By Froggie - 21 May 2015 7:47 PM
The SUBJECT is the question... any help, greatly appreciated.
|
By Seekforever - 21 May 2015 8:12 PM
I don't believe so unless something has recently changed; it seems to be a VSS issue.
http://support.macrium.com/topic.asp?TOPIC_ID=5309
|
By Dreamer2004 - 21 May 2015 9:08 PM
Well, I believe Macrium Reflect does include the "System Volume Information" Folder.
You will not only find the restore points, but sometimes also some other "monster files" in that folder
due to defragging software like O&O Defrag....
If you want to get rid of them, you have to run cmd.exe as admin and type in:
vssadmin delete shadows / all
|
By Drac144 - 21 May 2015 10:48 PM
As long as we are stating what we believe. I believe that they are included because they are important files for recovering the system to a previous state.
Consider the following: your system crashes because a program installed several days ago has done something bad and not only was there a crash, but some important files were lost. So you restore from a backup and you get the files back, but the state is messed up (but you did not know it until the crash) so you want to restore to a state from several days previous - but NOT restore all files from that older date since they are not current. If the system state files are restored. this is easy. Restore from the latest backup and do the system restore from the older date. If the restore files are NOT backed up,. this becomes more difficult. I have faith that Reflect will not do something that makes my life more difficult.
|
By Arvy - 21 May 2015 11:08 PM
Speculative responses can be interesting, I suppose, but more authoritative answers have been provided by both Nick and Stephen in another thread: "System restore points are not included in the snapshot and can take up to 10% of the partition capacity." [Emphasis added] In fact, the partition capacity that they use depends on certain system settings and they can be disabled completely if desired.
|
By Froggie - 22 May 2015 3:48 PM
I must offer concern over the fact that Windows RESTORE POINTs are NOT INCLUDED in Macrium images... without them, they are not disk images per say. They are part of a user's restoration eggs basket and as such may be very important to many users.
...and the question I have is, if they aren't currently included, is there a mechanism to include them that I may avail myself of? If not, do I hit the "Wish LIst" thread?
This really should be a User configuration thing, not an imposition by the program author... Windows RESTORE POINTS are very important to many users and are indeed part of a partition's image. And this is supoosed to be an IMAGING program, right?
|
By Arvy - 22 May 2015 5:40 PM
Given Macrium's own answers that I linked above, I guess it would have to be a "Wish List" request, but it would probably need to be addressed to Microsoft as well as Macrium since the underlying issue relates to VSS snapshot handling. Macrium did post a "What is VSS, how does it work and why do we use it?" blog item that is now a few year old and it links to an even older MS TechNet article on the subject. In fact the technology itself is getting just a little "long in the tooth", but you may be interested in some of the online resources linked on this ForensicsWiki page including information on how to mount shadow volumes.
|
By Seekforever - 22 May 2015 6:35 PM
+xI must offer concern over the fact that Windows RESTORE POINTs are NOT INCLUDED in Macrium images... without them, they are not disk images per say. They are part of a user's restoration eggs basket and as such may be very important to many users. ...and the question I have is, if they aren't currently included, is there a mechanism to include them that I may avail myself of? If not, do I hit the "Wish LIst" thread? This really should be a User configuration thing, not an imposition by the program author... Windows RESTORE POINTS are very important to many users and are indeed part of a partition's image. And this is supoosed to be an IMAGING program, right?
If the issue really is the use of VSS, you could try imaging with the Rescue Media version on WinPE since it doesn't use VSS.
"Image" is really a misnomer these days. Speaking of imaging programs in general and not Reflect in particular, there is no guarantee that the contents of sector ABCD will be put back into sector ABCD. Then there are the other things like no hiberfile or pagefile restored. VSS may well have other omissions.
The way to get a real image is to use what is called the Forensic copying which every sector in the partition is copied whether in-use or not.
I don't really use Restore Points. If I'm doing some testing etc I just whip off an image of my Windows and Apps only C drive first. If I don't happen to do it, no big deal since there would only be some Windows updates and (very few) app/config changes to be made since the last image which is the advantage of keeping important data off C. I realize not everybody has the same requirements as I do.
|
By Drac144 - 22 May 2015 8:00 PM
As Froggie said, and as I said when giving my opinion on what Reflect does (and should do), there is a reasonable argument for backing up restore point files. Of course, that could increase the size of the backup by up to 10% as pointed out. System restore data is NOT changing during normal operation so backing it up should NOT be an issue and should not have to be limited to rescue media backups.
Not knowing the internal operation of Reflect, I do not know how difficult it would be to allow this as an option. But since restore points ARE related to data backup and restore it seems reasonable that a backup/restore program should not ignore them. On the other hand, considering the potential increase in backup file size, their inclusion should be an option the user can control.
Many people do backups at odd hours when they are not using their computer, so an option for the Windows based Reflect (as opposed to the rescue media based version) to backup without VSS should be allowed. I never use my computer while it is doing a full backup, although I do sometimes use it while it is doing its daily incremental backup. This is a user choice and if they want to avoid VSS issues and not use their system while backing up, that should not be a big deal for Reflect. If there is some issue that could compromise a restore if the above is allowed, that MIGHT mitigate the request to provide this option.
|
By Froggie - 23 May 2015 2:30 PM
Arvy / Drac144... do you know if this KB Article (Restore Points ON/OFF) is applicable to v6?
|
By Arvy - 23 May 2015 3:04 PM
Arvy / Drac144... do you know if this KB Article (Restore Points ON/OFF) is applicable to v6?
WARNING: I have not actually tried the utility in the referenced KB article myself. This answer therefore contravenes my normal practice and includes some "guesswork" speculation. It is based, in part, on the answer provided by Stephen in another forum thread.
My guess is that the MRRestorePoints.exe utility merely modifies certain Windows registry entries that affect Reflect's VSS snapshot behaviour. In particular, I would expect that it works on the registry key "HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshotMacriumImage" to alter or remove the RestorePoints value which is normally set to "$AllVolumes$\System Volume Information\*{3808876B-C176-4e48-B7AE-04046E6CC752} /s" on my system. If that is so, then the behavioural results of the MRRestorePoints.exe utility would be the same regardless of the particular version of Reflect under which it is used. Note the cautionary statements about reliability of the 'Shadow Copy Optimization Writer' in the above-linked forum thread however.
P.S.: As a matter of purely academic interest, examining other registry keys and values under HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore indicates that the exclusions for MacriumImage are far fewer and much less extensive than those used in other "normal" VSS snapshot behaviour. So I can't see anything especially problematic about removing the singular remaining RestorePoints exclusion entry. Maybe Nick or Stephen can enlighten us both in that respect.
|
By Drac144 - 23 May 2015 10:16 PM
Wow, I had no idea that the utility existed. It looks like it might set a registry entry. The description looks like it does exactly what we have been discussing. I expect it would apply to V6 (though I was wrong about SR points being included).
(Arvy, I did not see your post when responding with the above - but what you suggest sounds reasonable.)
|
By Arvy - 24 May 2015 11:51 AM
Very kind of you to say so.
It is especially interesting to note that Windows own registry entries under HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot do not specify the exclusion of RestorePoints from its "normal" VSS snapshots. That RestorePoints exclusion seems to be unique to Macrium's VSS snapshot specifications only. At least that is the case with my own system setup under both Win7 and Win8.1.
|
By Drac144 - 24 May 2015 11:27 PM
That makes sense. Based on the specification-centric world, anything Macrium can do to make the size of the backup files smaller will improve sales. This is clearly one simple change that can significantly reduce backup size. And if customers (i.e. people who already purchased Reflect) want to include the restore points, Macrium can (and apparently did) just provide a patch.
The biggest issue is that patch is apparently a little known feature.
|
By Arvy - 25 May 2015 1:03 AM
Seems to me like it would make a lot more sense and be much more convenient than some obscure separate "patch" if it were just one more optional setting along with all the others in the Reflect app itself for handling registry entries, backup definition XMLs, retention rules templates, etc. In fact, since this particular option involves just a single registry value change, it would be a comparatively trivial one for Macrium to implement if requested by Froggie or others in the "Wish List" I would think.
__
EDIT: I see now that Nick has replied to Froggie's question in his other thread saying that Reflect's MRRestorePoints.exe utility should not be used at all with either v5 or v6 because restore points "are invalidated by the snapshot and cannot be used." That's quite puzzling since restore points aren't excluded from Windows own "normal" VSS snapshots, but the official answer seems to rule out their inclusion in Reflect's backup images (except in a WinPE environment) regardless of whether it's done by using a separate "patch" or as a built-in option.
I knew my habit of using WinPE for backup ops must have some good reason; I just didn't know what it was. 
|
By Nick - 25 May 2015 12:16 PM
Hi
Thanks for all of your posts.
I'm afraid that even though System Restore Points can be included in a disk image they are not valid when restored and cannot be used. The KB article is not correct and will be removed. Please do not use the utility MRRestorePoints.exe or modify FilesNotToSnapshotMacriumImage in the registry.
To include System Restore Points please create images from within Windows PE as this does not use VSS.
|
By Dreamer2004 - 25 May 2015 6:08 PM
+xTo include System Restore Points please create images from within Windows PE as this does not use VSS.
As Win PE does not use VSS, might it be possible to EXCLUDE files & folders when creating a system image (from within the Win PE rescue environment only)??
This would be a nice feature in the future!
|
By Arvy - 25 May 2015 8:13 PM
I think you have it slightly backwards. It's the 'Shadow Copy Optimization Writer' that allows and handles exclusions from snapshots for imaging purposes and that is not available in the WinPE environment. In any case, we're drifting off topic for this particular discussion which is about including restore points in backups based on the argument that a true partition image should be complete in all respects.
|