Solved Imaging via MR Rescue Media not skipping pagefile & hiberfil

[alphaniner]

I'm using Rescue Media created by Macrium Reflect Free 6.1.1311 to image a Windows 7 install. I installed to the entire disk so I have the 100MB Reserved partition and the OS partition consuming the remainder. When I select the entire disk for imaging, the resulting image contains both hiberfil.sys and pagefile.sys. This is despite using the "Intelligent Sector Copy" method which explicitly says

Windows pagefile and suspend to disk (hibernation) files are not copied.
​

The only non-standard option I chose was setting compression to none. I've never used MR before; any suggestions or ideas what I'm doing wrong? Thanks.

 

[townsbg]

I'm not sure what MR is however the only thing that comes to mind is to disable hibernation and pagefile before doing the backup because disabling them gets rid of those files. I never keep hibernation enabled. Disable The Page File And Hibernation - Can You Get More Space Or Speed From Your SSD?

 

[ignatzatsonic]

Alpha:

I'm using Reflect Free 6.1.1225 and have always used default medium compression.

How did you find those files---with a DIR command?

I just ran dir /s pagefile.sys and found nothing within 3 different images I've made in the last month or so.

I have no idea what standard behavior is supposed to be--I've never checked before.

I don't use hibernation, so would not expect to find that file in an image. I do use a page file however.

I don't have a System Reserved, but I certainly wouldn't expect that to make a difference.

Did you have this issue in prior MR builds?

 

[alphaniner]

@townsbg
Oops, MR = Macrium Reflect. OP updated.

I probably would have done as you suggest if it hadn't explicitly indicated it would skip them. I only needed to make a few temporary images so it's not worth special effort, and disabling hibernation isn't an option in this particular case.

@ignatzatsonic

I've never used MR before. I initially noticed "something was amiss" because the size of the first image was the same as the used space on C:. I mounted the image and both files were there. It's significant because the files are 24 & 32 GB (default settings). I tried medium compression the second time around and the files were still stored, but at least the image was significantly smaller (13GB vs 70GB) and the process was faster.

I guess I'll register on MR forums. I hate making new accounts, but if nothing else it should be reported in case it's a bug.

 

[mjf]

the resulting image contains both hiberfil.sys and pagefile.sys. This is despite using the "Intelligent Sector Copy" method which explicitly says

Windows pagefile and suspend to disk (hibernation) files are not copied.
​

When you mount the image are these empty? If not then I am surprised.

 

[alphaniner]

I assume you're not inquiring after their contents.

Their sizes are 24 & 32 GB, and they're not sparse files or such. The proof is in the backup: an uncompressed image of the disk (C: and Reserved) is ~70GB, and C: has ~70GB used.

 

[DavidE]

On the Macrium Forum they say the hiberfil.sys and pagefile.sys are empty in the image file, if it is created while running Windows.
I don't believe this.
I browsed a MR image in Windows, copied the pagefile to a temp folder, opened it with notepad, and i see data in the file.

There is a way to exclude files from being included in an image created while running Windows.
It requires adding some registry keys.
If anyone wants to see the reg keys, let me know and i'll post it.

I just added keys to exclude these files and created an image.
When i browse that image, the files are not there, and the mounted image is several GB smaller than the drive i just imaged.

Here's a couple Macrium threads about this:
Macrium Support Forum - Hiberfil.sys and Pagefile.sys
Macrium Support Forum - Pagefile being included?

 

[DavidE]

Alpha:

I'm using Reflect Free 6.1.1225 and have always used default medium compression.

How did you find those files---with a DIR command?

I just ran dir /s pagefile.sys and found nothing within 3 different images I've made in the last month or so.

I have no idea what standard behavior is supposed to be--I've never checked before.

I don't use hibernation, so would not expect to find that file in an image. I do use a page file however.

I don't have a System Reserved, but I certainly wouldn't expect that to make a difference.

Did you have this issue in prior MR builds?

To see these files you would have to temporarily change your Explorer folder options to show hidden and protected files.

 

[alphaniner]

Thanks for the links. From the second link, this is a known issue for years it seems. Seems like that's my solution.

An empty file (nothing but zeroes) should compress quite spectacularly, so it's not a terrible solution I suppose. It could be the file you looked at just had a small "header" of data and the rest was empty. In any case I'm only interested in the Rescue Media, which despite the issue is pretty impressive. I'm kind of curious if those keys can affect the WinPE environment.

 

[DavidE]

It's my understanding the PE environment can't use the reg keys, so the registry tweak will only work when creating the image while running Windows.

I could see enough in the pagefile with Notepad to know it's not just header info.
Most of it is unreadable, but some parts do display as readable text.

 

[RolandJS]

"...There is a way to exclude files from being included in an image created while running Windows. It requires adding some registry keys. If anyone wants to see the reg keys, let me know and i'll post it..." DavidE
Can I have the registry keys?

 

[Callender]

I do see pagefile.sys in my MR backups but it's just a small one as I've got the page file for windows swapped to another partition. I don't think that backing up the page file can be important as when I restore an image everything works without the missing non backed up (swapped partiton) page file. Also I have page file set to clear every shutdown anyway!

​

Page file swapped to drive D and not backed up when creating a MR backup of windows partiton. Everything still works.

​

 

[DavidE]

"...There is a way to exclude files from being included in an image created while running Windows. It requires adding some registry keys. If anyone wants to see the reg keys, let me know and i'll post it..." DavidE
Can I have the registry keys?

Here you go.
I added the reg keys of David-pagefile and David-hiberfil.
You can name the keys whatever you like, or add keys for any other files you want to exclude.

The keys are in HKLM\System\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshotMacriumImage

Windows rebuilds the pagefile and hiberfil every time it starts up, that's why they aren't needed in a backup image.

 

[mjf]

the resulting image contains both hiberfil.sys and pagefile.sys. This is despite using the "Intelligent Sector Copy" method which explicitly says

Windows pagefile and suspend to disk (hibernation) files are not copied.
​

When you mount the image are these empty? If not then I am surprised.

Looks like I'm wrong. I mounted a Macrium image and this is what I get for my pagefile. I have restricted it to 2GB because I'm running an SSD and I have deleted the Hyberfil.

 

[RolandJS]

DavidE, I moused over your informative post, downloaded the png pic, can't find the two key files
Callender, tell me more about your page & hiber files operations! Has such made Windows more stable?

 

[DavidE]

DavidE, I moused over your informative post, downloaded the png pic, can't find the two key files

You have to manually add the keys for pagefile and hiberfil using regedit.
The RestorePoints key should already be there, Macrium added that, not me.

 

[alphaniner]

Also I have page file set to clear every shutdown anyway!

I'm aware of the possibility to zero the pagefile on shutdown for security purposes. Is that what you're talking about, or do you mean it's actually removed?

 

[Callender]

DavidE, I moused over your informative post, downloaded the png pic, can't find the two key files
Callender, tell me more about your page & hiber files operations! Has such made Windows more stable?

Hibernation is disabled so hiberfil.sys doesn't exist anyway. Page File is fixed size and swapped to a non windows partition. That's nor recommended by most experts here but it works for me. I should state that I also use a RAMdisk. Some things have been disabled like Superfetch (not needed with RAMdisk)

Pretty much everyone will tell you that there's no benefit in a page file swap unless you use a second hard drive for the swap. However I do personally find performance seems to be much better simply by swapping it to another non windows partition.

 

[DavidE]

A fyi followup to my POST #7

I've been testing the MR Registry Exclusions for pagefile and hiberfil and found a little gotcha.
If the partiton being imaged does not have a drive letter, the exclusions are not used, these files are included in the backup image.
If i temporarily add a drive letter, then run Macrium and create the backup image, these files are not included.
I have multi-boot PC's and normally my non-boot OS's don't have a drive letter.
I don't think this affects most people that have a single boot PC and the only drive being imaged is the "C" drive.

For me it means a several GB difference in space used for backups.
It's not causing an error for me if the drive letter is assigned or not.
It does make a big difference in the backup image size.
ymmv

Also, i've tested exporting my reg keys and merging them on a different PC/OS.
So far, no problems here and they work for me.
I can post my reg key export, if anyone wants it so they can merge this, and test it.
Then you wouldn't have to manually add these reg keys.

It has all sub keys under FilesNotToSnapshotMacriumImage, including the default RestorePoints key.
I make no guarantee that this will work for anyone else.
Make sure you can recover before making any changes !!!