Windows Vista

A Guide to Windows Vista Backup Technologies

Christine Fok

At a Glance:

• File Backup and Restore
• Windows Complete PC Backup and Restore
• System Restore
• Shadow Copy

Too many people don't think about backing up their data until it's too late and the data has already been lost. This shouldn't ever be the case, but, unfortunately, it is. Windows Vista aims to make backing up easier, with a full range of features to seamlessly protect your data. The familiar

System Restore has been redesigned to be more robust and to support more system repair scenarios. File Backup has been improved to make data protection simpler and more thorough, and two new features, Windows® Complete PC Backup and Restore and Shadow Copy, have been added.

All of these features rely on Volume Shadow Copy Service in one way or another. This is a service that creates point-in-time copies (referred to as "shadow copies") of a volume and keeps track of changes made between shadow copies.

While these four features, all of which are available from the new Backup and Restore Center (see Figure 1), all allow you to back up and restore data, each is very different. But together they provide broad protection against various forms of data loss throughout the lifetime of your computer.

Figure 1** Backup and Restore Center in Windows Vista **(Click the image for a larger view)

File Backup

Scheduling Complete PC Backup

Scheduling a regular Complete PC Backup is one way to ensure you have recent images of your entire computer. Complete PC Backup is not schedulable through the control panel, but you can work around this by creating a new task in the Task Scheduler. If you choose to schedule Complete PC Backups, I advise periodic monitoring to verify that backups completed successfully. Why is this necessary? Because this method doesn't notify you via a pop-up if the backups fail due to disk space issues or other transient problems. This should not be considered a replacement for using File Backup on a regular basis. That said, here's how you can use Task Scheduler to schedule Complete PC Backup:

1. Go to Task Scheduler (which you'll find in the Accessories\System Tools folder in the All Programs portion of your Start menu).

2. Click Create Task.

3. Go to the General tab.

4. Type a descriptive name, such as Scheduled Complete PC Backup.

5. If you want the task to run regardless of whether you're logged on, click Run whether user is logged on or not.

6. Click Run with highest privileges.

7. Go to the Triggers page.

8. Click New and then specify when and how often the scheduled backup will take place.

9. Go to the Actions page.

10. Click New.

11. Under Program/Script, type wbadmin.

12. In Add arguments (optional), type the following command, adjusting the target drive letter as necessary:

    Start backup –allcritical –backupTarget:D: -quiet
    

    If you want to include additional volumes that are not the system, boot, or Windows Recovery Environment volumes, use the following statement instead, substituting the appropriate drive letters (separated by commas) for E and F:

    Start backup –allcritical –backupTarget:D: -include:E:,F: -quiet
    

    Note that the command should always include the allcritical flag. Not having this flag risks excluding important system volumes from the backup, which would lead to failure during restore.

13. Configure any other task-related settings.

14. Click OK.

Suppose I buy a new laptop. After copying various files—photos, Microsoft® Word documents, and so on—to my system, installing applications, and downloading the latest Windows updates, I decide to do a file backup. So I connect an external hard drive to the laptop and go to the Backup and Restore Center. When I click the Back up files button, I am presented with a wizard that guides me through the setup. It asks me for the backup target (in this case, the external hard drive), categories of files to back up (such as Pictures), and when to perform the backup.

File Backup uses a category-based approach for specifying what files to back up. While the source must be NTFS, the target hard drive can be either NTFS or FAT formatted. The determination of whether a file is associated with a particular category is based on three factors: MIME type, application association, and file extension.

If you want to back up files that do not fit into any other categories, choose the Additional files category. This includes files with extensions that are not recognized by Windows. It does not, however, support executable and system files. Such files are not backed up by this feature because they rarely represent user data. If you really do want to back up system and executable files using this mechanism, you can place them into a .zip file and select the Compressed files category in the wizard.

As this is my first time using the backup features on my new laptop, a full backup—which is a complete backup of all the files from the selected categories—is performed right away. Thereafter, only incremental backups are performed. The term incremental in the context of File Backup refers to keeping track of new or updated files only. For example, if you have an old Word document and then make some changes to it, the File Backup tool would keep complete copies of both the old and updated document. (The collection of a single full backup and the sequence of incremental backups created thereafter are referred to as a backup set.)

Rather than performing incremental backups indefinitely, you should occasionally perform full backups. Prompts to do so are based on factors such as how long since your last full backup, how many files you are backing up, how many CDs or DVDs you have backed up to, and so on. This is to ensure that a full, baseline backup is always available.

Data being backed up is stored as .zip files (with a maximum size of 200MB each). This makes the data more universally accessible. For example, you can restore the data to a machine that is not running Windows Vista by browsing directly through the backup media. The backup data is stored in separate files and can span multiple discs. If one disc was to fail, backup data on the other media is still accessible.

In File Backup, Volume Shadow Copy Service is used to create consistent copies of files that are open or in use by applications. During the backup process, the backup app reads from these consistent copies. This is handy, for example, when backing up a .pst file that is constantly opened by Microsoft Outlook®. Volume Shadow Copy Service ensures the backed-up .pst file is in a consistent state so that it can be accessed upon restore.

File backups aren't deleted automatically. However, you can delete file backups manually if you're low on space. A word of advice: you should always delete an entire backup set as opposed to deleting individual incremental backups.

As an aside, I should point out that you should avoid copying a file backup to a different location. If you must do so, keep in mind that this will only work if you move a single original backup media to another single destination media. For example, you can copy backup data from one CD to one DVD, but you cannot copy backup data from multiple CDs to one DVD. When you move a backup, you must copy the backup folder with your computer's name and the mediaid.bin file, both of which are located in the root of the backup media. Note that if you want to restore a file that has been moved, you must select Advanced restore | Restore files from a backup made on a different computer from the backup control panel to reach those files, since the backup catalog on the computer will not know of this new backup location.

Complete PC Backup

With my new laptop all set up and configured, I want to do a complete backup, protecting everything including the OS, the apps I've installed, configuration settings, and updates. I use the Complete PC Backup feature, which can then be used to recover my machine in case of a hard drive failure or other disaster. I wouldn't have to reinstall all the apps individually and redo all of my configuration settings. On first run, this feature performs a full backup of all blocks across the volumes I've selected, minus any blocks that do not have information stored. Subsequent backups are differential at the block level (more details about this in a moment).

After performing the backups, the control panel of the Backup and Restore Center is updated (see Figure 2). It now provides such information as when the backup was performed and where it was stored.

Figure 2** Backup and Restore Center provides details about previous backups **(Click the image for a larger view)

While both perform backups, Complete PC Backup works totally differently from File Backup. Complete PC Backup creates a block level image backup of the entire computer in a virtual hard drive (.vhd) format. During the first full backup, the engine scans the source disk and copies blocks that contain data into a .vhd file stored on the destination disk. Although the backed-up data is not compressed, it is compact.

The next time a Complete PC Backup is performed, only new and changed data is written to the .vhd file, and old data on the same block is moved to the shadow copy storage area. Volume Shadow Copy Service is used to compute the differences between snapshots taken as well as to handle the process of moving the old data out to the shadow copy area on the destination disk (see Figure 3). This approach makes the backup fast (since only changed blocks are backed up) and efficient (since data is stored in a compact manner). Note that the backup application defines the maximum amount of shadow copy storage space available on the destination disk. For a step-by-step procedure on using the Complete PC Backup system regularly or automatically, see the sidebar "Scheduling Complete PC Backup."

Figure 3** How data moves in a Complete PC Backup and Restore **(Click the image for a larger view)

When restoring data, blocks are restored to their original location. If you want to restore from an older backup, the engine reads from the shadow copy area and restores the appropriate blocks.

Note that Complete PC Backup can only back up NTFS-formatted disks. If the backup destination is a hard drive, it too needs to be NTFS-formatted.

System Restore

System Restore is enabled by default. I access the System Restore wizard by choosing Repair Windows using System Restore, available on the upper-left part of the Backup and Restore Center (it can also be accessed in the Accessories\System Tools folder in the All Programs portion of your Start menu). If I select "choose a different restore point" and click Next, I can see that restore points have already been created at various points while I was setting up my laptop, installing applications, and performing backups.

Restore points are turned on by default only on the boot volume, even on a system where the hard disk has multiple volumes. Restore points are automatically created during application and driver installations and daily across the selected volumes (if a restore point has not already been taken on that day). Restore points can also be created manually by choosing the System Protection option in the System control panel applet. Shadow copies created during File Backup and Complete PC Backup can also be used as restore points.

In Windows XP, System Restore uses a file system filter to keep track of system file changes. In Windows Vista, System Restore uses Volume Shadow Copy Service to keep track of block-level changes over the selected volumes. This makes System Restore more robust and allows it to support a broader range of repair scenarios.

Also new, System Restore can now run while your regular Windows installation is offline. This is done using Windows Recovery Environment, allowing you to repair your system even if Windows is unbootable.

Shadow Copy

Shadow Copy is nearly invisible. It is enabled by default and requires no input on the user's part. If a user ever needs to restore a file, that's when she is likely to first take notice of this feature. It essentially exposes the point-in-time copies of files that are created by Volume Shadow Copy Service.

Shadow Copy Space Management

There are storage spaces set aside for shadow copies both on the live volumes and on the backup disk for Complete PC Backup. You can check the used, allocated, and maximum shadow copy storage space values by running the following command from an elevated command prompt:

VSSAdmin list ShadowStorage

Used indicates how much space is currently taken up by shadow copies; allocated indicates the amount of space reserved for shadow copies (and so cannot be used for other purposes); maximum is the size limit that shadow copies are guaranteed to stay under.

Space allocation for shadow copies is automatic, meaning it cannot be set by the user. New space is allocated in fixed increments whenever the space previously allocated is used up. This is why the value shown for used space is always less than the value you see for allocated space.

For the live volume, the maximum shadow storage space allowed is determined when the first shadow copy is created—typically when System Restore is first enabled and a restore point is created during setup. The value is set to 30 percent of free space or 15 percent of the overall size of the volume—whichever is less. This maximum size is static. It will not change when more or less free space is available, nor will it change after the size of the volume has been adjusted.

However, you actually can manually adjust the size of this storage area by using the VSSAdmin tool from an elevated command prompt. For example, the command to increase the maximum storage size to 15GB on C:\ would be:

VSSAdmin Resize ShadowStorage /For=C: /On=C: /MaxSize=15GB 

This tool originated on Windows Server®, where shadow copies for a particular volume could be maintained on another volume. In Windows Vista, shadow copies for a volume are kept on the same volume. Hence, the "for" and "on" volume has to be the same.

The backup destination disk for Complete PC Backup, on the other hand, has a fixed maximum shadow copy storage size of 30 percent of the disk space. This value is controlled by Complete PC Backup and cannot be changed manually. This shadow copy storage space is used for storing incrementals for Complete PC Backup.

Up to 64 shadow copies can be kept on a volume at any one time, provided there is enough space in the shadow copies storage area. Once the maximum space limit is reached, older shadow copies are deleted to make room for the new ones. Therefore, old restore points for System Restore are deleted when the shadow storage limit on the live volume is reached and old Complete PC Backups are deleted when the limit is reached on the backup disk. In addition, storing and editing other data on the backup disk may interfere with the normal process of aging old backups, causing old backups to be deleted at an accelerated rate.

Restore a File with Shadow Copy

Now, imagine I've had my laptop for a while and I've been using it to create some presentations. I've finished the presentations and passed them along to my clients. A month has passed, I'm onto new projects, and I've since deleted these files. Then my manager asks me for a copy of the old presentations. This is where Shadow Copy really comes in handy.

There are two ways to look for copies of deleted files. First, if I know where the file had been stored, I can simply right-click the folder that contained the deleted file and select "Restore previous versions." From there, I choose a date that contains the desired version of the deleted file (see Figure 4), click open, and then copy the target file to another location on the live volume. This copy operation is as fast as a regular file copy.

Figure 4** Restoring a file that was deleted **(Click the image for a larger view)

If I have forgotten where the file was stored, I can open up the previous version of the closest parent folder in the file tree and do a search from there. For example, if I have forgotten the specific folder but do know it was in some subfolder located within Documents, I can search the previous version of Documents by typing the file name (full or partial) in the search box located at the top right-hand corner of the Windows Explorer window, as shown in Figure 5. Note that the search functionality for shadow copies does not work at the root folder. And since shadow copies are not indexed, the search time can be longer than searching on a live volume.

Figure 5** Searching for the previous version of a document by typing a partial file name **(Click the image for a larger view)

Restore a File from a File Backup

Shadow copies are not available forever since they get pruned from time to time to manage the available space. If I need a file that is no longer available using this method, I can resort to my scheduled file backups. I simply select Restore files from the Backup and Restore Center, and choose a backup date that contains the deleted presentation. When I click the Add files button, I get an open file dialog that lets me navigate through the backup. After I select the file I'm looking for, I am given the option to restore the file to the same or a different location.

It's worth noting that the Restore files option only shows backups contained in the latest backup set. To view backups from an older backup set, select Advanced restore and then the Files from an older backup made on this computer option. On the rare occasion that you can't find an old backup set using that option, select Advanced restore and then the Restore files from a backup made on a different computer option. This can happen because the computer backup catalog is trimmed when it gets too big.

Restore a File from Complete PC Backup

I should mention, for thoroughness, that a Complete PC Backup can be used to restore individual files. While intended for restoration at the volume level, Complete PC Backup stores data in a .vhd format, and this means you can use the offline VHD mounting tool to access and restore individual files. (At the time of writing this article, the VHD mounting tool is only available as part of Microsoft Virtual Server 2005 R2 SP1, which you can download from microsoft.com/technet/prodtechnol/eval/virtualserver.) To mount the backup, open a command prompt with elevated privileges and navigate to Microsoft Virtual Server\Vhdmount. The command is:

vhdmount /m [path of the .vhd file] [drive letter to assign to the virtual hard drive]

When doing this for the first time, the system may not pick up the required driver since it is unsigned. This will cause an error message that says the device driver could not be loaded. To solve this problem, after plugging in the .vhd file using the command above, go to the Device Manager, right-click on the new device that shows up, and select Properties. From there, go to the Driver tab, select Update Driver, click Browse my computer for driver software, and select Let me pick from a list of device drivers on my computer. The correct driver file will be located at Microsoft Virtual Server\Vhdmount\vhdstor.inf. After installation, the new drive will appear and you'll be able to browse the latest Complete PC Backup and copy the files you want to an alternate location.

Complete PC Restore

Now imagine that one sunny afternoon, I decide to use my laptop while sitting by the pool. I slip on some wet tiles and my laptop dives into the pool. It's beyond repair and I have no choice but to buy a new one. Since I used the Complete PC Backup tool, I can restore my system to the new laptop—I don't have to spend a lot of time manually reinstalling each application and reconfiguring them with my personal settings. Performing a Complete PC Restore is straightforward. At startup, I use the Windows Vista installation disk to boot into the Windows Recovery Environment. Here, I am prompted to attach the device that contains the system image. I choose the appropriate image, and then the restore process begins.

After the restore is finished, I perform a file restore from my latest file backup. This is because I do file backups more frequently so the data contained in my file backup is more current. Since the computer is reverted to a time prior to the chosen file backup, it does not contain a record of this backup in the catalog. Therefore, I select Advanced restore | Restore files from a backup made on a different computer | Restore everything from this backup. I also start a new full backup to protect my newly restored data.

Windows Recovery Environment is often installed by the OEM on the hard drive as a hidden partition. This can be used for restoring a Complete PC Backup image to the same hardware. But if you need to restore an image created from one computer to another, you need to run Windows Recovery Environment from external media, such as your Windows installation disk.

There are some caveats worth considering. Complete PC Restore works simply when restoring to the same hardware the backup was taken from. (Provided, of course, that hardware failure wasn't part of your problem.)

Since Complete PC Backup includes an image of the entire computer, some restrictions apply when restoring to different hardware. First, the backup image contains drivers that are used to boot to the machine after the restore completes. In rare cases, the drivers needed to boot on the new machine might not be present. This might happen when restoring an image backup taken on one type of disk controller (IDE, SATA, or SCSI) to another type of disk controller. Even in this case, there is still a good chance you can complete the restore successfully, because the common Windows drivers included in the image backup would likely be compatible.

Second, the restore can only be performed if the new computer has at least the same number of hard drives and each hard drive is at least as big as the original it replaced. Keep these restrictions in mind if you intend to use Complete PC Backup for migrating to new hardware.

Since backup and restore are performed at the block level for entire volumes, Complete PC Restore requires a volume to be either fully restored or skipped. Therefore, you might want to create multiple volumes for backup (for instance, partitioning the system files from the data files). Then when restoring, you can choose whether to restore only the system volume (identified as critical) or all volumes.

Putting These Features into Practice

Windows Vista has made significant improvements over Windows XP in protecting your data and system by introducing new backup technologies and improving existing options. The four main backup features—File Backup and Restore, Windows Complete PC Backup and Restore, System Restore, and Shadow Copy—deliver different yet complementary capabilities, casting a broad net of data protection. It's important to understand how these features work together, to make sure your system is configured to utilize all four methods, and to apply the appropriate protection and remedy according to the situation.

As a rule of thumb, always try Shadow Copy restore first in a data loss situation since this method is likely to have the most up-to-date copy of your data. For system instability and repair, use System Restore. Complete PC Restore should generally be used as a last resort for a full system repair, and it should be used with caution. Nonetheless, Complete PC Repair can be a real lifesaver. Most importantly, take action before it is too late: backup now!

I would like to thank Eduardo Laureano, Ivan Pashov, Jill Zoeller, and all the members of the backup and restore product team for their assistance with this article.

Christine Fok is a Program Manager in the Storage Solution Division of Microsoft. She focuses on backup and restore experiences in the Windows client platform.

© 2008 Microsoft Corporation and CMP Media, LLC. All rights reserved; reproduction in part or in whole without permission is prohibited.