I supposed TI could freeze the OS during the image save but then there would be no advantage to running TI under Windows rather than just reboot using bootable media to run TI. When I was investigating Terabyte's Image for Windows (which needs its PhyLok plug-in to work), I was pretty much sure that I would instead be using the included Image for DOS software to use bootable media to save an image while the OS was not running at all.
     
  6. Vanguard

    Vanguard Registered Member

    Joined:
    Aug 27, 2003
    Posts:
    69
    I just read the thread using the link you provided to see the discussion on using TI on disk-based encryption setups. EFS, which is a file-based encryption scheme, should not present a problem as long as TI is reading sectors instead of files. Whether TI uses true sector-by-sector and in-use sector-by-sector reading and writing, it is still reading and writing by sector. It would only be if TI read and wrote by files would there be a problem with EFS.

    "We regret to inform you that you can create sector-by-sector image only in case your hard drive is corrupted or the file system is unknown for Acronis True Image. Current version of Acronis True Image doesn't allow you to use this mode in other cases."

    Well, that sucks. This should've been an option a long time ago, at the point of deciding to do sector read/writes instead of file read/writes. So I'm not sure that TI even does sector reading and writing when it is ran under Windows or even if booted separately for a partition using a known file system that it supports. Sure sounds like TI is saving *logical* images by reading through the file system rather than reading sectors. About a year ago, I remember discussing different imagers and some TI users were having problems on restores that would NOT be a problem if TI had actually saved *physical* images (by sectors) rather than logical images (by files).
     
    Last edited: Sep 16, 2005
  7. Greyhair

    Greyhair Registered Member

    Joined:
    Oct 9, 2004
    Posts:
    50
    Location:
    Boston
    Hi Menorcaman,

    I've been following this thread with great interest. Could you explain the difference between an "in use sector based mechanism" and "true sector-by-sector imaging"

    I don't have a problem, I'm just curious.

    Thanks in advance.
     
  8. Menorcaman

    Menorcaman Retired Moderator

    Joined:
    Aug 19, 2004
    Posts:
    4,661
    Location:
    Menorca (Balearic Islands) Spain
    Hi Dan,

    Hopefully Acronis Support or someone else will chip in here if I'm wrong but my understanding is that TI's sector-by-sector mode copies all sectors (be they good or bad) into the image, along with their respective sector addresses. Hence the reason sector-by-sector imaging takes a long time. I guess a restored drive will end up with the same sector layout as the source drive.

    Regards
     
  9. Greyhair

    Greyhair Registered Member

    Joined:
    Oct 9, 2004
    Posts:
    50
    Location:
    Boston
    Hi Menorcaman,

    Many thanks!

    Dan
     
  10. Acronis Support

    Acronis Support Acronis Support Staff

    Joined:
    Apr 28, 2004
    Posts:
    25,885
    Hello Vanguard,

    Thank you for your interest in Acronis Disk Backup Software.

    Menorcaman is correct. Acronis True Image 8.0 uses two basic approaches when creating an image. One method is for supported file systems and structures and another for unsupported or corrupted ones.

    I'm afraid that the current version of Acronis True Image does not allow you to select which method to use, since it chooses the appropriate method automatically.

    The reason for doing so is that the sector-by-sector method allows you to create an image of all sectors of the selected disk\partition. This image will contain not only sectors with data but also sectors that are free. As a result, this image will be equal in size to the disk being imaged, as there is no data compression. The image creation process will also take much more time in this case. This method is useful only if a partition being backed up is not supported by Acronis True Image 9.0 or corrupted. In this case, all sectors of this partition are included in this image and will be restored.

    In case the file system is supported and contains no errors, Acronis True Image 8.0 images only the actual data according to the file system structure. This takes much less time and allows to decrease the size of the resulting image archive.

    The ability to manually select which method to use will probably be implemented in the future versions of Acronis True Image, but exact time frame for this is not decided yet.

    Please also note that if you want us to change the behaviour of Acronis True Image in any way or add some new features to this product, please feel free to post any of your suggestions in Acronis True Image WISH-LIST thread.

    Thank you.
    --
    Alexey Popov
     
    Last edited: Sep 19, 2005
Thread Status:
Not open for further replies.