RollBack RX question

Discussion in 'backup, imaging & disk mgmt' started by bgoodman4, Mar 15, 2009.

Thread Status:
Not open for further replies.
  1. bgoodman4

    bgoodman4 Registered Member

    Joined:
    Jan 13, 2009
    Posts:
    3,130
    When you take a snapshot are you doing incremental or differentials? I suspect/hope they are differentials because if not when you clear snapshots from a set if the snaps were incremental you would lose the integrity of the set.....unless the next snap makes up for the gap somehow.

    Also, I know its very individual but how many snaps is it reasonable to maintain? I ask because when the snaps are defraged if there were hundreds of them it could take a fair bit of time to run.

    Here is how I have things set up at the moment.

    Upon boot a snap is made and is automatically locked. Each hour a snap is made but is unlocked. At the end of the day, if nothing troublesome has occurred, I delete all of the hourly snaps and power down the PC.

    I am wondering if you folks think this is a reasonable approach or would it be fine to just leave the snaps accumulate and have Rx simply delete the oldest unlocked snaps as space is required?.
     
  2. demoneye

    demoneye Registered Member

    Joined:
    Dec 30, 2007
    Posts:
    1,356
    Location:
    ISRHell
    Rollback RX make a incremental bacup :D

    according to rollback documentation u can make up to 65,000 snaps , so your approach is ok, u can always make a full back up using its build in drive image (in ver below 8.1)
     
  3. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,039
    Rollback snapshots aren't really either incremental or differential, those are imaging terms.

    A rollback snapshot, is literally a picture of what your system looks like at the time you take the snapshot.

    So if you take snapshot A, and then add 10 files, take snapshot B then delete 5 of the files and take snapshot C, then go back and delete B, when you go to C it will have the system the way it was with A, but only with the 5 new files you didn't delete, The other 5 are gone. I suppose in a way it's incremental, but it's better to really understand what is going on.

    Also when you take a snapshot, no files are created or deleted. Simply a table pointing to the file sectors is updated.

    Pete
     
  4. Jo Ann

    Jo Ann Registered Member

    Joined:
    Jan 6, 2007
    Posts:
    508
    Although Wikipedia refers to RB snapshots as 'incremental sector redirection', in actual use RB snapshots behave similar to differential image backups. I say this because deleting one or more interim snapshots does not 'break the chain'. If they were truly incremental, deleting just one interim snapshot would irreparably destroy your ability to restore any snaphsot taken subsequent to the one you deleted.

    As you suggest, it is purely an individual preference. I allow snapshots to accumulate until I create my weekly disk-image (on a weekly basis, I tend to accumulate about a dozen or so snapshots). Once I have created that system-image backup (including all RB snapshots) I update the RB Baseline which optimizes RB's mapping (as well as freeing up disk-space). Then I start a new (fresh) week ...that process works for me. ;)
     
    Last edited: Mar 15, 2009
  5. Baldrick

    Baldrick Registered Member

    Joined:
    May 11, 2002
    Posts:
    2,299
    Location:
    South Wales, UK
    Ditto here...except that I do hourly snapshots which allow a good deal of granularity vis-a-vis where you can roll back to...but then disk space used by the snapshots over a week is not an issue for me.

    Cheers :D
     
  6. appster

    appster Registered Member

    Joined:
    Jun 19, 2007
    Posts:
    530
    Location:
    Paradise (Hawaii)
    I pretty much do the same thing. The only procedure that I add to this process is that once per month I defrag my system drive before updating the baseline. Doing this results in a substantial increase in the size of RB's current snapshot, but that is completely remedied with the subsequent baseline update. The only caveat to running a disk defrag with RB installed is to be sure you have ample free disk space before doing it - otherwise you are inviting trouble!
     
    Last edited: Mar 15, 2009
  7. Aaron Here

    Aaron Here Registered Member

    Joined:
    Jun 4, 2006
    Posts:
    1,205
    Location:
    USA
    Hi appster,

    EAZ's & Horizon's FAQs advise against running disk defraggers with EF/RB installed (suggesting that it doesn't do any good). Since you defrag your system drive (monthly) with RB installed - am I to conclude that you are deriving a performance improvement after doing that?

    Aaron
     
  8. ratchet

    ratchet Registered Member

    Joined:
    Feb 20, 2006
    Posts:
    1,906
    Although just a rookie in this whole snapshot software behavior I still have one observation after using AyRecovery since December. After I uninstall it I run JKDefrag and I don't even think the whole process takes much more than about two minutes, when normally it would take at least 10 to 15, so I would say the snapshot defraging works just fine. I've uninstalled it every two weeks so I can make a Ghost image.
     
  9. appster

    appster Registered Member

    Joined:
    Jun 19, 2007
    Posts:
    530
    Location:
    Paradise (Hawaii)
    Yes, I do see a performance improvement after defragging. I use most of the MS Office apps and after a few weeks I notice that it takes longer for my docs, worksheets and databases to open. I find that monthly defrags remedy that.

    I suspect that the reason Eaz/Horizon discourages disk defragging is because by its very nature defragging relocates files and RB sees all of that as data changes requiring extensive re-mapping in the current snapshot (RB doesn't know that the files themselves have not changed). This can bring about extremely large snapshots (and slow operation)! By updating RB's baseline immediately after defragging, RB re-optimizes its sectors map and frees-up disk space. ;)

    Of course all individual snapshots are rolled-up into the updated baseline, so in order to preserve those snapshots I always create a sector-by-sector image backup of my system drive before updating the baseline.
     
    Last edited: Mar 15, 2009
  10. bgoodman4

    bgoodman4 Registered Member

    Joined:
    Jan 13, 2009
    Posts:
    3,130
    Thanks for all the comments. They are much as I had expected but thought it makes sense to be sure. I have done a number of restores and have not had any problems so it seamed reasonable that the snaps are more like differentials than incremental. As to defraging Horizon indicates you should only use RBs built in snap defrag utility. There is no statement that defraging should be eliminated completely, just that you should not use any defrag program other than RBs if RB is installed.

    Regarding freeing up disk space I did not think this was a real issue since the promotional material indicates something like the ability to store 60,000 snaps on (I think) .7% of the drive. Even if its 7% of the drive its still not much. My concern here was more with the time required to defrag 1,000 of snaps upon boot. Or are previously defraged snaps not re-defraged? If they are not, and only snaps taken since the last defrag are dealt with by a new defrag, then this concern disappears and there is no issue.
     
    Last edited: Mar 16, 2009
  11. Baldrick

    Baldrick Registered Member

    Joined:
    May 11, 2002
    Posts:
    2,299
    Location:
    South Wales, UK
    Hi Bgoodman

    I do not think that the 0.7% of the drive thing is well understood. This relates I believe to the amount of space that RB Rx uses to store the snapshots but infact the critical thing here is the amount of space that is 'locked' by the snapshots, ie, cannot be reused and is therefore effectively consumed as a result of snapshotting...a subtle but important difference. If you look at the main panel of the RB Rx GUI you will see 'Used Space' and that indicates the amount of space that is 'locked' and therefore unusable by the system until all existing snapshots are deleted or the baseline is redone. If you monitor this you can see that eventually you will run out of disk space depending on how much free disk space you have when you set the base line.

    So my thoughts are (i) forget the 0.7%, (ii) concentrate on the 'Used Space' and (iii) go for a snapshots every x for y weeks (you fill in the variables...but iin my case it is x = 1 hour & y = 2 weeks) and (iii) after y weeks defrag, take a full image and then reset the base line. (if using v8.1 you need to uninstall RB Rx if using v9 there is now the ability to defrag without uninstallation).

    Just my thoughts for what they are worth...but then I may be wrong so if I am then some one plase correct me!

    Cheers :D
     
  12. bgoodman4

    bgoodman4 Registered Member

    Joined:
    Jan 13, 2009
    Posts:
    3,130
    Thanks for this, it makes perfect sense to me. I never did understand the .7% thing, mind you, I don't understand much of how RB works. The idea that snaps are so small yet can return your PC to a prior state is very puzzling. I know (since it was posted elsewhere) that RB is not imaging the drive but mapping the pointers (whatever they are) but if files are missing because they have been deleted how can changing the pointer restore the file? Very mysterious but hey as long as it works, thats all that really counts.
     
  13. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,039
    The reason it works with a deleted file is after you take a snapshot, the file is deleted from that snapshot, but the sectors a previous snapshot is aware aren't removed, so changing the pointers back now points to those sectors that still contain the data.

    Pete
     
  14. bgoodman4

    bgoodman4 Registered Member

    Joined:
    Jan 13, 2009
    Posts:
    3,130
    Is this not unreliable? What happens if you write over the file? I guess this is less of an issue if you don't let too much time pass between the creation of baselines (or rather between the current snap and the one you want to revert to) and if this is correct then it points out the added importance of regular imaging of the drive. I had thought that imaging was only important in terms of a drive melt down but I now suspect this is incorrect.

    Interesting program and one that a user needs to have something of an understanding about how it works in order to make proper use of (I think).
     
  15. ratchet

    ratchet Registered Member

    Joined:
    Feb 20, 2006
    Posts:
    1,906
    Jo Ann, question about AyRecovery and NOD32 SysRescue!

    You seem to be one of the definitive authorities on combining "snapshot" and "image" softwares so I turn to you. Does Ay need to be uninstalled before making the ESET SysRescue CD? Thank You!
     
  16. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,039
    HI bgoodman4

    You address a controversial subject...reliablity. Basically what the rollback family is doing is taking all windows IO and redirecting it thru a kernel level driver to it's own file system where it keeps track of where all the various snapshot sectors are. When working properly it works very well. However some people have had problems with it as if the rollback file system get's messed up, several snapshot can be lost. Early on system crashes were a problem, but the latest versions seem fine.

    As to imaging, there are many reasons to image. I use FDISR, but if I am installing something that could really impact the system, I'll image first, and then if there is a problem just restore. Drive failures are just one of many reasons to image.

    Pete
     
  17. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,039
    Re: Jo Ann, question about AyRecovery and NOD32 SysRescue!

    Hi Ratched

    Not sure who you are addressing this to, but if me, I really have no idea what the Eset SYSrescue CD is.

    Pete
     
  18. ratchet

    ratchet Registered Member

    Joined:
    Feb 20, 2006
    Posts:
    1,906
    Re: Jo Ann, question about AyRecovery and NOD32 SysRescue!

    Jo Ann usually jumps in these threads so that is why I addressed her. Here is the ESET NOD32 quote about their latest v4 product: "System Tools — ESET SysInspector and ESET SysRescue simplify diagnosing and cleaning of infected systems by allowing deep scans of system processes to find hidden threats, and creating bootable rescue CD/DVD or USB drives to help you repair an infected computer."
     
  19. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,039
    Re: Jo Ann, question about AyRecovery and NOD32 SysRescue!

    Ah. One thing to consider. Say one of your Rollback snapshots gets infected, that bootable CD probably won't ever see the snapshot files. At best all it will see is the baseline.

    If you build it from your system, it might work from a snapshot, but to be sure, I'd consider unstalling any Rollback variation.

    Maybe some who's done it will step in.

    Pete
     
  20. Jo Ann

    Jo Ann Registered Member

    Joined:
    Jan 6, 2007
    Posts:
    508
    Re: Jo Ann, question about AyRecovery and NOD32 SysRescue!

    ratchet,

    I'm hardly an authority (but i'm flattered that you consider me to be one). I can't give you a definitive answer to your question as I don't have any experience with those specific applications. However my best guess is that you should not have to uninstall Ay before creating any kind of Boot CD. But as Pete suggests, any AV scan performed from a boot CD will likely scan only Ay's baseline snapshot, so the use of a Boot CD for AV scanning would be of limited value while Ay is installed.

    JA
     
    Last edited: Mar 17, 2009
  21. ratchet

    ratchet Registered Member

    Joined:
    Feb 20, 2006
    Posts:
    1,906
    Thank you both for the input!
     
  22. bgoodman4

    bgoodman4 Registered Member

    Joined:
    Jan 13, 2009
    Posts:
    3,130
    Well I am glad to have found this out now rather than after there was a problem. I will take the appropriate steps to protect against this. Would I be correct that not deleting any snaps between imaging and new baseline creation reduce the probability of problems or is the daily writing of data to the drive still likely to overwrite a file that may be needed? Seems to me this issue would make RX much less secure as a way to deal with malware. Seems to me if malware overwrites or corrupts a system file RX will not be able to recover the system. They sure do not address this point in any of the literature on Horizons website.
     
  23. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,039
    I wouldn't worry to awfully much. Just test under the normal working conditions you use, and if okay you should be fine.

    I had problems, but in fairness, I was stressing my system with beta testing stuff, and also I have a raid 0 system and they don't officially support it.

    If it's working I wouldn't worry to much, but periodically uninstall and make a good image. Then you should be good to go. Just understand the way it works.

    Pete
     
  24. nexstar

    nexstar Registered Member

    Joined:
    Jun 23, 2004
    Posts:
    371
    Location:
    Southampton, UK
    It is important to understand that RollBack replaces the Windows drivers with its own so it controls what gets written to, or deleted from, the disk. Once it is installed, the pre-installation files will remain on the disk untouched. Any changes to those files will be recorded on sectors that only Rollback knows about.

    This is very efficient in one sense because your data is only stored once on the disk but this is also the achilles heel as any software which is allowed to write to the disk directly (without the RB driver running) has the chance of writing to sectors used by RB and so corrupting what RB has carefully secreted away. This makes imaging a RB system equally as important as any other non-RB system but, as long as you don't do unwise operations then it will provide great benefits in being able to go back and forth in time on your system.

    Graham
     
  25. appster

    appster Registered Member

    Joined:
    Jun 19, 2007
    Posts:
    530
    Location:
    Paradise (Hawaii)
    As you indicated Graham, any low-level program that bypasses Windows when writing to disk can corrupt RB, so such programs must be avoided when running RB!

    I would go as far to say disk-imaging is the very most important of all - representing the 'last line' of recovery.
     
    Last edited: Mar 17, 2009
Loading...
Thread Status:
Not open for further replies.