Rollback RX imaging

Discussion in 'backup, imaging & disk mgmt' started by nexstar, May 8, 2007.

Thread Status:
Not open for further replies.
  1. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    Another year, another Rollback imaging thread :) I've been doing some testing using Drive Snapshot (DS) www.drivesnapshot.de as an imaging solution for Rollback systems and while the initial results were variable and didn't seem to make sense, I seem to have now found a method which works reliably (for me, at least). It would be good if anyone else with a quest for knowledge could also test this out.....but not on your important data!

    This is a summary of what I think I've discovered:

    DS cannot reliably image RB from within Windows.
    DS can reliably image RB from within a UBCD or BartPE environment providing the DS 'Maintenance Mode' option is selected.
    The maintenance mode does not do a byte for byte copy but it does successfully back up the snapshots.
    The restore can be done from within the UBCD/BartPE environment or from the DS DOS boot disk.
    On restoration of the image, all snapshots are available and fully functioning (exciting bit!).
    The DS differential backup facility also works as it should.
    Prior to restoring an image, it is essential to 'wipe' the partition or else RB will find previous data and get confused. I found that just deleting the partition with Acronis Disk Director was not adequate. You have to select the option to wipe the partition. One pass is enough.
    In testing with RB8, I found that the saving of a snapshot using the built-in option did just that. But you only got that one snapshot and had to re-install RB on recovering from the image.

    So, to successfully image and restore a RB installation together with all snapshots using Drive Snapshot, I do the following:

    1) Boot up using UBCD or BartPE.
    2) Save an image (or differential) of the system making sure that the Maintenance Mode option is checked.
    3) To recover, wipe the partition information using your favourite partitioning software (just deleting is not good enough)
    4) Either run DS from DOS (if you don't mind a simple command line) or from UBCD/BartPE. If you do this from DOS then restore the main image file first and then the differential if you have one.
    5) Reboot and feel smug when it all comes up as it should :)

    The partitioning bit was where I was getting odd issues. The RB data was obviously surviving the deletion of the partition and so was confusing things. I even found it necessary to do this when re-installing a RB image saved from within RB8. The first time I restored a RB8 produced image without wiping the partition, it showed 5 snapshots but messed up when trying to roll back to them. Once the partition was wiped, it successfully restored with just the one saved snapshot. I don't understand why this hasn't shown up as an issue before unless I am misinterpreting what is going on.

    The images take longer to save with the maintenance mode selected but I'm not bothered how long it takes if it works!

    To give some idea of storage requirements, my test setup was a 15GB C partition with 2.7GB used.

    An image taken before RB installation is 1GB.
    An image taken using 'Maintenance Mode' after the RB install and with a few basic snapshots is 1.3GB
    A differential taken on the same basis after installing some software is 73MB.

    The OS is XP Pro. The Drive Snapshot release is V1.38 dated 4th April 2007 and I have tested this on RB7 and RB8.
     
  2. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    Congrats with finding another solution, because RBRx isn't exactly an easy software to backup/restore COMPLETELY.
    It's a bit cumbersome of course, especially the required wipe of the partition, which is UNUSUAL for restorations in general.
    You really have to be a fan of RBRx, to live with such backup/restore solution. :)

    PS.: I also wipe my partition before restoration, but only when a malware attack occurred, like the killdisk virus for instance.
     
    Last edited: May 8, 2007
  3. Kenjin

    Kenjin Registered Member

    Joined:
    Sep 29, 2004
    Posts:
    63
    Thanks for sharing your results, however this solution is not really new and in essence the same what I posted 1 year ago: https://www.wilderssecurity.com/showpost.php?p=739635&postcount=413

    No, that's not correct, 'Maintenance Mode' DOES copy all sectors/bytes: http://www.drivesnapshot.de/en/advbac.htm

    Right, in my opinion RB8's snapshot backup is the cheapest implementation they could come up with. You can achieve more or less the same with version 7 together with any partition imaging program. Simply restore the snapshot you would like to backup and then do imaging from within Windows.
    A GOOD implementation of the snapshot backup feature in version 8 would have been to allow capturing all snapshots, or even better allow to just backup the delta of a snapshot so that you could work with it very much like full/incremental image backups in usual imaging software.

    The small sizes despite usage of 'Maintenance Mode' are most probably the result of good compression of unused space in the partition. If unused sectors are all zero they compress to almost zero bytes. However the sizes would change dramatically if those sectors once had real data (even if only temporarily). Therefore I don't think imaging with a "copy all sectors" option is a viable solution in most cases.
     
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,042
    Hmm. Doesn't sound like Rollback V8 really has an off disk disaster recovery that's very good. When I was fooling with Eaz-fix, I notice the only mention of recovery was bartpe.

    Either these guys don't understand it, or simply can't figure out a workable way of doing it. What is the point of having "60000" snapshots, and only being able to image "1"??
     
  5. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    You got that right.
    Another thing, I don't understand : all these RBRx-users have 20-40 snapshots. I only work with TWO snapshots.
    Why so many snapshots, that is an entire bookkeeping.
     
  6. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    I'm quite quick at it now:) Actually, it's not that bad and as it is something which should only be needed in the event of hardware failure then I just need to know that it will work when I need it. If the hard drive has failed then you can skip the wiping of the partition bit on restoration;)
     
  7. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    Harddrives fail almost never, in other words the wiping of the partition is always required for the restoration. Otherwise I misunderstood this sentence. :)
     
  8. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    There have been so many posts on this that I must have missed yours. Pity, it could have saved me a few hours loss of sleep! Perhaps your post should have been made a sticky:)

    Sorry, in my clumsy way what I was trying to say was that, if you have a 100GB drive with only 20GB used then you are not likely to need a 100GB drive for the backup even though you've selected the maintenance mode.

    Quite. I thought I'd done something wrong with the RB8 restore when it only produced the one snapshot but if you read their documentation then that is all it seems to promise. Not really good enough when a 3rd party piece of software seems to manage it ok.

    I guess it depends on how you work with RB. I tend to have 6-10 snapshots which are locked and which can be set up for very different purposes. The other snapshots are just short-term for use while testing etc and wouldn't need archiving. I take your point though that if I have copied a DVD, say, to the drive at some point and deleted it then maintenance mode would most likely back up that area even though it was no longer used. I feel another test coming on:)

    I noticed from your post last year that you were using a 3rd party app to restore the mbr. I haven't found the need to do that as DS seems to restore it correctly. Also, did you find it necessary to wipe the partition prior to restoring the backup?
     
  9. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    One of my hard drives is generating noises that I suspect will end in failure but will probably be replaced before it gets that far;)
     
  10. Kenjin

    Kenjin Registered Member

    Joined:
    Sep 29, 2004
    Posts:
    63
    :D Yes, most likely. If you're really going to test more on this, please also try another round with backing up after clearing unused sectors with a tool like Eraser (http://www.heidi.ie/eraser/). I have no big hopes that it works as expected on a RB protected volume, most likely that would be counterproductive and lead to RB seeing additional sector changes and blow up snapshots like defragging does. However it would be interesting to see results from such test in practice. ;)

    Yes, I used a 3rd party tool, but I am not sure anymore why. Probably I just overlooked these options from the drive's context menu in the DS restore screen (http://www.drivesnapshot.de/en/rest2.htm). I think they are what you're referring to, right? Or didn't you use them either? In this case I would suspect, it only worked ok for you because you may have just erased the partition but not the whole disk before restoring.

    Regarding the need to wipe the partition prior to restore I can't say much. In last years' test I tried only the "bare metal restore" case, i.e. I rolled back the virtual machine to a pre Windows install snapshot, so that the drive would be all zero from first to last sector. At the moment I see no reason why it should be necessary to wipe the partition. If you're taking the image in "all sectors" mode I would expect a restore operation to overwrite every single sector with the contents from the image.
     
  11. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    I will try out Eraser in amongst further testing and see what impact it has.
    I didn't even know that context menu existed in DS :eek: . Thanks for the info!

    What I was doing was wiping the partition with Acronis Disk Director. Creating a new NTFS partition with Acronis and then rebooting to make sure that the mbr had been over-written. Once I got the 'ntldr is missing' report then I was happy that the RB mbr had gone.

    I then simply did the restore with DS ( snapshot restore hd1 auto filename ). The RB mbr was then present on reboot. I didn't have to explicitly write it using the DS mbr command although the DS instructions tend to imply that it doesn't restore the mbr unless you do. I can't see how it could not be there and then be there without DS having restored it.

    So would I. Which was why I was surprised when the RB8 internal backup appeared to have 5 snapshots when it was restored. If I tried to go to roll back to those snapshots then things were clearly not right. So I then wiped the partition, restored the same image and then there was just the one snapshot as, it seems, they intend it to work. The information about the previous install with the 5 snapshots could only have come from the drive. I have found this same behaviour when I do a restore with DS or with RB8. This is why I include the wipe as it seems the only reliable way to restore....but I'm happy to be proved wrong:)
     
  12. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    Well, as expected, Eraser is certainly counter-productive with Rollback. It managed to make the system think that the partition was completely full by the time it had finished:eek: I also tried a similar DOS-based program and it worked better in that it recovered the used disk space but it also got rid of Rollback in the process!

    I copied a DVD to the desktop and the DS image increased accordingly. Deleting the DVD didn't reduce the subsequent image size so this is one limitation of using the DS 'maintenance mode'. However, from my point of view, this isn't really a problem. I use Rollback to protect my system drives. My C partitions are rarely larger than 15GB and so it is not onerous to image 15GB in total if it means that I can retain all of my snapshots in that image.

    I guess it would be nice if the RB developers added a facility to clean the free space on the protected drive(s) which I would imagine would be very easy to implement from within Rollback. This would then allow third party imaging software to work more efficiently. Or they could just build a proper backup routine instead:)
     
  13. pvsurfer

    pvsurfer Registered Member

    Joined:
    Sep 1, 2004
    Posts:
    1,400
    Location:
    California - USA
    Hey guys, I'm failing to understand this - most likely because I didn't get any sleep last night (was up with a very sick kid). :blink:

    Seems to me that any disk-imaging program automatically wipes the drive that it's restoring the image to, so I'm confused about the need for a separate 'wiper'... Would you clear that up for me?
     
  14. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    I hope things are on the mend now.
    Yes, I thought that as well. I can only currently speak of my experience with Drive Snapshot and also Rollback v8's restore facility. Both of them required the partition wiping to get a correct restore of the saved image. I'm afraid I'm not qualified to say why. :)
     
  15. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,042
    Not necessarily. Both with Acronis and Shadow Protect you can just restore the partition and it just rewrites the data. Both have options to allow you to delete the partition(in acronis's case) or delete the volume( in SP's case)

    I don't think Drive Snapshot or IFD/IFW have similiar options for example
     
  16. pvsurfer

    pvsurfer Registered Member

    Joined:
    Sep 1, 2004
    Posts:
    1,400
    Location:
    California - USA
    Thanks Pete, that could just be the answer... zzzzo_O
     
  17. Kenjin

    Kenjin Registered Member

    Joined:
    Sep 29, 2004
    Posts:
    63
    Are you sure RollBack's MBR was really completely gone after wiping? Did you wipe the whole disk or just the partition?
    I'm somewhat skeptical that wiping/recreating only the partition really removed the RollBack MBR. It should have deleted everything inside the partition (usually starts at sector 63), but not the MBR (in sector 0). The "NTLDR is missing" message comes from the partition boot sector. It is no indication of a clean MBR.
    I suppose this might have happened: RollBack MBR was still present after your wiping procedure and it just did not show the usual screen during boot as it could not find any of the files required for the subsystem console. Instead, it just continued booting the partition marked 'active', which then ended with the "NTLDR missing" error. After you had restored the image, the necessary files for the boot screen stuff were back and so it appeared as if that also restored the MBR.

    Yes, as expected.
    Right, but one has to keep this effect always in mind and remember not to put large files there, not even temporarily (or lots of smaller ones which could add up quickly).
     
  18. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    I'm not sure of anything anymore :eek: You were absolutely right. The RB MBR was still lurking and just pretending not to be there. I did a fixmbr and then a restore and the sub-console had gone. Restoring the MBR with Drive Snapshot is simple enough though so it's not an issue....it's just nice to know. Thanks for all of the enlightenment!

    Agreed, but I don't normally copy DVD's to my dektop and even if I manage to write all over my C drive over a period of time, it is still no great hardship to image a 15GB partition. Especially knowing that I am also storing all of my snapshots intact :)
     
  19. EASTER.2010

    EASTER.2010 Guest

    I'm actively using RollBack RX and so far am pleased as pink with it, especially the feature of file/folder selection restore at will.

    I was doing a simple Paragon image and during the Restore my PC suddenly & instantly rebooted for no reason right in the middle of all that. I tried unsuccessfully to boot back in windows only to be met with a BLUE SCREEN detailing something had happened. Giving up on booting back normally i used the Rollback Rx bootscreen menu to change snapshots and in an instant everything was restored perfectly again. It save me from certain frustration.

    I can see very clearly now from this malfunction that rollback programs are indeed VITAL to recovery even where your imaging apps fail.
     
  20. Banshee

    Banshee Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    543

    So no need to use diskpart ?
     
  21. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,042
    Only time I had to use diskpart is when I was playing with the trojan Killdisk, and it deliberatly messes up the partition so normal programs can't deal with it. Then I needed diskpart.

    Pete
     
  22. EASTER.2010

    EASTER.2010 Guest

    And i have to applaud and thank you Peter2150 for that test but moreover for arriving at a succesful solution and sharing it. I since been zeroing some of my drives before a reinstall and now find the XP installer really zooms thru an install much quicker & smoother. I suppose the XP Installer has less leftover writings on the platter disc to have to hesitate and climb over when you thoroughly zero out the hard drive in this manner.

    Nice Tweak really!
     
  23. flinchlock

    flinchlock Registered Member

    Joined:
    Jan 30, 2005
    Posts:
    554
    Location:
    Michigan
    Yes, I also have the same question...

    Before I make an image, I...
    • stop Folding@Home
    • compact TB folders
    • IE
      • recheck my Zone and Advanced settings
      • delete cookies, files, offline files, history, autocomplete forms
    • FF: Tools > Clear Private Data > ALL
    • empty C:\TEMP\ and Recycle Bin
    • Drive C:
      • Disk Cleanup
      • Defrag (Windows builtin defrag)
    • make and verify image
    Question: Does the defrag effectively wipe the old deleted files?

    Question: When you say "diskpart", this Microsoft Windows XP - DiskPart?

    Question: When you say "trojan Kildisk", this Active@ Kill Disk - Hard Drive Eraser?

    Mike
     
  24. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,042
    Hi Mike

    To explain. No Kill disk is a trojan, not the disk eraser program. What it does is take advantage of a weakness in the microsoft routines that all backup/imaging programs use. It checks the partition table, and if there is none, thats fine, if one is there it returns information about it. What it doesn't do well is handle corrupt tables. It just quits, so what ever software(Acronis,Shadowprotect) etc. use can't tell whats there and so gives errors. It does this by writing random numbers into the table.

    You are also right the Diskpart I was refering to is the utility in the recovey console you can use when you boot to a windows XP CD.

    When I restore I routinely do a delete volume. This essentially zero's out the partition table, deleting the disk. It doesn't actually overwrite every sector, but as far as windows is concerned it's an emtpy disk.

    One big caution I learned when fooling with this stuff, and no FDISR,Rollback,Powershadow, etc would have saved me, is you can get into big trouble. Shadowprotect IT edition has a partition table editor, and you can use it to zero out the partition table. Same exact thing as Diskpart. Worked fine. I was doing a test sugggested by Erik, and since I was booted to my Bartpe disk, I used Acronis Disk Director's partition table editor to do the same thing. Oops. Couldn't do next step so I rebooted. BartePE BSOD'd. Tried my ShadowProtect Recovery CD, and Winpe BSOD'd. Then tried my Windows XP CD, and it BSOD'd. Not good. Downloaded the zeroing utility from western digital, and of course with out the nvidia drivers it wouldn't work. Turned out Bootitng was my savior.

    One does have to becareful. Illusion of invincibility shattered.

    Pete
     
  25. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,042
    Probably not. But unless your paranoid, there is no need to wipe them. To me know shutting down stuff is optional if I image from windows. I've tested SP's hot imaging with stuff running and it's fine. Restoring just gives system state of files as they were on the disk before being open.
     
Loading...
Thread Status:
Not open for further replies.