Capsule or unassigned partition: What's the difference?

Discussion in 'Paragon Drive Backup Product Line' started by VanguardLH, Mar 11, 2015.

  1. VanguardLH

    VanguardLH Registered Member

    Joined:
    Sep 10, 2007
    Posts:
    96
    I'm looking at using Paragon Backup & Recovery 2014 Free on Windows 7 Home. I've been reading the product manual but it really doesn't describe WHAT is the Backup Capsule. Okay, it's a separate partition (which I will put on a 2nd hard drive rather than on the same hard drive as for the OS and apps). It doesn't assign a drive letter; i.e., the partition for the Backup Capsule won't get mounted.

    I can create partitions using Disk Manager (diskmgmt.msc) in Windows or using 3rd party tools. I can format that partition (I'd use NTFS). I do NOT have to assign it a drive letter. That's how partitions are normally hidden by not assigning them a drive letter.

    So what's the difference between PBR 2014 Free creating a partition and hiding it (not assigning a drive letter) and me creating a new [primary] partition and hiding it (not assigning a drive letter)?

    Does PBR 2014 create a partition using a non-standard partition type value (so that partition isn't seen as an NTFS, FAT, or other recognizable partition type) in the MBR's partition table for the partition record for that partition? Does a kernel-level (level 0) driver for PBR prevent access to that partition by any process other than itself? Just what does creating a Backup Capsule partition do other than not assign a drive letter to that partition which I can do with any partitioning software, including what comes in Windows?

    I ask because the destinations for a backup are:
    - Save data to the Backup Capsule
    - Save data to local/network drives.
    - Save data to a physical partition. (*)
    - Save data to FTP locations.
    - Burn the data to CD, DVD, or BD.

    (*) This sounds like a partition that has no drive letter assigned to it.

    If PBR 2014 Free can backup to a physical partition that has no drive letter assigned to it in the OS then it seems this is the same as backing up to the Backup Capsule partition that has no drive letter assigned to it - if not assigning a drive letter is the only effect performed by creating a Backup Capsule.

    In the past when I used Easeus ToDo Workstation, I could define pre- and post-backup commands (not available in their free edition). I assume the same is true with PBR 2014 Free. For the Workstation edition, I defined a .bat (batch) file that would run devcon.exe to enable the 2nd hard disk (the one where backups were stored) and follow with diskpart.exe that would assign a drive letter (so the backup software could find the backup location). The post-command would run a .bat file that ran diskpart.exe to unassign the drive letter to the backup partition on the 2nd HDD and follow with devcon.exe to disable the HDD. So not only did the backup partition normally not have a drive letter assigned to it but the hard disk (device) was disabled to further prevent access. There was a window of opportunity for malware to rename the backup files, delete them, move them, set the hidden file attribute, or encrypt them during the backup when the HDD got enabled by devcon and was assigned a drive letter by diskpart during the backup job. It was still better than leaving my backup location wide open to miscreants, accidental boobs, or most malware.

    I was interested in PBR 2014 Free because of its claimed protection of the backup location. Okay, so besides not assigned the partition a drive letter, what else does the Backup Capsule do to protect the backups? If not assigning a driver letter is all it does, I obviously don't need to create the Backup Capsule since I could have PBR 2014 "Save data to a physical partition" (that also had no drive letter assigned to it).
     
  2. fireworker

    fireworker Registered Member

    Joined:
    Sep 27, 2009
    Posts:
    277
    Location:
    Russia
    Backup Capsule have a specific partition ID, and thereby:
    • You can't assign a letter for this partition in any way.
    • Content in this partition is not available for the OS(es) or third-party applications (eg Easeus).
     
  3. VanguardLH

    VanguardLH Registered Member

    Joined:
    Sep 10, 2007
    Posts:
    96
    Acronis True Image does the same. Its Secure Zone partition has a non-standard partition type value. This usually means the OS and user-mode processes cannot access the drive because a drive letter cannot be assigned to that partition. That does not prevent users from using a partition manager to alter the partition type specified in the partition record in the partition table in the MBR. The Acronis Secure Zone is a FAT32 or NTFS formatted partition. Once the partition type is change from Acronis' non-standard ID to one that designates the partition type as FAT32 or NTFS then the OS and apps can assign a drive letter and access the partition. It's a nice trick, undoable, but helps to protect the backups.

    Easeus ToDo Backup doesn't have that so I used the pre-job command feature to run diskpart.exe to assign a drive letter to the partition, run the backup, and then use a post-job command to run diskpart to unassign the drive letter. Yet that meant the partition was exposed during the backup. Acronis would write directly to the hidden partition without requiring a drive letter be assigned. Hopefully Paragon Backup and Recovery 2014 Free does the same with direct access without drive letter assignment.

    Because I can use software (diskpart, Disk Management, 3rd party partition managers) to assign and unassign drive letters to partitions, I figure malware can do the same. The formatting of a partition can be determined through interrogation so using a non-standard partition type specified in the partition record in the partition table of the MBR doesn't preclude a process from accessing a partition. Drive letters aren't required for partition access other than for programs that required a drive letter, like programs that interface with a user. Volumes can be mounted without a drive letter. Programs can read the content of a partition without it having a drive letter. All depends how the program was designed to provide its access to the partition (or any part of the storage media).

    Because hiding a partition by using a non-standard partition type along with not assigning it a drive letter works most of the time but not all of the time for those determined to get at the content of a partition, I came up with using devcon.exe (a command-line equivalent of Disk Management, diskmgmt.msc, applet) in the batch file (along with diskpart) to better hide the partition. Well, actually that would be to hide entire hard disk. I use a separate hard disk on which there is one single primary partition to store the backups. Disabling the hard disk means nothing can easily get at the backups. With diskpart to assign/unassign a drive letter, with backup programs using a non-standard partition type to thwart typical apps, and along with disabling the device, I'm about as close as I can get to using a removable hard disk in a drive bay; i.e., this is as close as I can figure to eliminating access to the partition and its hard disk as I can get using software to physically extracting or disconnecting the drive from the computer. The problem with physical disconnect is there will no one around to insert or power up the backup drive at the scheduled time for periodic backups. Yeah, a USB drive that you can power down would eliminate malware, like ransomware, from getting your backups but that also bars scheduled backups from using that removable or disconnectable drive.

    So Paragon Backup & Recovery 2014 free will not assign a drive letter to the partition which eliminates most apps from accessing its content. Using a non-standard partition type helps to block many partition managers from putzing with the partition (although such tools still allow overrides, edits, or deletes) or, at least, requires more effort from the user of the partition manager, like knowing to what value to change the partition type record in the partition entry in the partition table. Alas, no backup software that I've seen yet goes so far as also disabling the device. Free backup programs don't provide for pre- and post-job commands to let me use devcon.exe to disable the device. Can't get everything for free.

    Thanks for replying, though.
     
  4. VanguardLH

    VanguardLH Registered Member

    Joined:
    Sep 10, 2007
    Posts:
    96
    Upon further reading of the product manual, there appears another feature of the Backup Capsule feature: the partition is bootable. That is, if I'm reading correctly, the hidden partition (by non-standard partition type and no drive letter but not in disabling the device) contains a boot sector (boot code) for an OS in that partition that runs Paragon Backup & Recovery. This would require either replacement of the MBR's bootstrap code with one designed to permit multi-booting (and where you can pick the Capsule partition from which to boot) or modifying Microsoft's goofy dual-boot feature (you load a bit of Windows after which you can select to boot the rest of it or another OS) by editing boot.ini or BCD to add the Capsule's partition as a bootable OS. For recovery where the OS is quiescent (not loaded), you would elect to boot to the Capsule partition to load its boot sector which has a loader for the OS in that partition (which could then run a specified app on startup).

    Is it correct that the Backup Capsule partition is made bootable and offered as a choice during the computer startup? If so, do they do that by usurping the MBR's bootstrap code or altering boot.ini or BCD of Windows? This would eliminate having to create, have around, and find bootable media (CD, DVD, USB drive) to perform a recovery operation on startup of the computer.
     
  5. fireworker

    fireworker Registered Member

    Joined:
    Sep 27, 2009
    Posts:
    277
    Location:
    Russia
    Absolutely. Backup Capsule = Secure Zone, they use the same ID, so for Acronis - Backup Capsule is available, as for Paragon - Secure Zone. Acronis (long ago) was established by luring a few developers of Paragon.

    Disabling the hard disk seems to me unnecessary precaution.

    The capsule can be made bootable, at its creation, or after creating by editing the parameters of the capsule.
    If the boot disk is MBR-style, the bootstrap code is written to the MBR. Booting to Paragon environment is done by pressing a set key (F1 by default) for a set period of time (default is 5 seconds) before all the menus and operating system. If Paragon environment based on Windows, the BC to menu can be added manually, by editing boot.ini or BCD. If Paragon environment based on Linux, when it start, it inspects all disks including external drives for the presence of Windows, then you can boot to any of the found Windows.

    If the disk is GPT-style, then will be created a separate partition for Paragon environment (on MBR-style disk, is stored directly in the BC). And in the selection menu item is automatically added BC.

    I am sorry for my english
     
  6. VanguardLH

    VanguardLH Registered Member

    Joined:
    Sep 10, 2007
    Posts:
    96
    Although I'm using Windows 7, my computer is too old for UEFI that supports GPT managed media. I only have MBR on this computer; however, I have 2 hard disks. One is split across 2 partitions: OS + apps, and data. The data partition was created expressly to eliminate any of those files from getting included in my scheduled backups of the OS+apps partition. The 2nd HDD is solely for backups. Well, it is now but I suspect I will split it into 2 partitions, too: a small one to hold a portion of the Windows pagefile and perhaps some minor backups, and a huge one for the backup images. So I [will] have:

    HDD1 = C: partition (OS+apps), D: partition (data)
    HDD2 = E: partition (pagefile), no-drive partition (backups)

    HDD1 uses MBR.

    If Paragon usurps the bootstrap code in the MBR of HDD1 then it can get at partitions on HDD2 to boot those (that have a boot loader in their boot sector). If Paragon relies on standard bootstrap code in HDD1's MBR then it cannot boot from any partition on HDD2. The standard bootstrap code relies on finding a partition marked as "active" in the partition table and upon finding one loads the bootloader in that partition's boot sector. Since it is using the partition table to find the active partition, it can find an active partition only on that hard disk. Non-standard bootstrap code can read partition tables on any hard disk to find either one marked as "active" or provide a menu to the user to let them select.

    So while a bootloader might be put into the boot sector of the Backup Capsule's partition that will load the OS in that partition (which then loads Paragon's Backup & Recovery program), something has to load that partition's bootloader. For standard bootstrap code in the MBR, it can only select a partition on the first hard disk selected by the BIOS since the MBR's bootstrap code on the first hard disk is what the dispatcher in the BIOS program will load into memory and transfer control. The BIOS detects the first hard disk, loads the MBR bootstrap code on that one and transfers control to it, and then the bootstrap code looks in the partition table for an "active" marked partition on that hard disk. Usurping (replacing) the MBR bootstrap code allows for more functions that with the standard bootstrap code.

    Or does Paragon rely on Microsoft's dual-boot feature where first just enough of the Windows kernel gets loaded to read the boot.ini or BCD database to determine thereafter what OS to load? That is, you load Windows to determine what OS to really load. That means if that partition gets corrupted or deleted then there will be no Windows kernel to load or no boot.ini or BCD to use to determine which OS to load. The bootloader is *within* a partition which makes it susceptible to changes or corruption in that partition. I've never liked that method of multi-booting. Best is to usurp the MBR's bootstrap code which is never within any partition so it can never be affected by changes in the partitions, like moving or resizing them. In fact, the multi-boot program can be larger than the 446 bytes for the bootstrap area in the MBR. Since sector 0 cannot be assigned to any partition, the cylinder containing it cannot be assigned to a partition. A multi-boot program can start in the MBR bootstrap area but extend into the rest of that cylinder so it can be large. And all of that multi-boot program is not inside any partition.

    Acronis' Recovery program usurps the MBR bootstrap program. That means their loader is not inside any partition. Easeus ToDo Backup relies on editing the boot.ini file to add an entry for an image file to load that contains the Easeus recovery program (the Linux and backup/restore program). That means their recovery manager resides within a partition so is susceptible to changes in that partition. Because they rely on Microsoft's dual-boot feature, Windows must also be sufficiently usable within that partition to read boot.ini to decide which OS to load and behave the bootloader for whatever OS is selected. I liked how Acronis put their recovery manager outside a partition. I did not like how Easeus put their recovery manager inside a partition and also relied on Windows to perform the multi-booting.

    A multi-boot manager should never reside within a partition. Any changes to the partition(s) means the boot manager may no longer function. A multi-boot manager should never rely on another OS to perform the bootloader function. The multi-boot manager should do that and be completely independent of any OS installed in any partition on any drive.

    Does "If the boot disk is MBR-style, the bootstrap code is written to the MBR" mean Paragon usurps the MBR's bootstrap code area to put in Paragon's own boot manager? That is the best place to put [the start of] a boot manager.
     
  7. fireworker

    fireworker Registered Member

    Joined:
    Sep 27, 2009
    Posts:
    277
    Location:
    Russia
    Last edited: Mar 13, 2015
  8. VanguardLH

    VanguardLH Registered Member

    Joined:
    Sep 10, 2007
    Posts:
    96
    http://www.paragon-software.com/features_custom.html?p1=BRFree14&p2=HDM15Suite

    That's not very informative as to what features are provided by the Backup Capsule component. The manual was also unclear whether the partition would be bootable other than not mentioning it. Too bad. Looks like I have to make recovery media (e.g., CD) to recover from that partition if the app on the OS partition is unusable.

    I also see the Backup Capsule doesn't manage the backups, like rolling out an old chain (full+diff/incr backup) when space is needed for a new chain. That is why I use the Acronis Secure Zone because I don't need to be concerned about having to manually check for free disk space, don't have to remember to review backup logs for errors regarding lack of free space, or manually have to delete old backups to make room for new ones.

    So, at this point, I have to wonder what is the advantage, if any, in using the Backup Capsule feature versus simply creating a partition and not assigning a drive letter to it. According to the manual, Backup & Recovery 2014 Free should be able to store backups in an unmounted (no drive letter) partition. The only remaining advantage I can see for using the Backup Capsule feature is the use of a non-standard partition type specified in the partition's record in the MBR.

    I realize freeware (based on commercialware) is often crippled; however, the lack of image management within the partition and the absence of a bootloader and OS in the partition looks to have castrated the Backup Capsule feature to one of "hey, we can still list the feature".

    Thanks for replying. Looks like I won't bother with the Backup Capsule feature. There's nothing left of its guts in the freeware version.
     
  9. fireworker

    fireworker Registered Member

    Joined:
    Sep 27, 2009
    Posts:
    277
    Location:
    Russia
    Last edited: Mar 14, 2015
Loading...