Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: System Image info, shadow/system restore storage - internal workings


06 Dec 2011   #1

 
 
System Image info, shadow/system restore storage - internal workings

There are assumptions within the text here. Please post and make any corrections that you know to be false (i.e. you tested).

***


OK. If you create a system image, it gets stored in a folder in this format:

sysimagedrive:\WindowsImageBackup\%computername%\Backup YYYY-MM-DD HHMMSS

The first system image is a complete one. All future ones are incremental, but I assume only if the correct pieces are lying about on your disk.

If you create another system image, only modified blocks/sectors are written to the .vhd files inside the aforementioned folder. I think the original blocks that are unchanged for THIS "incremental" backup are written to shadow storage.

This shadow storage looks like it is shared with System Restore "recovery points" (do a vssadmin list shadows to see all the restore points - see output below). So even if you're wallowing in disk space, if your shadow storage won't hold the unchanged incremental backup blocks/sectors, it will delete a prior System Image which I assume includes the aforementioned WindowsImageBackup folder parts (the \%computername%\ path directories likely).

Curious thing. My oldest System image has two .vhd's, presumably one for the unlettered 100MB partition and the other for the C drive. The unnamed partition backup .vhd size was initially 50MB. On all successive images, it is 40MB. Since that partition "never"?? changes, I would have expected to see NO .vhd in successive images as the original 100MB would be in shadow storage.

Here is what I have on my PC currently (see wbadmin output further down). This output is from a .bat script that I wrote that will hopefully automate some of this nightmare of keeping multiple System Images around. I have it almost working and will always pull the Y-M-D HMS from the \Backup folder and put that date onto the %computername% PRIOR (in the directory tree) folder. So, it will be \%computername%_YYYY-MM-DD_HHMMSS\.

I only have 3 of the following 6 \WindowsImageBackup\%computer%\Backup folders around. I manually deleted 3 of the others (meaning deleting ONLY the WindowsImageBackup folders and not the shadow storage entries via wbadmin delete systemstatebackup). Reference below to see.

#1 is orphaned. The wbadmin get versions command is likely looking at BOTH the WindowsImageBackup folder and stuff inside System Volume Information (Shadow/System Restore Points).

I know people have renamed drive:\WindowsImageBackup\%computername%\ to something else and when they boot into Recovery Environment, it DOES show ANY folders inside WindowsImageBackup but with the caveat that the SHADOW info (wbadmin get versions) has to ALSO be correct/present. Much the way you can have TWO PCs point to the same WindowsImageBackup folder and all is kosher.

#2 below has been copied to my D: drive in the correct folder structure. Yet, I don't think RecEnv would see that since it's SUPPOSED to be on F: according to wbadmin.

#3 is orphaned.

#4 is around but sitting in a non WindowsSystemImage folder.

#5 (orphaned as I deleted the physical WindowsImageBackup folder) shows I backed up the 100MB unnamed partition, C: and D: (don't recall specifying my data drive).

#6 is one I took last month. It's on E: as it should be.

Here is vssadmin list shadowstorage output. I only have System Restore enabled on C. Yet, you can see E: is shown here. I assume that is because I have a WindowsSystemImage on E:. You can see E: has only 1 MB out of 7+G in use. The C: shadow storage space is almost all used (the % you see is the % of the whole PARTITION).

Verify this via Control Panel > System > System Protection tab. Highlight a partition, click on SETTINGS tile and you can see the GB shown matches the vssadmin output below.

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Shadow Copy Storage association
For volume: (E : ) \\?\Volume{4985e584-ad1e-11df-8a19-00121795121c}\
Shadow Copy Storage volume: (E : ) \\?\Volume{4985e584-ad1e-11df-8a19-00121795121c}\
Used Shadow Copy Storage space: 1.188 MB (0%)
Allocated Shadow Copy Storage space: 512 MB (2%)
Maximum Shadow Copy Storage space: 7.225 GB (30%)
Shadow Copy Storage association
For volume: (C : ) \\?\Volume{936b54c0-228a-11df-8147-806e6f6e6963}\
Shadow Copy Storage volume: (C : ) \\?\Volume{936b54c0-228a-11df-8147-806e6f6e6963}\
Used Shadow Copy Storage space: 5.413 GB (5%)
Allocated Shadow Copy Storage space: 5.692 GB (5%)
Maximum Shadow Copy Storage space: 5.854 GB (6%)


The bottom line is: I bet if you blow away a WindowsImageBackup\%computername%.....\Backup YYYY-MM-DD HHMMSS folder, the next System Image will probably be a full as it has no prior to compare to??

And, if you have moved a WindowsImageBackup somewhere else, it likely has to be put back on the CORRECT drive (i.e. per wbadmin get versions output). Ironically, the Version ID in wbadmin is only HH:MM format and doesn't have the SS seconds.

Also, note the wbadmin backup time is YOUR time while the Version ID: time is Greenwich Mean Time.

There is an option to delete system image backups which I assume will delete the shadow and the WindowsImageBackup\%computername%\Backup folder (but I assume will leave WindowsImageBackup around if there are other %computernames% in there).

wbadmin delete systemstatebackup -withvariousoptions/combinations

If you issue a vssadmin list shadows it will list all shadows. I have only ONE E: one and it is NOT "client-accessible" which means I can NOT delete it with an appropriate command. Note it shows all as being "incremental".

Contents of shadow copy set ID: {45979ba4-59df-4b82-82ed-2f92b0ecaf5b}
Contained 1 shadow copies at creation time: 11/5/2011 8:30:51 PM
Shadow Copy ID: {5b29b558-c36f-4cbb-8f2c-963b16b7eec8}
Original Volume: (E : ) \\?\Volume{4985e584-ad1e-11df-8a19-00121795121c}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy22
Originating Machine: Jim-GLH
Service Machine: Jim-GLH
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: DataVolumeRollback
Attributes: Persistent, No auto release, No writers, Differential
Contents of shadow copy set ID: {a1b52d8c-74ef-494d-8c7d-1cb1664e3764}
Contained 1 shadow copies at creation time: 11/24/2011 9:35:26 AM
Shadow Copy ID: {70b2b09a-628a-4b1a-9792-0ab1a5187de9}
Original Volume: (C : ) \\?\Volume{936b54c0-228a-11df-8147-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
Originating Machine: Jim-GLH
Service Machine: Jim-GLH
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered



Items for any folks to test:

Do a delete systemstatebackup and see if the WindowsImageBackup\%computername%\Backup folder also gets deleted.

Delete a \Backup folder and do a System Image and see what happens in the .vhd and and the shadow storage area.

Do various combos and boot into Windows Recovery Environment and see what is shown.

Strangely, on the System Image panel, if you specify a partition that IS on the same physical disk as the OS images, you will be a yellow triangle/! telling you so. I wonder IF one did have a legit WindowsImageBackup on a partition on the same disk, if System Image GUI would show it (i.e. would it show that AND the yellow triangle)?



wbadmin get versions output

Code:
 
***1
COMMAND wbadmin get versions
VERSIONS wbadmin 1.0 - Backup command-line tool
VERSIONS (C) Copyright 2004 Microsoft Corp.
VERSIONS Backup time: 2/25/2010 1:07 AM 
VERSIONS Backup target: Fixed Disk labeled OS backup(F : )
VERSIONS Version identifier: 02/25/2010-06:07
VERSIONS Can recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State
VERSIONS Snapshot ID: {af5e58c7-a774-4d05-ab53-e2c206cf1b69}
COMMAND wbadmin get items -version:02/25/2010-06:07
GETITEMS wbadmin 1.0 - Backup command-line tool
GETITEMS (C) Copyright 2004 Microsoft Corp.
GETITEMS Volume ID = {68429721-21e2-11df-ab15-806e6f6e6963}
GETITEMS Volume '<Unlabeled Volume>', mounted at <not mounted> at the time the backup was created
GETITEMS Volume size = 100.00 MB
GETITEMS Can recover = Full volume
GETITEMS Volume ID = {68429722-21e2-11df-ab15-806e6f6e6963}
GETITEMS Volume '<Unlabeled Volume>', mounted at C: at the time the backup was created
GETITEMS Volume size = 97.55 GB
GETITEMS Can recover = Full volume
GETITEMS Application = Registry 
GETITEMS Component = Registry (\Registry)
***
 
***2
VERSIONS Backup time: 2/25/2010 9:12 PM 
VERSIONS Backup target: Fixed Disk labeled OS backup(F : )
VERSIONS Version identifier: 02/26/2010-02:12
VERSIONS Can recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State
VERSIONS Snapshot ID: {07eff7f0-de3f-4a14-8c61-12f203042578}
COMMAND wbadmin get items -version:02/26/2010-02:12
GETITEMS wbadmin 1.0 - Backup command-line tool
GETITEMS (C) Copyright 2004 Microsoft Corp.
GETITEMS Volume ID = {936b54bf-228a-11df-8147-806e6f6e6963}
GETITEMS Volume '<Unlabeled Volume>', mounted at <not mounted> at the time the backup was created
GETITEMS Volume size = 100.00 MB
GETITEMS Can recover = Full volume
GETITEMS Volume ID = {936b54c0-228a-11df-8147-806e6f6e6963}
GETITEMS Volume 'LIVE OS', mounted at C:
GETITEMS Volume size = 97.55 GB
GETITEMS Can recover = Full volume
GETITEMS Application = Registry 
GETITEMS Component = Registry (\Registry)
***
 
***3
VERSIONS Backup time: 2/28/2010 1:17 AM 
VERSIONS Backup target: Fixed Disk labeled Expendable(E : )
VERSIONS Version identifier: 02/28/2010-06:17
VERSIONS Can recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State
VERSIONS Snapshot ID: {782b0fbc-74cc-4f27-b44d-41097d627102}
COMMAND wbadmin get items -version:02/28/2010-06:17
GETITEMS wbadmin 1.0 - Backup command-line tool
GETITEMS (C) Copyright 2004 Microsoft Corp.
GETITEMS Volume ID = {936b54bf-228a-11df-8147-806e6f6e6963}
GETITEMS Volume '<Unlabeled Volume>', mounted at <not mounted> at the time the backup was created
GETITEMS Volume size = 100.00 MB
GETITEMS Can recover = Full volume
GETITEMS Volume ID = {936b54c0-228a-11df-8147-806e6f6e6963}
GETITEMS Volume 'LIVE OS', mounted at C:
GETITEMS Volume size = 97.55 GB
GETITEMS Can recover = Full volume
GETITEMS Application = Registry 
GETITEMS Component = Registry (\Registry)
***
 
***4
VERSIONS Backup time: 2/28/2010 9:42 AM 
VERSIONS Backup target: Fixed Disk labeled Expendable(E : )
VERSIONS Version identifier: 02/28/2010-14:42
VERSIONS Can recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State
VERSIONS Snapshot ID: {cc0a0db2-4a16-46f1-a530-b354d7c3a0bd}
COMMAND wbadmin get items -version:02/28/2010-14:42
GETITEMS wbadmin 1.0 - Backup command-line tool
GETITEMS (C) Copyright 2004 Microsoft Corp.
GETITEMS Volume ID = {936b54bf-228a-11df-8147-806e6f6e6963}
GETITEMS Volume '<Unlabeled Volume>', mounted at <not mounted> at the time the backup was created
GETITEMS Volume size = 100.00 MB
GETITEMS Can recover = Full volume
GETITEMS Volume ID = {936b54c0-228a-11df-8147-806e6f6e6963}
GETITEMS Volume 'LIVE OS', mounted at C:
GETITEMS Volume size = 97.55 GB
GETITEMS Can recover = Full volume
GETITEMS Application = Registry 
GETITEMS Component = Registry (\Registry)
***
 
***5
VERSIONS Backup time: 4/15/2010 8:15 AM 
VERSIONS Backup target: Fixed Disk labeled Expendable(E : )
VERSIONS Version identifier: 04/15/2010-13:15
VERSIONS Can recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State
VERSIONS Snapshot ID: {bcc672ec-a9cc-4951-963f-d7de9e2cb2e5}
COMMAND wbadmin get items -version:04/15/2010-13:15
GETITEMS wbadmin 1.0 - Backup command-line tool
GETITEMS (C) Copyright 2004 Microsoft Corp.
GETITEMS Volume ID = {936b54bf-228a-11df-8147-806e6f6e6963}
GETITEMS Volume '<Unlabeled Volume>', mounted at <not mounted> at the time the backup was created
GETITEMS Volume size = 100.00 MB
GETITEMS Can recover = Full volume
GETITEMS Volume ID = {936b54c0-228a-11df-8147-806e6f6e6963}
GETITEMS Volume 'LIVE OS', mounted at C:
GETITEMS Volume size = 97.55 GB
GETITEMS Can recover = Full volume
GETITEMS Volume ID = {936b54c1-228a-11df-8147-806e6f6e6963}
GETITEMS Volume 'LIVE DATA', mounted at D:
GETITEMS Volume size = 600.97 GB
GETITEMS Can recover = Full volume
GETITEMS Application = Registry 
GETITEMS Component = Registry (\Registry)
***
 
***6
VERSIONS Backup time: 11/5/2011 8:23 PM 
VERSIONS Backup target: Fixed Disk labeled Boot Backup(E : )
VERSIONS Version identifier: 11/06/2011-01:23
VERSIONS Can recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State
VERSIONS Snapshot ID: {5b29b558-c36f-4cbb-8f2c-963b16b7eec8}
COMMAND wbadmin get items -version:11/06/2011-01:23
GETITEMS wbadmin 1.0 - Backup command-line tool
GETITEMS (C) Copyright 2004 Microsoft Corp.
GETITEMS Volume ID = {936b54bf-228a-11df-8147-806e6f6e6963}
GETITEMS Volume '<Unlabeled Volume>', mounted at <not mounted> at the time the backup was created
GETITEMS Volume size = 100.00 MB
GETITEMS Can recover = Full volume
GETITEMS Volume ID = {936b54c0-228a-11df-8147-806e6f6e6963}
GETITEMS Volume 'LIVE OS', mounted at C:
GETITEMS Volume size = 97.55 GB
GETITEMS Can recover = Full volume
GETITEMS Application = Registry 
GETITEMS Component = Registry (\Registry)
match 2011-11-06 012348 2011-11-06 012348
full path match d:\wib\JIM-GLH_2011-11-06_012348\Backup 2011-11-06 012348
dir path d target drive E
***



My System SpecsSystem Spec
.

Reply

 System Image info, shadow/system restore storage - internal workings




Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 12:37 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33