Before you start
Objectives: learn what is backup, which tools in Windows can be used to create backups, to restore data and to restore system from previous state.
Prerequisites: no prerequisites.
Key terms: backup, system, data, files, restore, user, disk, state, previous, media, version, automatic
What is Backup
A backup is a copy of files and data on our system. Backups are used for recovering our system state or user data in the event of a hardware or system failure. Backups are also useful in restoring deleted or changed files. We should backup anything that we don’t want to lose or that we don’t mind redoing. Backups must be performed while the system is in working order. In other words, we have to protect our system before there is a problem. Also, we have to test our backups and store the backup media in a safe place. We can’t allow ourselves to take a backup only to find that we can’t restore from it, or that we can’t find the backup media. Backup media should be stored offsite to prevent the same disaster from affecting the network and the backup media. In general, we should back up user data more often than system state data, since user data changes more frequently.
Backup Destinations
The available destinations for our backups are:
- Second internal hard disk – Hard drives are relatively inexpensive these days and always available unless of a major malfunction. After the backup is complete, we can even install the drive in another computer and perform a restoration data to that computer. We should try to stay away from storing our backups on a different partition that exist on the same physical hard disk as our system partition. If that hard drive fails, we will lose our original data and our backups.
- External hard drive – External hard drives are more expensive than internal hard drives, but they are easier to use and relocate. We can store them in a secure remote and off-site location. External hard drives are usually slower than internal hard drives and sometimes tend to be less reliable and prone to failure mainly because of the interfaces they connect through. It’s recommended to format our external hard drive with the NTFS file system as it increases reliability and security, as well as enables us to store system image backups. System Image backups cannot be stored on FAT partitions.
- DVDs and CDs – Optical discs are very inexpensive and can be archived in a secure location. However, they are also prone to failure, since they can easily get scratched or the data can become corrupt over time. Also, we cannot save scheduled system image backups onto DVDs and that is typically due to the capacity limit. We might need multiple DVDs or CDs to backup our system.
- USB flash drives – they typically support a lot less memory than hard drives. It must have at least one gig of free space if we want to see is as a backup option. Again, we cannot save System Image backups to flash memory. The advantage of flash drives is that they can be stored off-site and are small and easy to carry. At the same time, they are easy to lose.
- Network location – This can be a computer or a network storage device such as a NAS or SAN. When saving backup to a network location we must also provide credentials to the Windows backup program so it can access the network location.
- VHD files – VHD file should not be on the same physical disk that we are backing up, or else we could lose our backup if the disk fails. VHD discs can also be used to save System Image backups of an entire volume. We can make this image a bootable image, so that we can easily boot the computer from a backup system image.
System State vs User Data
When we talk about backups it’s important to differentiate between different types of data that might be saved in the backup. One type of data that might be saved is system state data. System state data includes files required by the operating system to restore the configuration, to boot and to run our computer. This includes registry settings, drivers, operating system files or any other configuration information.
Another type of data is user data. User data are the files that we create using applications on our computer. For example, videos files, music files, pictures, etc. User data is the most important and most valuable data. User files might change daily so a daily backup schedule might be required for the user data.
A third classification of data are applications. These include the executable files and any other files required by the application to run. Depending on the system you are using and the backup type, a backup of system state data might include backing up all application files as well.
System Image Backup
System image backups like BDRSuite backups a an entire volume to a VHD file. It contains everything on the system, including the operating system, installed programs, drivers, and user data files. This can also be compacted to remove the empty space. This type of backup enables us to quickly restore computer and all running applications, as well as boot directly to it. System Image backups cannot be stored as any other file format such as ISO, WIM or even the old BAK format. Also, they cannot be saved on USB tape, CD or DVD-ROMs.
We can backup a System Image to the same VHD file as subsequent backups to that media, automatically performs an incremental backup. Only the portion of the hard disk that has changed will copy to existing backup, while only a single version of the System Image backup is stored in a single VHD file.
We can also run System Image backups from the command line using the “wbadmin” command. We can use this command to create a batch file and create a schedule task to schedule System Image backups.
The destination drive needs to be formatted using the NTFS file system. A System Image file is stored in the WindowsImageBackup folder at the root of the destination location. Within this folder it creates a folder with the current computers name and then creates a catalog folder containing the global catalog and the backup global catalog files. Folder with the year-month-date-time as its name contains the actual disk image file.
Files and Folders Backup
With files and folders backup, we can store files and documents to compressed ZIP files. The first backup is a full backup, and all subsequent backups are incremental by default. Also file backups do not backup system files, program files, Encrypted File System files, temporary files, files in the Recycle bin or user profile settings. File backups can be saved to FAT32 or NTFS-formatted volumes. File backups can backup to either local media or shared folders on a network. Administrative privileges are needed to configure scheduled backups or to manually initiate a backup. If we perform a file backup to a shared network folder, the credentials used to run the backup must have full control at both the Share and NTFS permissions on the destination shared folder.
To reduce security risks we should set up a user account also known as a service account that is used only by the backup application and configure the share and NTFS permissions of the network share location to grant full control access only to that backup user. The backup account also requires administrative privileges to the computer being backed up.
With file and folder backups Windows automatically creates a folder in the root of the destination using the computer name. Within that folder backups are saved. The backup process creates a series of folders that are named using the date on which the incremental backup was performed, as well as a catalog folder within the root of the Backup Set folder. Within each of the backup folders is a series of compressed ZIP files. The ZIP file names will have an incremental number that makes each file name unique. The benefit of using zip files is that Windows can search compressed files.
The catalog folder contains a global catalog file which contains an index of the individual files that have been backed up and in which backup they are contained. This way, Windows can quickly locate a file for restoration. The catalog folder also contains a list of file permissions for each file.
Backup Tools
For each tool we have to ensure that it is compatible with our operating system version. Also, we have to consider the type of data that is backed up and the type of media we can use for the backup.
Windows Backup (NT Backup)
Windows Backup utility, also called NT Backup, is the backup utility included with Windows 2000 and XP. To open Windows backup, we can type in Ntbackup.exe in Run menu, or we can start Windows Backup from the Administrative Tools in the Control Panel. NT Backup allows us to select the type of data that we want to backup. We can backup user data (entire volumes, or selected folders or files), or we can perform a system state backup. Backups can be saved to tape, a network location, or a file (on a hard disk). Windows Backup cannot back up to recordable disc media (CD-R, CD-RW, DVD-R, or DVD-RW). To save backups on these media types we can perform a backup to a file, and then copy the backup file to the disc. We can schedule backups to take place at regular times.
Automated System Recovery (ASR)
Automated System Recovery or the Emergency Repair Disk are essentially the same tool, but they run on a different operating system version. ASR is used on Windows XP, while the Emergency Repair Disk was used on Windows 2000. Automated System Recovery (ASR) is a simple way of backing up and restoring the operating system. We can use ASR to recover from a hardware failure or other error that prevents the operating system from loading. The data that is backed up is our system state data. Both tools backup the system state, but not user data. Both tools require that we have the installation disk. The backup process creates a floppy disk, which doesn’t contain any of the backup data. Floppy disk is used to initiate the restore process and includes some initial configuration settings that are required. So, during the backup, we create a floppy disk that is used along with the backup files and the Windows installation disc during the restore procedure. The media that can be used to store the actual data might be a tape drive, disks or even a file on the file system. We can use Windows Backup to create the ASR backup.
Windows Backup Console
In Windows 7 we have a Backup and Restore console which is available under System and Security in the Control Panel, we can schedule file and folder backups or create a system repair disc. We can also use this console to create an image of a complete volume, also known as a System Image. System image is a copy of all the files and folders in the system disk, and if we want, other hard disks as well. We can use System Image backup to restore the computer back to exactly it was when we created the image.
Windows 7 backup uses a process called shadow copies to take a snapshot of our volume. This enables the backup job to completely backup files even if they are open and being accessed. Without a shadow copies, files that are in use, such a system files, configuration files, databases or even a running program files, would not be backup and could cause our backup job to fail.
When creating a new backup job we must first select the destination. The destination cannot be a system volume, no matter if it is a volume with the existing operating system is installed on, or in the case of a multiboot environment, another volume that has the other OS installed on it. Also we cannot choose a BitLocker enabled volume and a tape drive as a destination. The available destinations for our backups are second internal hard disk, external hard drive, DVDs and CDs, USB flash drives, network location, and VHD files.
After choosing a destination, we need to choose the files and folders to be backed up. We can either manually select the files and folders to be backup, or let Windows automatically choose what to backup. Automatic backup will include data files that are saved locally in libraries, on the desktop, and default folders for all users with accounts on the computer. These folders can include documents, downloads, favorites, links, contacts, and other personal user information. If the destination drive is formatted with NTFS, and has enough disk space, a System Image is also included in the backup. We can configure the day and time of the backup.
If we choose to manually select which files and folders we want to be backup, we can choose local files and folders except “Program files” folder, file stored on the hard disks that are formatted with FAT file system, files in the Recycle bin and temporary files on drives smaller than one gig. We can also specify whether our backups include a System Image of our drive or drives that contain operating system.
Complete PC backup solutions which are ASR, ERD and Complete PC Backup we typically perform these manually. At a later time we can redo the backup if we want to, if significant change has taken place. With NT Backup and Automatic Backups we usually have scheduled backups. That means that we set a time to perform the backups on a regular basis. This way we’re constantly backing up user data as it changes.
System Restore
Another solution that we can use to help protect our system is called System Restore. System Restore is a feature that started with Windows XP and is available now with every version since Windows XP. System Restore takes periodic snapshots (restore points) of the system state data. We can use those restore points to roll back our computer to a specific point-in-time configuration. The first snapshot that is taken includes the entire system. Periodically additional snapshots are taken, however they include only the changes that have taken place since the last snapshot was taken. Restore points take snapshots of system files, registry settings, program files, and other batch, script, or executable files. Restore points do not protect user data files. With System Restore we can choose to restore our computer to any point in time where a snapshot exists. For example, it can be used if we have problems with the drivers that we have installed. We can revert back to the snapshot that we took prior to the installation of the driver.
System Restore is automatically enabled and automatically saves the changes made on our computer. It does this before configuration changes are made such as installing an application, installing an unsigned driver, or making other system changes. We can also manually make restore points. System Restore works only on NTFS partitions. Restore points are automatically saved to the same disk using up to 15% of the available disk space, but we can modify the amount of disk space used for restore points.
When we restore our system to a restore point, previous settings are restored, while subsequent changes are removed. For example, any drivers installed after the restore point are no longer installed. The same is with applications. User data is not modified when restoring to a restore point. We cannot use a restore point to recover user data.
Previous Versions (Shadow Copies)
Previous Version tool, also called Shadow Copies, takes advantage of the backup capabilities of the System Restore feature. It takes snapshots of files and folders and protects against accidental deletion or modification of user data files. It is included with Windows XP and above. When System Restore is enabled, Shadow copies of files are automatically created when a restore point is made. We can decide if we want to restore from backup or from Shadow Copy. If System Protection feature is enabled, Windows automatically create copies of files that were modified since the last restore point was created. System Protection is enabled by default on the system drive, but not on other volumes. If we enable System Protection with the “Restore system settings and previous versions of files” setting, system settings are included in the restore point. Using the “Only restore previous versions of files” option protects files but not system settings. By default, new restore point will be created every seven days or whenever a significant system change occurs. If we can’t find shadow copies of some file, System Protection might not be turned on for our hard disk. Also, Shadow copies are not available for offline files, and for operating system files.
Shadow copies allow us to rollback or restore a previous version of a file. For instance if we make a change to some file, we can go back and see a previous version of that file to see how it existed at a certain day and time. Previous Versions works on entire folders as well as individual files. When we view a previous version of a file, it is opened in Read-only mode. We can also browse through a previous version of a folder. When we restore previous versions, we can choose to copy the previous version to a new location, or restore it to the same location and overwriting the existing version. Note that with Previous Versions, backups are saved on the same disk, so it does not protect us against disk failure. Previous Versions uses the same technology that System Restore does, and it only works on NTFS partitions.
The Volume Shadow Copy Service (VSS) manages and implements shadow copies. When we initiate a file and folder backup, this service creates a snapshot of the volume that contains the files and folders to be backed up. It backs up this snapshot rather than the actual files them self. This speeds up the backup process while enabling us to backup files on drives even while they are open and in use. VSS startup type is manual and starts as needed during backups. If this service does not start for any reason, shadow copies will not be available for backups and Windows backups will fail. In addition, restore points and previous versions will not be created.
Restoring from Backup
Windows allows for easy and straightforward restoration of files and folders from backups to the original location or to a different location. Normally, we restore data to its original location, but sometimes we want to restore information to a different location to test that backup and restore procedures are working correctly. This method is also known as a dummy restore.
When we perform a file and folder backup, by default we backup all the personal data files and folders associated with each of the users on the computer, also known as a user profile. User profiles are stored locally in a small network, but can also be stored on a server in a domain based enterprise network. Profiles stored on a server are also known as roaming profiles, which enables a user to log on to any client computer on a domain and be able to retain their personal settings, access to their files and folders, and their favorites, contacts and other personal information. Roaming profiles are backed up on the server and maintained by the server administrators. Local profiles can be backed up locally and restored using the Restore Files Wizard in the Backup and Restore console. We can restore the entire profile or select specific files from the profile.
Examples
Remember
Part of regular system maintenance should include performing backups. We should back up user data more often than system state data. System data cannot be backed up selectively in portions. Backup media should be stored offsite. Backups can be scheduled using the tools within the backup utility. Previous Versions takes snapshots of files and folders. System Restore automatically takes restore points of our system. Complete PC Backup and Restore replaces the ASR/ERD feature of previous Windows versions.