New
#1
Imaging strategies
Information
Most everybody is meticulous setting up proper antivirus programs and defenses. But should you catch a virus or some other malware despite all the care, you are often forced to reinstall the system.
The same is true when your system goes on the blink because you made a false maneuver with your system files or the registry as well as bad update and program downloads.
In some cases you can bail yourself out if you reset to a system restore point (if available). But that is not always a safe bet especially in the case of bad malware which may void this option.
But in all cases it is possible to reset the system to a system image if that is well planned. This write-up gives an overview of an imaging strategy based on my own experience. It may help you to plan your own approach.
After 3 years of imaging my systems, I have developed certain imaging strategies that work very well. Maybe they are useful for you.
These strategies are independent from any particular imaging program being used. I started with Norton Ghost 14, after that used Paragon, and now I use Macrium. In between I also experimented with a few others.
For my wife I have setup a Maxtor One Touch 2.5” USB2 attached disk with the Maxtor Manager. This is absolutely the easiest form of imaging. All she needs to do is to push the button on the disk and the Maxtor Manager gets started.
Hardware requirements
For any serious imaging you should have two additional physical disk drives – additional to the drive on which the OS resides. They can be 2 external disks or one external and one internal disk. An internal disk will obviously yield a faster speed when you image.
One external disk should be easily detachable (set off-line) and should be only on-line when in use. This will give you 100% certainty that nothing and nobody can access that disk and the images on it.
The space you need on the disks depends on the number of images you want to retain at any given time. The typical size of an image is approximately 50% of the data (not the partition) that is being imaged. If you have a 100GB OS partition but only 20GBs are occupied with data and 80GBs are free, your image of that partition would be 10GBs.
The 2 disks need not be dedicated to imaging – especially the internal disk (or the external disk that stays on-line). All you need is a defined folder on those disks and sufficient free space to hold the images you want to keep.
Software requirements
You do, of course, need an imaging program. There is a vast choice of free and paid programs. I like to break the available options into 4 categories:
1. The imaging facility that is built into Windows7. You access it through Control Panel\System and Security\Backup and Restore
2. Free programs which are usually versions of paid programs with reduced functionality. Free Macrium and free Paragon are examples.
3. Free programs that come with external disks of certain manufacturers. The Maxtor Manager is an example.
4. Paid programs are available from many providers. You can find a little selection on this link.
Imaging steps
Initial images are those that you take immediately after the installation of the operating system. Reinstallation from that image is a substitute for a total reinstall from the installation DVD or the recovery partition. The advantage over a total reinstall is that you do not start completely at square one and the reinstallation process is, therefore, a lot faster (20 to 30 minutes).
The initial image should be taken after all the updates that are available at installation time have been installed, the main programs that you use all the time (e.g., AV program, Office, etc.) are installed, and all the system and program settings that you deem important are made. I store this initial image in a separate folder on the external disk that is normally disconnected. This way I hope it will be in a safe place.
Ongoing images can be taken any time. I recommend to take one every day – that can be scheduled and automated in most imaging programs. The best place to store them is another internal HDD (but an external HDD that is permanently attached is OK too – just a bit slower).
I accumulate those daily images until Sunday when I transfer the Sunday image to a monthly folder on my normally disconnected external drive. At that time I delete daily images of that week.
On the last day of the month, I transfer the last image to a monthly folder which is also on the normally disconnected drive. And, I delete the monthly images of that month.
So at any given time I have this week’s images (maximum 6), this month’s images (maximum 4), and the images of every month since installation, including the initial image. This is a maximum total of 22 at the end of the first year after installation. But, usually, I do not keep 12 monthly images, but weed them out as I go.
Special considerations
A 100MB active boot partition is present on many Windows7 installations. This partition is needed to boot the system since it contains the MBR (Master Boot Record). Normally the content of this partition does not change. I therefore image it only with the initial image and keep it in the folder with the initial image (in a separate subfolder).
Should you, however, later add another operating system in double boot mode, you need to reimage this 100MB partition because its content has changed. I suggest you store it in a separate subfolder with the initial image. If you later decide to delete this second operating system, you need only restore the initial image of the 100MB partition and you have no trace of the second OS.
Special attention has to be given to the restore process of the OS partition if you have a separate 100MB active boot partition. You must not mark the OS partition as “active” during the restore process nor must you restore the MBR.
Note: The native Windows7 imaging facility automatically images the 100MB partition every time. Thus, a different procedure applies.
User data that is stored in the OS partition will be automatically imaged with the imaging of the OS partition. It is, however, good practice to store the user data in a separate data partition and many people do so. In case you have such a data partition, you need to arrange for separate images of that partition. The same applies to any other partition where you care to backup the content.
Recovery CDs have to be burnt for all imaging programs. You do this best at the beginning of your imaging experience. The imaging programs provide the facilities for burning the CD.
The recovery CDs are needed to restore images. They contain the necessary software to manage the recovery process and will guide you through that process. You load them by changing the BIOS boot sequence to boot from the optical reader.
Timing will vary depending on the imaging program you use and the speed of the disks to/from you image. I have seen an image to complete in 3.5 minutes for 20GBs of data on a SSD imaged to an internal 7200 rpm HDD. In contrast an image of 80GBs of data from a 5400 rpm internal HDD to a 5400 rpm external USB2 attached disk can take over 1 hour.
The image restore process varies between 20 to 40 minutes – again depending on the used program and the speed of the disks.
Disk hardware malfunction happens rarely but imaging protects you against such an event too. In case that happens to you, exchange the HDD and restore your system from the last image.
Most paid imaging programs can restore to new partitions that are smaller than the partition from where the image came – as long as the image fits on the space. Many free imaging programs do not have that capability. You must therefore see to it that the target partition is at least as big as the originating partition.
For preparing and partitioning your replacement HDD I suggest the bootable CD of free Partition Wizard.
Laptops are a special challenge for imaging. They very rarely have 2 internal HDDs and often there is no external disk available either.
For the normal daily process I suggest to work with one external 2.5” USB powered disk. That provides a little less security than the 2 disk approach but beats doing nothing.
For laptops that are constantly “on the road” where you may not always want to carry an extra external disk, I suggest you define an imaging partition on the one and only internal HDD and place an occasional image there. That does not protect you against a disk hardware failure, but is still useful in case of a malware infection or some serious malfunction of the OS.
Last edited by whs; 03 Dec 2010 at 00:08.