Live imaging of a machine in operation - pros, cons, experience?

Discussion in 'backup, imaging & disk mgmt' started by TiberianMagnus, May 10, 2012.

Thread Status:
Not open for further replies.
  1. TiberianMagnus

    TiberianMagnus Registered Member

    Joined:
    May 10, 2012
    Posts:
    7
    Location:
    United States
    I've been a faithful user of Acronis True Image for many years now, and while I do own the commercial product(s), I've never actually used the Windows version of the software: when I purchase(d) the new(er) versions of TI I would only install it long enough to make the bootable CD to use since I never believed that "live imaging" was possible without a lot of issues because of it but also because it just seemed like it wouldn't work in any reliable sense.

    But, as time has gone by - and I'm not an uptime junkie, I swear - I've come to realize that with my laptop (an older HP nx9420, a 17" beast machine from 2006 with a killer Quadro GPU in it, found this laptop practically in mint condition a few weeks ago) is rarely actually turned off. I do use sleep/standby pretty frequently (but not hibernate), and since I prefer to have it up and running almost 24/7 I'd prefer to try some live imaging methods and see how it works out, even if just for a short period or at least until I have a good reason to not use it.

    I don't mind using the boot CD method other than it does require shutting down and it's a chore to do that more often than not.

    My history:

    I was a beta tester for PowerQuest's Drive Image, the first drive imaging software that ever mattered to me. I tried Norton Ghost when it first appeared and simply couldn't tolerate it for more than a minute and that was it. But as far as PQDI was concerned, I used that software for many years without a single issue or failure, and I miss it to this day. One reason?

    PQDI was and still apparently is the only imaging software that I ever used that could create a true self-booting recovery set of CDs - when you made the recovery set to CD media, it would actually place a copy of itself (the PQDI app) on the first CD in the set and you'd use THAT disc to do the restore of the whole image set - you didn't have to have the actual program CD around, which became an incredibly useful thing long ago.

    Anyway, after Symantec bought and effectively destroyed PowerQuest and the reputation they built up over the years with Drive Image and also Partition Magic, I needed to find another imaging solution as Drive Image simply didn't work anymore and DVD media was moving in as my predominant form of long-term storage.

    Long story somewhat shorter:

    I never bothered using True Image's ability to make live images of a system in operation (I use Windows 7 Professional as my primary OS, some tinkering around with Ubuntu on occasion in VMs so that's a non-issue - the virtual machines are stored on a separate drive from the host OS so backups are already par for the course). So now I'm "in the market" for something that has good recommendations and reviews and actual first-hand experience, hence this post and my request for comments, as the case may be.

    I've looked back over a few hundred or more threads the past day or two and seen a lot of different opinions, etc about backups and imaging of all kinds, but I haven't been able to track down much info about live imaging.

    Please understand I will continue to use the TI boot CD if I can't find a workable reliable system for live imaging, but the purpose of this thread is two-fold:

    a) ask if others do actually perform live imaging and what they use to do it as well as their opinions and experience with it, and...

    b) if people in general (especially here at this forum) would consider live imaging a bad thing from start to finish and perhaps my current and long-standing offline imaging is still the superior method even in spite of me really seriously hoping to find something that will do the imaging without requiring me to shut down for the time it takes to image/verify (which I always always do - even with optical media, I always verify before moving on).

    So, that's about it, sorry for the long post but I'm a detail oriented person that likes to get as much info out there in the hopes that the right folk will spot it and respond in kind.

    Thanks...
     
  2. napoleon1815

    napoleon1815 Registered Member

    Joined:
    Sep 9, 2010
    Posts:
    702
    Welcome! To answer your questions...

    1. I almost exclusively do offline images. Compared to live images, offline images are definitely "safer" as there are no "moving parts." For this, I use IFL from TerbayteUnlimited. You are bound to get many opinions on here, but for my piece of mind, I prefer offline.

    2. I don't think live imaging is a bad thing...it's certainly better to do that than no imaging at all if taking your systems offline is too inconvienent or you can't do it (this is more true in the corporate world). Truth be told I never had any issues with live imaging for the times I have done it (and my subsequent restores). Ultimately, do what is best for your situation. A lot of people do both...do an offline once a month and a weekly live image or something like that. It has gotten better, that's for sure. I use IFW from Terabyte or R-Drive for live imaging. Believe me, even with the few systems I have, it can be a pain to take them down for imaging.

    BTW...I use to love PQ V2i...I also tested it and bought it for my old NT 4.0 servers back in the day. Awesome tool, but like you said, Symantec killed it. Sad really.
     
  3. buckshee

    buckshee Registered Member

    Joined:
    Apr 11, 2006
    Posts:
    134
    TrueImage and programs like Macrium Reflect (which I use) are designed to do the imaging while using the OS, in my case Windows 7. I have never, ever had a problem with restoring an image that was made this way in all the years I have been using Macrium. In fact I set up a schedule to make a full image once a week followed by an incrematal image every day. Once 2 sets are made (i.e over a 2 week period) then the oldest set is automatically erased. I don't even think about it. As I said I have never been let down. Doing a CD boot then taking an image seems to me to be to much aggrevation
     
  4. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    I do daily images with image for windows which means live images using vss or phylock. I have used the product since 2010 and havent had any issues with the live images on multiple machines.
     
  5. treehouse786

    treehouse786 Registered Member

    Joined:
    Jun 6, 2010
    Posts:
    1,388
    Location:
    Lancashire
    Fwiw, i have been using active@ disk image to do daily live images on my SSD and weekly (average) restores back to the SSD for a long time now and i have not had a single problem. I also do monthly offline images just for peace of mind but i have not had any issues with live imaging :thumb:

    So based on personal experience, live imaging is just as reliable as offline imaging.
     
  6. The Seeker

    The Seeker Registered Member

    Joined:
    Oct 24, 2005
    Posts:
    1,100
    Location:
    Adelaide
    I've performed many online images (using Image for Windows) and have never had a problem.
     
  7. TiberianMagnus

    TiberianMagnus Registered Member

    Joined:
    May 10, 2012
    Posts:
    7
    Location:
    United States
    As expected (and based on the number of threads related to it), Terabyte Unlimited Image for Windows seems to be the all-around favorite because of some issues I noted (again, based on threads) with Acronis True Image. Now, I have to say that because I have never used the Windows application itself for imaging purposes I suppose I've never encountered the issues or problems that others have with that product. It's always worked for me, never failed once, but then again doing offline imaging is always the best solution and I totally agree with that point.

    But since my objective is to "keep the ball rolling" so to speak then live imaging is what I'm trying to do, that's the focus. I grabbed the user manual for IFW and I'm now browsing through it to see what I'll be getting myself into. :)

    Will make a standard offline image with TI sometime today and then install the trial of IFW and do some tests, see what happens.

    buckshee:

    If you have a moment to respond, can you say which version of Macrium Reflect you happen to use, and if you don't use the Free edition, would you think that would still be useful for doing live imaging as I've stated, and not much else (meaning I don't need all the bells and whistles they show off in the comparison chart for the different editions). I am going to guess that you're not using the Free edition since it doesn't show the ability to do differential or incremental backups (which for live imaging and keeping the machine running would be the best solution, I think).

    Your workflow of doing a full weekly and daily incrementals then wiping the previous week's backups sounds like a brilliant solution and sort of what I had in mind. With TI I've been doing somewhat weekly backups (if I remember to do it, getting older every day, ain't quite the spring chicken I once was) so, any advice on setting up your particular workflow for myself would be absolutely awesome.

    I use a 60GB primary partition for Windows 7 itself (and the 100MB system reserved partition as well); those are what I always image together. I rarely go over 40GB full on that partition as I use it a) for the OS itself b) the main apps I use regularly and c) downloaded data since it's easier to just let it go into %userprofile%\username\Downloads and then I move it to another drive or partition once I decide what to do with it. The system drive is ready to be imaged in a few minutes typically because of keeping it "light" and only leaving data on it till I move it (which is pretty frequent).

    Thanks again for the info and suggestions, folks. Looks like this place will be a good one to hang out with... :D
     
  8. napoleon1815

    napoleon1815 Registered Member

    Joined:
    Sep 9, 2010
    Posts:
    702
    Going to the live imaging darkside? Just kidding. Welcome again...good place to hang out. Another great live imager is DriveSnapshot (http://www.drivesnapshot.de)

    It's a portable app...just an .exe you run with no install...rock solid with live imaging and very popular on here...on par with IFW.
     
  9. moontan

    moontan Registered Member

    Joined:
    Sep 11, 2010
    Posts:
    3,931
    Location:
    Québec
    Terabyte IFW never failed for me while doing live imaging.

    neither has Windows 7 own imager.

    these days though, i use offline imaging.
     
  10. TheRollbackFrog

    TheRollbackFrog Registered Member

    Joined:
    Mar 1, 2011
    Posts:
    3,047
    Location:
    The Pond - USA
    Greetings, TM!

    95+% of my imaging is done LIVE and the current product I use is "Image For Windows" (IFW). I have restore beaucoup images taken LIVE and have never had a problem with their status or their consistency. I have also used "Drive Snapshot" and Acronis TI ECHO with the same rate of success. Abandoned Acronis after ECHO due to massive product bloating and leftover garbage (following uninstall) causing system problems.

    DRIVE SNAPSHOT was used during an extensive testing period as was IFW, but IFW was selected mainly 'cause it was the only LIVE product (using REGISTRY tweaks) that could accurately image a Rollback RX-protected system... snapshots and all. Other imagers could only do this using non-LIVE solutions (WinPE, LINUX, DOS off-line).

    The above solution is used on a system that is only taken down about 2-3 hours per month... thus the requirement for LIVE imaging. Having restored many LIVE images using these products, never a failure has been seen.

    Test away... you will be pleased.
     
  11. tej

    tej Registered Member

    Joined:
    Dec 2, 2010
    Posts:
    23
    Location:
    India
    Does anyone know why imaging a running system is as reliable as offline imaging? I had the same doubt last week and finally decided to image offline. Intuitively, one would think that offline imaging is safer.
     
  12. napoleon1815

    napoleon1815 Registered Member

    Joined:
    Sep 9, 2010
    Posts:
    702
    I don't think it's as reliable myself. With offline nothing is running actively while taking the image. Let me put it this way...if I had ONE chance to image my desktop and had to pick, I'd do offline. Again, I have NOT had any issues with online, and I think it really comes down to your preference.
     
  13. napoleon1815

    napoleon1815 Registered Member

    Joined:
    Sep 9, 2010
    Posts:
    702
  14. buckshee

    buckshee Registered Member

    Joined:
    Apr 11, 2006
    Posts:
    134
    Hi TiberianMagnus,

    I use Macrium Reflect Pro 5. The only reason I have the Pro version is so I can restore my images to a brand new upgraded computer (not just a harddrive change). The Standard version will do the imaging procedure I use..

    Just to add to this though...
    My primary drive is partitioned in to C and D drives. The `My Documents' folder, My Music, My Pictures etc are on the D drive. I also have a second harddruve which us where I image to

    I image the C drive and D Drives on their own unique procedure to different folders on the second harddrive.

    As my data (emails etc) are on the D drive, if I restore just my C drive (ie The OS plus all programs) then my system is 100% up to date after the restore as the data is not overwritten.
    I image the D drive regularily in case the harrdrive crashes which would lose the C and D drives

    Hope that all makes sense !!! It works well for me
     
  15. TheRollbackFrog

    TheRollbackFrog Registered Member

    Joined:
    Mar 1, 2011
    Posts:
    3,047
    Location:
    The Pond - USA
    I cannot answer that question to the 100% level. What I can say is that most LIVE imagers use the Windows VSS (Volume Shadow Service) when doing this operation. VSS will "freeze" the Windows file system at a point in time which will allow the imager to image what looks like a dormant system. All system changes during the time VSS has been invoked are cached out of the frozen system point, and re-integrated at the time VSS is ended. This is the main reason consistency has really never been a problem with LIVE imagers (including Windows itself). The IFW product can use either VSS or its own VSS-like system freeze function (phylock) to accomplish the very same thing.

    Hope this helps...
     
  16. Robin A.

    Robin A. Registered Member

    Joined:
    Feb 25, 2006
    Posts:
    2,279
    The main problem I see with creating live images with an automatic schedule is security. When the image is created, the system may have been infected with malware or may be corrupt, and this may not be obvious at the moment, only later. Images created under these circumstances are useless.

    Some examples of system corruption that I have occasionally encountered, and don´t cause obvious problems in normal operation:

    - Windows Update can´t install updates.
    - Device Manager can´t be opened.
    - Programs that depend on .NET FW don´t work.
     
  17. tej

    tej Registered Member

    Joined:
    Dec 2, 2010
    Posts:
    23
    Location:
    India
    So assuming the VSS algorithm is foolproof, it looks like people (myself included) are wasting their time with offline backups.
     
  18. napoleon1815

    napoleon1815 Registered Member

    Joined:
    Sep 9, 2010
    Posts:
    702
    Nothing from Microsoft is foolproof. :) As Robin A. stated you can still get inconsistencies with live backups...I have seen those on the server side.
     
  19. In my experience, Volume Shadow Copy based backups of Windows systems work... Always. I have yet to experience any backup failures. OTOH, I haven't done all that many Windows backups, and I'm also careful not to do anything with a computer while it backs up. Not sure what would happen if I started moving files around during a backup, and I'm not sure I want to find out.
     
  20. 1chaoticadult

    1chaoticadult Registered Member

    Joined:
    Oct 28, 2010
    Posts:
    2,248
    Location:
    Chaotic Land
    I manually live image with Active@ Disk Image all the time and I never had any issues.
     
    Last edited: May 12, 2012
  21. TheRollbackFrog

    TheRollbackFrog Registered Member

    Joined:
    Mar 1, 2011
    Posts:
    3,047
    Location:
    The Pond - USA
    As was mentiond... foolproof... Microsloth, hmmmmm.

    I would tend to agree that if the system downtime is available, off-line imaging is probably the preferred method. That downtime is not available on one of my sytems... therefore, LIVE imaging (Yes, we all need that protection in some form).
     
  22. Scott W

    Scott W Registered Member

    Joined:
    Sep 21, 2008
    Posts:
    484
    Location:
    USA
    Yes, offline (cold) imaging is more reliable than hot imaging (if you can afford to take the system down). VSS is error-prone (Google it)! There must be a reason why IFW and DS bothered to develop their own proprietary system-locking drivers! But VSS works well enough most of the time. ;)


    Scott
     
    Last edited: May 11, 2012
  23. TiberianMagnus

    TiberianMagnus Registered Member

    Joined:
    May 10, 2012
    Posts:
    7
    Location:
    United States
    A wealth of good info, so thanks for all the participation. I had some issues the past few days (medical with the Wife, no worries now) that prevented me from doing any testing for useful experience but I'll get to it this weekend.

    Scott (just above) makes a good point, but it's not always a bad thing or even good ones when companies decide they might have a better solution to a given problem. I figure if VSS can do the job then so be it, but having the option to also try the secondary solutions those providers have is the fallback.

    I do prefer to keep things clean as possible, and while I've never actually implemented a setup where I do "move" the My Document/Pictures/Videos folders to another drive, I think I just might start doing that since it would obviously negate the requirement to move that stuff if I decide to do a backup, and it'll be right where it should be (given I alter the locations) when I do get back up and running with a clean install if I choose to do one.

    Great info, got a lot of stuff to check out this weekend so, again, thanks for all the replies and assistance. :D
     
  24. Brian K

    Brian K Imaging Specialist

    Joined:
    Jan 28, 2005
    Posts:
    8,638
    Location:
    NSW, Australia
    Scott,

    Is that a personal opinion or can you quote an objective study that demonstrates it is true?


    TiberianMagnus,

    See http://www.windowsbbs.com/windows-xp/49222-moving-windows-xp-default-folders-rev1.html
     
  25. TiberianMagnus

    TiberianMagnus Registered Member

    Joined:
    May 10, 2012
    Posts:
    7
    Location:
    United States
    Thanks for that link, Brian. I hope I didn't make myself misunderstood in the sense that I do know how to actually alter the location of those user directories (Docs/Pics/Videos/etc), I've just never done it for myself. ;)

    As for what Scott said about offline, I would tend to agree in most situations that yes, an offline image is more reliable in the sense that:

    a) you're probably fairly safe from a big mishap of some errant problem cropping up during the image process that not only breaks it but breaks the operating system and crashes the box completely

    b) it'll probably be just as fast if not faster to do the image offline since the drive won't be in any exclusive mode for the OS itself even in spite of the VSS or physical lock on the volume access put in place

    For me, the primary reason for wanting to get into doing live imaging (after using offline imaging for 15+ years now) is convenience: I'm tired of shutting down to the do the image and the restore. If I can do the image live with the OS running and get the same results (that's the general idea, yep, yep) without needing to shut down all the apps/etc that I've got running at any given moment - that's the inconvenient part - and still be "safe" or as safe as modern backup and imaging technology can provide, that's what I'm going to do.

    It's a given that to do the restore it'll require a shutdown/reboot to get into the imaging restore process, which is not something anyone can do anything about, that's understandable. But if I can save myself some hassle of shutting down everything and then having to bring it all back up to the previous state without having to shut down, I'm all for it.

    Will be testing out IFW here in a few minutes after I do a proper offline image with TI so I've got that fallback in case something gets borked. ;)
     
Loading...
Thread Status:
Not open for further replies.