Quantcast
Channel: Saul Painter – Macrium Software Blog
Viewing all 33 articles
Browse latest View live

Macrium Central Management Console in a Nutshell

$
0
0

image2016-7-21-15-27-10
It’s finally here! We’re pleased to announce the release of Macrium’s Central Management Console (CMC). To tell us a bit more about CMC and Macrium’s plans for the future, we speak to Stephen Macpherson, Sales Director at Macrium Software.

What made Macrium decide to create a CMC?

We had been getting lots of requests from our customer base for a management tool and it was a very obvious extension to our product portfolio as well as a nice compliment to the speed and power of the Macrium Reflect family.

What are the main features of the CMC?

I think the main feature is the ability to manage large numbers of Macrium Reflect end-point back up agents making the job of the IT Administrator much easier. They can simply manage deployment of the agents, quickly configure backup jobs, manage repositories and monitor the backup process. Of course, the recovery is vital too and incredibly fast and easy.

You can see a full list of all the features here and also try out a free trial!

How does CMC work with the existing Macrium Reflect product family?

All existing stand-alone products will work with the CMC although they do need to be version 6.1 or later. Almost all Reflect products can be incorporated into the CMC which makes central management much more straight forward than in the past.

Who do you see benefiting from the new CMC?

It will benefit administrators who already have Macrium solutions in their estate and want to reduce their administrative workload. They may also want to take advantage of the great backup capabilities we have across more machines, and CMC allows you to do that really easily.

What’s next for Macrium?

We’re currently looking into integration with cloud backup repositories which we have already been testing and at the same time considering a managed service provider version. We will continue to provide a steady stream of updates supporting the latest versions of Microsoft operating systems.


You can read more about the CMC (and download it for free) here!!


Techie Tuesday: The Macrium Rescue Environment

$
0
0

#TechieTuesday

Absolutely the first thing you need to do after purchasing and installing Macrium Reflect is create rescue media.

If you lose your Windows operating system, you can start your PC using Macrium Reflect rescue media on CD, DVD, or USB stick. This makes creating rescue media the first thing you need to do with Macrium Reflect. It contains a bootable, lightweight version of Windows and a full version of Macrium Reflect.

This lightweight version of Windows is called Windows Pre-installation Environment (also known as Windows PE or WinPE) and is provided by Microsoft. When you create rescue media, Macrium Reflect downloads Windows PE automatically for you and writes it to your media. It downloads just those components you need to rescue your system.

You have the option of restoring to a new system or virtual machine using Macrium ReDeploy to reconfigure your windows installation for the new hardware.

Windows PE and the rescue environment

Windows PE is a reduced version of Microsoft Windows that is designed to boot from CD, DVD or USB on a wide range of hardware. When you run the rescue media wizard, Macrium Reflect automatically downloads the Windows PE components from Microsoft and builds the rescue environment locally. The Macrium Windows PE rescue media has the following features:

  • Fixes for boot problems
  • Macrium ReDeploy to prepare Windows to load on new hardware
  • RAID support
  • USB 3.0 support
  • CD boot
  • USB boot
  • Boot menu
  • Full version of Macrium Reflect
  • Reduced download size compared with full Windows Automated Installation Kit (WAIK) – 150 MB to 450 MB (depending on PE version and 32- or 64-bit support)

Windows PE hardware support

The Macrium Rescue Environment needs to include support for your hardware such as USB ports, network interfaces, and in particular for your storage device if for example you use RAID disks. The default Windows PE environment supports a good selection of hardware and you can add support for further devices. When Macrium Reflect creates a rescue CD or USB, it analyses your system hardware and tries to locate drivers for unsupported devices by looking on your system. If it can’t find appropriate drivers, Macrium Reflect prompts you to provide drivers. You can provide drivers by finding driver packages on the local hard drive, looking for driver CDs supplied with the system, or downloading drivers from the web. After you provide these additional drivers, Macrium Reflect adds them to the Windows PE environment.

Note: You cannot add support for booting media because booting takes place before drivers are loaded. For example, if your CD drive is connected via an unsupported SCSI interface card or your boot menu lies on an unsupported RAID array, then the Windows PE cannot boot. Booting using a USB stick is a good workaround in this case as all USB 2 interfaces are supported by default.

Note: You can also overcome this issue using this solution.

CD, DVD and USB rescue media 

You can boot your computer into Windows PE from a CD, DVD, USB stick or USB attached external hard disk. For convenience or for automated restores to your system disk, you can add Windows PE to a boot menu that’s displayed when your system first starts. Although, do not rely upon this local copy as a rescue mechanism because it could be lost if you suffered hard disk failure or corruption leaving you without a method for rescuing your system.

Macrium Reflect creates custom Windows PE systems for each installation type by downloading the required components from Microsoft.


The Rescue Media Wizard

  1. Insert your blank CD, DVD or USB stick.
  2. From the Backup tab of the task pane, below Other Tasks, click Create bootable Rescue media.Accept the default Windows PE environment selected by Macrium Reflect or Click ‘Change PE Version’ to use a different version of Windows PE for your rescue media:Explanation of the ‘Change PE version’ dialog…
    • The device is supported by default in WinPE
    • There is a compatible driver in the host operating system
    • There is a compatible driver already present in the collection of drivers on previously created rescue mediaClick Next and add device drivers if required.This dialog enables you to add drivers for any Network and Disk controllers that are unsupported in Windows PE.A device driver is a collection of files (also referred to as a driver package) and generally comprises of:
      • The driver software, these files have a .SYS extension.
      • The driver information, or INF, file which contains the installation instructions for the drivers, these files have a .INF extension.
      • An optional security catalog that signs those drivers for operating systems that require signed drivers, commonly used on x64 operating systems, these files have a .CAT extension.
      • One or more optional supporting software library files (Dynamic Link Library) that contain further code to support the driver software, these files have a .DLL extension.


      Windows PE (WinPE) is packaged with a large collection of drivers but there are many devices that are not part of the WinPE driver package. If your device is not compatible then you must add its driver so WinPE recognizes it and communicates with your device.

      The wizard checks whether your device requires drivers adding to WinPE. It builds a list of devices in your computer that are either Hard Drive/RAID controllers, Network Interface Cards, USB controllers or USB hubs. For each of these devices it checks if:

    Example of adding a device driver…

  3. Click Next. to prepare and build the Windows PE imageNote: If you have already built the Windows PE image for this rescue media then the wizard will skip this step and advance to the Burn page<
    Option Descriptionth>
    PE Architecture Either 32 bit or 64 Bit. The default option is selected to match the architecture of the host Windows OS.
    Include optional components Select this option to add BitLocker Encryption and iSCSI support to the rescue media. Please note that adding these components may several minutes to the creation process.
    See Adding iSCSI support to Windows PE for more information on using iSCSI in Windows PE
    Automatically unlock BitLocker encrypted drives Select this option to automatically unlock all BitLocker encrypted drives when Windows PE starts.
    See Adding BitLocker support to Windows PE for more information on using Windows PE to access BitLocker encrypted drives.
    Default base WIM Use the standard Microsoft Windows PE base installation. Macrium Reflect executables will be added to this to crate the rescue media,
    Custom Base WIM Use your own customized WIM for the rescue media. This is an advanced topic not covered in this help.

    Click Next to begin the WIM build process. If necessary, files will automatically be downloaded from Microsoft to complete the build process.

    You can also select the PE Components .zip file by clicking the ‘Browse’ button in the download dialog. The PE .zip file can be downloaded by using the Reflect download agent ‘ReflectDL.exe’.
    See Installing and updating Macrium Reflect offline for more information on downloading the PE components separately.

    A detailed log of the build process is saved to: ‘C:\ProgramData\Macrium\waik\waiklog.txt’

     

  4. Once complete you can choose where to burn the media<
    Option ________________ Description
    Rebuild Click this button to advance to the ‘Prepare Windows PE image’ wizard page to rebuild the Windows Image (WIM).

    Note: If updates are available for your rescue media then you will receive a message box prompting you to rebuild.

    Check for unsupported devices Select this option and Windows PE will prompt to add drivers for unsupported Network Interface and Disk controllers when started.
    Prompt for key press Select this option to enable the ‘Press any key to boot from CD or DVD…’ prompt when your PC starts. This is useful if you want to bypass Windows PE and boot into your host Windows OS.
    CD/DVD burner Select this option to choose a CD/DVD device that you are using to create your rescue media.

    To save the rescue media to an .ISO image file for burning with any burning software. Click the drop-down list of burners and select ‘Create an ISO image file’:

    USB Device Select this option to save your rescue media to a bootable USB stick or external hard drive.
    Enable multiboot MBR/UEFI Only applies if you are saving your rescue media to a USB device. This option enables the USB device to boot both legacy MBR and GPT/UEFI for modern motherboards. Please consult your motherboard user manual for information on choosing these boot options at PC startup.

    Note: CD/DVD media is always created multi-boot MBR/UEFI

    Technicians USB Applies to Macrium Reflect Technicians license keys only. See Technicians portable application support for more information

     

  5. Click Finish.to create your rescue media

To complete the process, boot from your Rescue media to ensure it works correctly.

After Windows PE loads, Macrium Reflect runs. The Windows PE user interface for Macrium Reflect is identical to that of the main application and offers the same core functions.

If you are using USB media, you can make the Macrium Rescue Environment compatible with multiple computers:

  1. Use the Rescue media wizard to create a bootable USB rescue device on one computer.
  2. Repeat the process with each other computer in turn using the same USB device.

You can read more about creating rescue media here.

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: image or clone?

$
0
0

#TechieTuesday

Both a clone and an image are an exact duplicate of your drive or partition: data, files, software, the master boot record, allocation table, and everything else needed to boot and run your operating system. Should your hard drive fail or become corrupt, a clone or image backup can quickly recover your PC and you can get back to work. But which is the right one for you?

Image

A Disk Image stores the information required to completely restore disks (or their individual partitions) exactly as they were when the image was taken. You can store several compressed disk images on one sufficiently large external storage device, so you can have the option to restore any one of them.

The entire contents of the imaged file system are stored in a full image file. This is a reliable way of backing up your PC, however, repeating the process can be slow and subsequent images can fill your backup media very quickly. After you have created an initial full image, you can create differential and incremental images. These are both quicker to execute than full images and create much smaller image files.

A differential image stores the changes that have been made to the imaged file system since the last full image. Subsequent differentials can be taken, but only one differential and the full are required in order to fully restore the system. This is quicker than creating a full image, however the longer the time between the full and the differential, the larger the differential image file is and the longer it takes to create.

The main difference with incremental images is that they only store file system changes since the last image, either full, differential or incremental. The resultant backup set therefore consists of a full image and a number of incremental images which must all be present in order to restore the system correctly.

Clone

Cloning with Macrium Reflect creates an exact copy of an entire hard drive, or specific partitions on a hard drive, to a different drive. Everything on the target disk is overwritten and you are left two identical drives.

This is useful if you are upgrading to a larger hard drive or moving from a large magnetic hard disk to a smaller and faster SSD. When you Clone a hard drive, you can boot from the target disk on the same system with the state of your computer at the time you undertook the clone. But Windows cannot boot from a USB connected drive; this is a restriction imposed by Windows. You can clone to a hard drive installed in your computer or to a hard drive installed in a USB hard-drive Caddy. If you clone your system disk to a USB connected external drive then, to boot your clone the physical disk must be removed from the USB caddy and attached to your Motherboard SATA port.


You can read more about both here: Macrium KnowledgeBase: Backup, imaging and cloning

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Reviewing your backup history

$
0
0

#TechieTuesday

Macrium Reflect maintains an easy to access log of all types of backups and restores where you can review activities, purge the log files and view Windows VSS events.

  1. In the main task bar click Log.
    log
  2. Clicking the Delete old logs icon will take you to the Log file purge settings, where you can select to remove old logs.
    delete
  3. Make selection and click OK.
  4. Select the activity you want to review.
    review
  5. If the activity has a VSS log, select to view VSS events, if required by clicking the View window VSS events icon.
    vss

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Re-deploying Windows to new hardware using Macrium ReDeploy

$
0
0

#TechieTuesday

Introduction

Macrium ReDeploy overcomes issues with Windows boot processes to run a Windows installation on new hardware. There are a variety of scenarios where you move a windows installation to a new machine, for example:

  • Due to hardware failure or planned upgrade.
  • Moving between a physical and a virtual machine (P2V / V2P).
  • Changing a non-raid to a raid installation or legacy SATA to AHCI SATA.

Aspects of the Windows boot process can cause a boot failure after significant changes to the hardware, ReDeploy can overcome these.

Discovering hardware and association with matching device drivers is time consuming and must be undertaken while windows is being installed. It is skipped during a normal Windows boot making the boot delay acceptable.

Early in the boot process, the boot loader loads the Windows kernel (the core of the operating system) and the critical drivers required to get Windows up and running. If the new hardware configuration requires a new driver to read the disk containing the operating system then Windows will fail to boot.

When the kernel and critical drivers are loaded, the kernel starts. The kernel and its associated hardware abstraction layer (HAL) need to match the motherboard for best enabling. Drivers are optionally loaded to handle specific central processing unit (CPU) features. For a stable system, the driver needs to match the hardware, in this example, the CPU model.

ReDeploy detects changes to critical system features, locates relevant drivers and injects them into your Windows operating system so it boots.

ReDeploy makes the complex process of getting an off-line Windows operating system running, as easy and intuitive as possible. It does not, however, install the complete driver set for the new hardware. You can complete the driver installation for devices such as network and graphics adapters when your windows installation boots on your new hardware.

You need to run ReDeploy from the Windows PE Reflect rescue CD. This allows the new hardware to be detected and the configuration of the Windows system modified to enable it to boot.

Note: To transfer to a Windows Server install to new hardware use Macrium Reflect v6 Server edition for ReDeploy.

For non-server (workstation) installs use ReDeploy included with v6 Home, Workstation or the Server Edition. Please note that ReDeploy is not included in 30 trial versions of Macrium Reflect

Note: ReDeploy modifies an existing offline operating system to work with new hardware. Restore your system image to the PC being deployed before running ReDeploy. There is no need to reboot your PC after restoring an Image and before you run ReDeploy.


  1. Boot the target PC with the Windows PE rescue CD or USB equivalent. (There is a link to a video on creating a Windows PE rescue CD at the bottom of this page).
  2. Click ReDeploy Restored Image to new hardware.
  3. If you have a multi-boot system, then you will be presented with a list of operating systems, select the operating system to be redeployed. Click Next.
  4. Specify driver locations for your mass storage devices (such as RAID card).
    1. If you haven’t already, insert a driver disk for the hardware you are going to boot from.
      This will typically be the motherboard or RAID card driver CD.
    2. Click Add to add driver locations.
      You can also specify additional paths such as network folders.
    3. Click Map Drive to add a network share.
    4. Click Next.
  5. ReDeploy searches through user specified driver locations. If none are specified or no matching drivers are found then it searches removable devices such as CD’s and disk drives. ReDeploy also searches through Windows’ database of drivers.
  6. ReDeploy seeks drivers for all discovered mass storage devices and displays a list with details, Click Next.

    For each mass storage device, there are three possibilities:
    1. The driver is already installed. It might still need to be enabled at boot, this is done automatically.
    2. The driver is located, either from a CD, user specified path or from the Windows database. This driver is installed on completion of ReDeploy.
    3. No matching driver is located.
  7. If no driver is located, or you choose to override the displayed driver, then use locate driver to manually specify an .inf file.
    If you have multiple mass storage interfaces in your system, you only need to locate drivers for hardware that contains the Windows system and active partitions.
  8. Review displayed options, leaving them as default if possible. Click Next.
    If you are having trouble booting these options can help to resolve issues. For more information about them options see below:
    Option Description
    Disable reboot on system stop Set this option to stop automatic rebooting if a blue screen of death (BSOD) occurs while Windows is loading or running. If this option is not set and Windows generates a BSOD, there will be no time to note the BSOD error codes.
    Display boot drivers as they load Set this option to show which drivers are being loaded as Windows loads. Once Windows is loading and running without issue this option can be reverted using the Windows MSCONFIG utility. You can use the Pause/Break key to freeze the list as it scrolls past, use space to un-pause.
    Enable boot logging Set this option to log drivers being loaded by Windows as it loads. The resulting log file ‘ntblog.txt’ can be found in the windows folder. Once Windows is loading and running without issue this option can be reverted using the Windows MSCONFIG utility.
    Disable CPU Driver Set this option to disable CPU drivers. This may be useful if you see BSOD’s in the selected HAL drivers or system lockup on entering standby or shutdown.
    Set Hardware Abstraction Layer Set this option to choose which Hardware Abstraction Layer is to be used in the selected Windows operating system. The recommended HAL for this machine is the one initially selected. If you have the incorrect HAL configured, your Windows installation is unstable and can cause random BSOD’s or lock ups after Windows boots. In particular, if you are redeploying from or to Virtual Box with an advanced programmable interrupt controller (APIC) unchecked (the default) or very old physical hardware, set a new HAL.
    Allow Windows to detect Hardware Abstraction Layer Set this option to allow Windows to determine the best Hardware Abstraction Layer to use at boot time. This is a Vista and later only option.

     

    Enable SATA AHCI Set this option to enable support for generic SATA AHCI hardware. You will typically also need to enable an option in your BIOS for your mass storage hardware to operate in this mode. This is a Vista and later only option.

     

  9. Review the actions to be be performed and click Finish to apply them to the target operating system.A log file ReDeploy.log saves to the drive containing the redeployed operating system.After clicking Finish to inject drivers and apply your settings you see a confirmation dialog, and you can reboot your OS which should now be compatible with your new hardware.

Note: Check there is a tick in the checkbox against Check for unsupported devices each time the rescue media loads before burning the Windows PE rescue CD, so that you can add additional drivers when you boot on new hardware.


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Adding BitLocker support to Windows PE

$
0
0

#TechieTuesday

Note: It isn’t absolutely necessary to unlock a BitLocker encrypted drive when restoring an image of the encrypted partition. The partition will restore without a problem and will be automatically re-encrypted on reboot, however, unlocking the drive in Windows PE enables intelligent sector copy imaging and cloning, RapidDelta Restore (RDR) and also free access to the drives contents using PE Explorer.

Automatically unlocking BitLocker encrypted drives

Macrium Reflect can include the components and decryption keys necessary automatically to unlock Microsoft BitLocker encrypted drives in Windows PE.

In the Rescue Media Wizard select ‘Include optional components’ and ‘Automatically unlock BitLocker encrypted drives’

When Windows PE starts any BitLocker unlocked drives that are were attached when the recovery media was created will be automatically unlocked in PE.


Unlocking BitLocker encrypted drives using a USB stick

Automatically unlocking encrypted drives when PE starts may present an unacceptable security risk for some users. Automatic unlocking requires no user intervention and the Macrium Reflect boot menu is able to access encrypted drives without password entry. An alternative method is to de-select the ‘Automatically unlock BitLocker encrypted drives’ option in the rescue media Wizard:

You can then save BitLocker Encryption Key files (.BEK) and/or BitLocker password TXT files to the root of any USB stick. This could also be a Windows PE rescue media USB stick.

  1. In Windows Explorer, right click on any BitLocker encrypted drive and click on ‘Manage BitLocker’.

  2. In the newly opened window click ‘Back up your recovery key’

  3. In the BitLocker Drive Encryption wizard select ‘Save to a USB flash drive’ and chose the USB device you want to save to.

    After choosing the USB device you want to save the Recovery Key file to, click ‘Save’ and then ‘Finish’ in the BitLocker Drive encryption wizard. This action will save a .BEK file and/or a recovery password text file to the chosen USB device.

    Note: The .BEK file is a protected operating system file, it is hidden by default and won’t be visible within Windows Explorer. it can be made visible by changing Folder Options and de-selecting the option to ‘Hide Protected operating system files’.You can add as many keys as you have encrypted drives.

When Windows PE starts ensure that your USB flash drive is attached to your PC. Your encrypted drives will then be automatically unlocked when Macrium Reflect initializes.


Note: PE 10 1607 is only relevant when using BitLocker XTS or iSCSI, otherwise it’s a wasted download. So, if you are already using PE 10 then Reflect checks for XTS BitLocker encrypted partitions and only downloads 1607 if you are.

You can force a rebuild using PE 10 1607 by setting the following registry entry and rebuilding your rescue media.


Download a 30-day Trial of Macrium Reflect for Home or Business use.

New Feature: Automatic System Restore

$
0
0

Note: These steps require Macrium Reflect v6.3 or later. To upgrade to the latest release take the ‘Other Tasks’ > ‘Check for updates’ menu option.

This post describes the steps involved to setup a ‘one-click’ system restore. Using Macrium Reflect you can automatically and easily return a Windows PC to a previously imaged system recovery point.

  • System restore is completed without any user interaction during the restore process.
  • Using Rapid Delta Restore (RDR) recovery is fast!
  • BitLocker encrypted drives can be restored without requiring re-encryption after restore.
  • The restore can be password protected to prevent accidental or unauthorised recovery.

Add the Macrium recovery boot menu

The first step is to add the Macrium boot menu. Take ‘Other Tasks’ > ‘Add Recovery Boot Menu’ in Macrium reflect and follow the instructions here: Adding a boot menu option for system Image recovery.

Adding a boot menu is optional but will enable simple one-click restore when the PC starts.
Without a boot menu you can still automatically restore by booting into optical rescue media or an external USB drive.


Create an image of drive C:

Start Macrium Reflect, select ‘Image this partition only…’ for drive C.

Choose a location that will be accessible when the recovery media boots, this could be a spare partition on an internal drive or an external USB disk or flash drive.
In this example we’ll choose drive ‘F:\’, an internal partition.


Prepare the auto restore XML file

Once the image completes we can prepare the xml file to automatically restore the image. To do this we need to step through the restore wizard but we aren’t going to start the restore.

Start Macrium Reflect, click the ‘Restore’ tab, select the image created above and click the ‘Restore Image’ link.

In the Wizard that opens, click through to the final wizard page and press the Ctrl+Shift+S keys together.

In the save dialog that opens, save the file ‘macrium_restore.xml’ to the root of any local drive that is accessible when Windows PE starts,

In this example we’re saving to the root of the same drive that contains the image file, drive ‘F:\’.

Note: Do not save to drive C: as this drive be overwritten during the restore process.


Password protect the restore

The auto restore can be password protected for security. Instead of Ctrl+Shift+S press Ctrl+Shift+P and a Password dialog is displayed:

After entering a password you’ll be prompted with the ‘Save As’ dialog as shown above.

This password must be entered to start the restore process.

Finally, Open Windows Explorer, navigate to ‘macrium_restore.xml‘ and make the file read-only, This ensures that the restore can be repeated. If the file is not read-only it will be deleted as soon as the restore starts.Right click on ‘Macrium_Restore.xml’, select ‘Properties’, click ‘Read-only’ and click ‘OK’:

That’s it! Now whenever you take the Macrium System Recovery boot menu option your system will be automatically restored using the image created above.

Techie Tuesday: New Feature – Logging file changes for Incremental and Differential Images

$
0
0

#TechieTuesday

Your Windows operating system and installed applications can create many changes ‘under the hood’ without you knowing about it. This can cause Incremental or Differential images to be substantially larger than expected. This article describes a feature in Macrium Reflect to log files that have been changed in each Incremental or Differential image.

Please Note: Macrium Reflect must be at v6.3 or later. Please take the ‘Other Tasks’ > ‘Check for updates’ menu option in Reflect if you are running an earlier release.


What are Incremental and Differential Images?

Incremental images will only backup data blocks that have changed since the last Image or, in the case of Differential, Full image in the backup set. Images are created at File System cluster level and each block is MD5 hashed and compared. Blocks with the same hash signature aren’t included in the Differential or Incremental image file. A data block is usually 16 clusters in length.

See also: How backup sets are created and maintained


How to show changed files

If the following registry entry is set, Reflect will perform a reverse ‘look-up’ to identify the file for each cluster that is backed up.

Please Note: This may increase the time taken to backup and should only be used for diagnosis.

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Macrium\Reflect\Settings
Name: LogIncrementalChanges
Type: DWORD
Value: 1

Once the registry entry is set, perform another Differential or Incremental Image and, once complete, delete the registry entry created above. Then use Windows Explorer to navigate to: ‘C:\ProgramData\Macrium\Reflect’ in Windows Explorer and sort by Modified Date:

In addition to the normal ‘.html’ and ‘.vsslog’ files you will also see files with ‘.inc.log’ at the end. There will be one for each NTFS partition in the Differential or Incremental.

The first file, {IMAGEID}-XX-YY.inc.log, is the log for the first NTFS partition, the next file is , {IMAGEID}-XX-YY1.inc.log and,

in the above example, {IMAGEID}-XX-YY3.inc.log is the last last NTFS partition in the image.


Example log output

MFT Record - 32 - .\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf 
MFT Record - 34 - .\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002 
MFT Record - 38 - .\Windows\Prefetch\AgGlGlobalHistory.db 
MFT Record - 39 - .\Windows\Prefetch\AgGlFaultHistory.db 
MFT Record - 43 - .\Windows\Prefetch\AgRobust.db 
MFT Record - 45 - .\Windows\Prefetch\AgGlFgAppHistory.db 
MFT Record - 1236 - .\Windows\SoftwareDistribution\SelfUpdate\WuPackages.xml 
MFT Record - 1333 - .\Program Files (x86)\TeamViewer\Version8\TeamViewer8_Logfile.log 
MFT Record - 1353 - .\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf 
MFT Record - 1592 - .\Users\Dev\AppData\Local\Google\Chrome\User Data\Default\Current Session 
MFT Record - 1783 - .\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Log\ERRORLOG 
MFT Record - 13900 - .\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Admin.evtx 
MFT Record - 15637 - .\Windows\WindowsUpdate.log 
MFT Record - 15741 - .\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx 
MFT Record - 15743 - .\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx 
MFT Record - 15755 - .\Users\Dev\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\http_localhost_2904.indexeddb.leveldb\LOG 
MFT Record - 15868 - .\Windows\bootstat.dat 
MFT Record - 21541 - .\Windows\security\database\secedit.sdb 
MFT Record - 21544 - .\Windows\ServiceProfiles\LocalService\NTUSER.DAT 
MFT Record - 21565 - .\Windows\ServiceProfiles\NetworkService\NTUSER.DAT 
MFT Record - 22562 - .\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpCmdRun.log 
MFT Record - 22649 - .\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 
MFT Record - 22650 - .\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 
  
And so on......... 

Each log file lists the MFT record and full path name to the file(s) that have changed.

Please note: There will be many MFT metadata files (prefixed by ‘$’) that are not visible to Windows Explorer or any other windows utilities, but these are always included (if changed) in Diff/Inc image files.

Please note: This doesn’t mean that all clusters in the listed files have changed it means that the file clusters are scanned and differences have been detected.


Download a 30-day Trial of Macrium Reflect for Home or Business use.


Techie Tuesday: Differential and incremental disk images

$
0
0

#TechieTuesday

The entire contents of the imaged file system are stored in a full image file. This is a reliable way of backing up your PC, however, repeating the process is slow and subsequent images can fill your backup media very quickly.

After you have created an initial full image, you can create differential and incremental images. These are both quicker to execute than full images and create much smaller image files.

Note: With the Free Edition of Macrium Reflect you can only make full and differential images of your disks and partitions.

Differential Images

A differential image stores the changes that have been made to the imaged file system since the last full image. Subsequent differentials can be taken, but only one differential and the full are required in order to fully restore the system.
This is quicker than creating a full image, however the longer the time between the full and the differential, the larger the differential image file is and the longer it takes to create.

Advantages of differential images:

  • Differential images created after the initial full Image are very quick because only file system changes since the full backup are saved.
  • The amount of disk space used by differential images is significantly less than that of full images.
  • Only two image files are required to restore the system.

Disadvantages of differential images:

  • As the time since the last full image was taken increases, the size of the differential grows as does the time it takes to create the differential image.
  • In order to reduce this time, it is necessary to perform a full image occasionally to reduce the size of the subsequent differential images.

Incremental Images

The main difference with incremental images is that they only store file system changes since the last image, either full, differential or incremental. The resultant backup set therefore consists of a full image and a number of incremental images which must all be present in order to restore the system correctly.

Advantage of incremental images:

  • Incremental images have the same advantages as differential images, but since they only store the changes that were made since the last full or incremental. They are always small and very quick to make, especially if done frequently.

Disadvantage of incremental images:

  • All files must be present in the image set. If any intermediate incremental images are missing, it is not possible to restore the system to the latest backup.

Maintaining backup sets

Maintaining backup sets can seem an onerous task, however, Macrium Reflect takes care of all the hard work for you. With Macrium Reflect you can schedule incremental or differential backups automatically. It is as simple as selecting the image you wish to restore and Macrium Reflect automatically selects the required files in the image set as part of the restore process. The same is true for exploring an image. If you choose to explore an incremental image in an explorer window, Macrium Reflect reconstructs all the files that have been backed up to that time.

Macrium Reflect also includes functionality to automatically delete expired image sets. For example, if you take a full image every month and then incremental images every day, you can configure Reflect to keep two full image sets (the equivalent of two months of backups) and delete any older files. As a result, your backup media does not become full of obsolete image files.

Selecting an incremental or differential backup

The process for creating a differential or incremental backup is the same. Both save changes since the full backup if this is the only backup made so far.

  1. Initiate an incremental or differential backup, select Backup Definitions Files. In this instance, there is one saved XML definitions file MyBackup.xml which contains the configuration required to back up the C drive.
  2. Right click MyBackup.xml and select Run Now.
    You are presented with a number of options.
  3. Select Full, Incremental or Differential to automatically execute that particular backup. If unsure which you want to run, click Prompt.
  4. Click Finish.
  5. When the Image is complete close the dialog.

Alternative method using an existing backup

  1. Click the ‘Restore’ tab
  2. Select either Image Restore or File and Folder Restore.
    This presents a list of image or file and folder backup files
    .
  3. Select the file that you want to create an incremental or differential from.
  4. Select Other Actions… link, and choose ‘Differential’ or ‘Incremental’

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Cloning a disk

$
0
0

#TechieTuesday

It is possible to clone an entire hard drive or specific partitions on a hard drive. This is useful if you are upgrading to a larger hard drive. With Macrium Reflect you can boot the target disk on the same system after cloning. Cloning your hard drive creates a bootable new hard drive with the state of your computer at the time you undertook the clone.You can clone to a hard drive installed in your computer or to a hard drive installed in a USB hard-drive Caddy.
Important

Windows cannot boot from a USB connected drive. This is a restriction imposed by Windows. If you clone your system disk to a USB connected external drive then, to boot your clone, the physical disk must be removed from the USB caddy and attached to your Motherboard SATA port.
Deleting and re-configuring existing partitions or configuring new partitions is possible with Macrium Reflect, so you don’t need to do this prior to cloning.
Show important information about MS Dynamic Volumes…

  1. Select the disk you wish to clone in the main application window and Click ‘Clone this disk’..

  2. In the wizard that opens Click Select a disk to clone to…
  3. Select the hard disk you wish to clone to. In this case, there is only one disk available.
  4. If you do not want to modify the order or size of partitions of the clone, click Next. This is the default behavior.Alternatively, drag the partitions you want to clone, the red arrow below shows this.

    Becomes

    In this example, there is 400MB of free space after the copied partition. You can modify the size of each partition to fit the new disk if required.You can delete partitions on the target disk by selecting and clicking ‘Delete existing partitions’..
  5. To modify the partition sizes, click Cloned Partition Properties and adjust the size of the partition by:
    1. Setting the partition size precisely using the Partition Size entry box.
    2. Resize the partition automatically by clicking Maximum size, Minimum size or Original size.

  6. Click OK.
  7. If required, click Advanced Options to change settings for this clone:

    Option_____________ Description
    Intelligent sector copy Copy only file system sectors/clusters that are in use. This reduces the time to create the clone as unused file system clusters are not copied.
    Verify File System Verifying the file system prior to cloning ensures that there are no file system errors transferred to the clone.
    Please note that this may take several minutes to complete
    Rapid Delta Clone Copy only file system differences between the clone source and target. This increases cloning speed dramatically.
    Show more information on RDC…
    Enable SSD TRIM Enable SSD TRIM on the clone target to optimize the disk.

    Show more information on SSD TRIM…

    Forensic Sector Copy Copy every sector from the source to the target disk partition.
    Please note tat this option is only necessary if you want to copy unused file system space and will significantly increase the time to complete the clone.
  8. Click Next.
    The options to Add Schedule, Edit Schedule or Delete Schedule is displayed.

    Click ‘Add Schedule’
    to optionally schedule your clone

    Make any required changes and click Next.
    For more information see Scheduling backups.
  9. Review the settings and click Finish.
  10. Verify the settings in Backup Save Options and if appropriate, click OK.

    Note:
    Saving a backup definition enables you to run your Clone at any time with a single clickNote: You must save your backup definition if you have created Clone schedules. Your schedules cannot run if this step is missed.If you want to run the Clone at this point, select ‘Run this backup now’ and click OK.
  11. A Warning box appears, if appropriate click Continue.

    Important
    The target disk for the clone operation will be overwritten. This is unrecoverable, so please ensure that the target disk contains no valid data.The clone operation now starts.
    Incompatible Disk Selected
    If you receive the error message ‘Incompatible Disk Selected’ when cloning then please see this article for more information: Incompatible Disk Selected

Creating a clone video

 


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Using Macrium Reflect from the command line

$
0
0

#TechieTuesday

You can retrieve a prompt for all the command line arguments by simply typing reflect -h from the command line.


Running a Backup

The command line form is as follows:

reflect.exe [-v | -e [-w] [-full | -inc | -diff] [xml filename] ]
Explanations for the switches are as follows:

-h This help text
-e Execute the XML file. If no full / diff / inc qualifier is used, a full backup is performed by default.
-v Validate the XML file and exit
-w If Reflect is busy then wait until available otherwise exit immediately
-full Run a full backup
-diff Run a differential backup
-inc Run an incremental backup
-pass Password. Overrides the password saved in the xml file.

Please note that the XML file name is the fully qualified path.

Examples
To validate an XML file

reflect.exe -v "c:\backup.xml"

To execute an XML file

reflect.exe -e "c:\backup.xml"

To execute an XML file with wait if busy

<reflect.exe -e -w "c:\backup.xml"

To execute an XML file and create an incremental image

reflect.exe -e -inc "c:\backup.xml"

 


Mounting an image

reflect.exe [Path To Image File] -b [-auto -drives [Drives[s]] -pass [PASSWORD]]
Explanations for the switches are as follows:

-b Browse image
-auto Automatically assign drive letters. If not specified then you will be prompted
-drives A comma separated list of drive letters to use. If not specified then the next available letters are used
-pass The password for protected image files

The image file name is the fully qualified path. If “LAST_FILE_CREATED” is specified then the last image created in the current Windows session is mounted.

Examples

To mount an image and prompt for a drive letter to use

reflect.exe “D:\901DBF91346B9A81-00-00.mrimg” -b

To mount all partitions in an image using the next available drive letter(s)

reflect.exe “D:\901DBF91346B9A81-00-00.mrimg” -b -auto

To mount all partitions for the last image created

reflect.exe "LAST_FILE_CREATED" -b -auto

To mount all partitions in an image using drive letters j,k,l

reflect.exe "D:\901DBF91346B9A81-00-00.mrimg" -b -auto -drives j,k,l

To mount all partitions in a password protected image using drive letters j,k,l

reflect.exe "D:\901DBF91346B9A81-00-00.mrimg" -b -auto -drives j,k,l -pass "PWD"

 


Unmounting an image

reflect.exe [Drive Letter] -u

Explanations for the switches are as follows:

-u Unmount image

 

If a drive letter isn’t specified then all mounted images are unmmounted
Examples

To unmount an image from drive letter ‘j’

reflect.exe J -u

To umnount all mounted drives

reflect.exe -u

 


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Preparing a USB stick for Windows PE

$
0
0

#TechieTuesday

To use a USB stick as a boot device, Windows requires a Master Boot Record (MBR) however some USB sticks are shipped without one and with just a single partition. The USB stick, therefore, needs formatting but the standard Windows format option does not prepare the disk correctly as it does not create a master boot record.  You therefore need to prepare the USB stick using other tools, for example, Windows diskpart.

  1. Start an elevated  command prompt. See Running an elevated command prompt for more information.
  2. Type:
     diskpart
  3. Type:
     list disk

  4. Identify the disk number of your USB stick.Please ensure that you correctly identify your USB stick.
  5. Type:
    select disk <n>

    Where <n> is the number of the disk previously identified as being the USB stick.  Confirm that the current disk selection is correct by typing in detail disk, this will show information relating to the currently selected disk.

    Note: Please be certain you have the disk selection correct before proceeding to the next step.

  6. Type:
    clean

    This erases all data on the USB stick.

  7. Type:
    create par primary

    This creates a primary partition on the USB stick using the maximum size available.

  8. Type:
    active

    To make the primary partition active.

  9. Type:
    format FS=ntfs LABEL="Macrium WinPE" QUICK

    This formats the newly created partition on the USB stick for legacy MBR booting.

    If your system has GPT disks and uses the newer UEFI booting standard then please type the line below instead:

    format FS=FAT32 LABEL="Macrium" QUICK

    Note: UEFI booting requires a FAT32 formatted partition and will not recognize NTFS.

  10. Type:
    exit

    once the format command has completed to exit diskpart.

  11. Type:
    exit

    Again to close the command prompt.

See also: Troubleshooting USB rescue media


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Reviewing your backup history

$
0
0

#TechieTuesday

Macrium Reflect maintains an easy to access log of all types of backups and restores where you can review activities, purge the log files and view Windows VSS events.

  1. In the main task bar click Log.

  2. Clicking the Delete old logs icon will take you to the Log file purge settings, where you can select to remove old logs.

  3. Make selection and click OK.
  4. Select the activity you want to review.

  5. If the activity has a VSS log, select to view VSS events, if required by clicking the View window VSS events icon.


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Macrium Reflect 7 will be released on 27th February 2017. Read more here.

Viewing all 33 articles
Browse latest View live