Imaging strategies

[whs]

   Information

Most everybody is meticulous setting up proper antivirus programs and defenses. But should you catch a virus or some other malware despite all the care, you are often forced to reinstall the system.
The same is true when your system goes on the blink because you made a false maneuver with your system files or the registry as well as bad update and program downloads.
In some cases you can bail yourself out if you reset to a system restore point (if available). But that is not always a safe bet especially in the case of bad malware which may void this option.
But in all cases it is possible to reset the system to a system image if that is well planned. This write-up gives an overview of an imaging strategy based on my own experience. It may help you to plan your own approach.

After 3 years of imaging my systems, I have developed certain imaging strategies that work very well. Maybe they are useful for you.
These strategies are independent from any particular imaging program being used. I started with Norton Ghost 14, after that used Paragon, and now I use Macrium. In between I also experimented with a few others.
For my wife I have setup a Maxtor One Touch 2.5” USB2 attached disk with the Maxtor Manager. This is absolutely the easiest form of imaging. All she needs to do is to push the button on the disk and the Maxtor Manager gets started.

Hardware requirements

For any serious imaging you should have two additional physical disk drives – additional to the drive on which the OS resides. They can be 2 external disks or one external and one internal disk. An internal disk will obviously yield a faster speed when you image.
One external disk should be easily detachable (set off-line) and should be only on-line when in use. This will give you 100% certainty that nothing and nobody can access that disk and the images on it.
The space you need on the disks depends on the number of images you want to retain at any given time. The typical size of an image is approximately 50% of the data (not the partition) that is being imaged. If you have a 100GB OS partition but only 20GBs are occupied with data and 80GBs are free, your image of that partition would be 10GBs.
The 2 disks need not be dedicated to imaging – especially the internal disk (or the external disk that stays on-line). All you need is a defined folder on those disks and sufficient free space to hold the images you want to keep.

Software requirements

You do, of course, need an imaging program. There is a vast choice of free and paid programs. I like to break the available options into 4 categories:

1. The imaging facility that is built into Windows7. You access it through Control Panel\System and Security\Backup and Restore
2. Free programs which are usually versions of paid programs with reduced functionality. Free Macrium and free Paragon are examples.
3. Free programs that come with external disks of certain manufacturers. The Maxtor Manager is an example.
4. Paid programs are available from many providers. You can find a little selection on this link.


Imaging steps

Initial images are those that you take immediately after the installation of the operating system. Reinstallation from that image is a substitute for a total reinstall from the installation DVD or the recovery partition. The advantage over a total reinstall is that you do not start completely at square one and the reinstallation process is, therefore, a lot faster (20 to 30 minutes).
The initial image should be taken after all the updates that are available at installation time have been installed, the main programs that you use all the time (e.g., AV program, Office, etc.) are installed, and all the system and program settings that you deem important are made. I store this initial image in a separate folder on the external disk that is normally disconnected. This way I hope it will be in a safe place.

Ongoing images can be taken any time. I recommend to take one every day – that can be scheduled and automated in most imaging programs. The best place to store them is another internal HDD (but an external HDD that is permanently attached is OK too – just a bit slower).
I accumulate those daily images until Sunday when I transfer the Sunday image to a monthly folder on my normally disconnected external drive. At that time I delete daily images of that week.
On the last day of the month, I transfer the last image to a monthly folder which is also on the normally disconnected drive. And, I delete the monthly images of that month.
So at any given time I have this week’s images (maximum 6), this month’s images (maximum 4), and the images of every month since installation, including the initial image. This is a maximum total of 22 at the end of the first year after installation. But, usually, I do not keep 12 monthly images, but weed them out as I go.

Special considerations

A 100MB active boot partition is present on many Windows7 installations. This partition is needed to boot the system since it contains the MBR (Master Boot Record). Normally the content of this partition does not change. I therefore image it only with the initial image and keep it in the folder with the initial image (in a separate subfolder).
Should you, however, later add another operating system in double boot mode, you need to reimage this 100MB partition because its content has changed. I suggest you store it in a separate subfolder with the initial image. If you later decide to delete this second operating system, you need only restore the initial image of the 100MB partition and you have no trace of the second OS.
Special attention has to be given to the restore process of the OS partition if you have a separate 100MB active boot partition. You must not mark the OS partition as “active” during the restore process nor must you restore the MBR.

:note: Note: The native Windows7 imaging facility automatically images the 100MB partition every time. Thus, a different procedure applies.

User data that is stored in the OS partition will be automatically imaged with the imaging of the OS partition. It is, however, good practice to store the user data in a separate data partition and many people do so. In case you have such a data partition, you need to arrange for separate images of that partition. The same applies to any other partition where you care to backup the content.

Recovery CDs have to be burnt for all imaging programs. You do this best at the beginning of your imaging experience. The imaging programs provide the facilities for burning the CD.
The recovery CDs are needed to restore images. They contain the necessary software to manage the recovery process and will guide you through that process. You load them by changing the BIOS boot sequence to boot from the optical reader.

Timing will vary depending on the imaging program you use and the speed of the disks to/from you image. I have seen an image to complete in 3.5 minutes for 20GBs of data on a SSD imaged to an internal 7200 rpm HDD. In contrast an image of 80GBs of data from a 5400 rpm internal HDD to a 5400 rpm external USB2 attached disk can take over 1 hour.
The image restore process varies between 20 to 40 minutes – again depending on the used program and the speed of the disks.

Disk hardware malfunction happens rarely but imaging protects you against such an event too. In case that happens to you, exchange the HDD and restore your system from the last image.
Most paid imaging programs can restore to new partitions that are smaller than the partition from where the image came – as long as the image fits on the space. Many free imaging programs do not have that capability. You must therefore see to it that the target partition is at least as big as the originating partition.
For preparing and partitioning your replacement HDD I suggest the bootable CD of free Partition Wizard.

Laptops are a special challenge for imaging. They very rarely have 2 internal HDDs and often there is no external disk available either.
For the normal daily process I suggest to work with one external 2.5” USB powered disk. That provides a little less security than the 2 disk approach but beats doing nothing.
For laptops that are constantly “on the road” where you may not always want to carry an extra external disk, I suggest you define an imaging partition on the one and only internal HDD and place an occasional image there. That does not protect you against a disk hardware failure, but is still useful in case of a malware infection or some serious malfunction of the OS.

 

[Kari]

I rep'd you some time ago because of your sound and clear backup strategies, and the quality of advice and information you have shared with us here on the Seven Forums.

Have to "spread rep around" before I can rep you again, so here's a public thank you instead. I wish people would listen to you, understand the importance of a sound backup strategy. The three most important things in safe computing are backup, backup and backup

I've learned a lot from your posts and video tutorials.

Thank you.

Kari

 

[whs]

Kari, I appreciate your kind words, thank you. It was actually after you encouraged me last time that I started to make this write-up. I hope it will be useful for our work here and that many people will take the plunge into imaging.

 

[Lordbob75]

Very will written, very well thought out.

While this may be a bit more extreme than what most people would need, it has some good tips.
Unfortunately, there are those of us too lazy to make a disk image, but don't mind reinstalling on the rare occasion it needs to be done.

This would be a good write up for anyone with data they deem irreplaceable (such as a business, or for cherished family photos).

~Lordbob

 

[mitchell64]

Great work WHS, & this just answered a question i had "you do need to independently image the System Reserved Partition" as i just found out beta testing an AV

Oh well first clean install in a long time, thanks again for another valuable piece of resource material

 

[kado897]

I take a slightly different approach using the Win 7 built in utilities.

In addition to the usual first image, repair disks etc. I use the following cycle

1. Daily data file backup. I keep a months worth of backup sets. Usually four or five per month.

2. A weekly image every Sunday. I retain four or five of these on a FIFO cycle.

3. An image when I am sure any major software installation or update is stable. I retain this indefinitely. This is usually the weekly image following "patch Tuesday".

I naturally hope never to have to use these.

I am running a laptop which was configured without a separate OS partition which makes daily image backups impractical.

Does this look like a sound strategy?

 

[whs]

kado, sounds good to me. It is really a matter of your usage pattern. E.g. in my case the system changes a lot more often than my data (most of which is on external drives anyhow). So I need to image the system more often than the data. And for a laptop with no additional internal disk, weekly may be better than daily - although you can run imaging in the background - if you are worried about the length of time it takes.

 

[kado897]

Thanks for your kind words whs.

How do you run imaging in the background?

I always worry that running jobs like imaging and defrags when other work is going on will cause integrity problems so I avoid that as much as practicable. I guess it's my mainframe background where that was definitely not recommended.

 

[whs]

I nearly always run imaging in the background. It takes little CPU load and surfing the web is no hiderance. Just "hide" the imaging or start a browser.

Btw: I recommend to enable "System Protection" (Restore points) for the data partition (I assume you have a seperate Data Partition - if not, see the link). You have to create those manually from time to time. Should you ever lose a file or folder, you can recover it with Shadow Explorer from the Restore points.

 

[kado897]

Thanks for the info. I do indeed have System protection enabled and have on a few occasions needed to use it to recover from problem updates and driver installations. It is also my first recourse in restoring incorrectly modified files.

I will look at shadow explorer.

 

[whs]

My point is, you do not have to restore the whole system only because a few files are mucked up. With Shadow Explorer you can get them back individually. Long time ago I made a video tutorial how to do that. You find it here: http://www.vimeo.com/17987647

 

[kado897]

Thanks for that. I tried to view the tutorial but the video stopped at 3 min 16 seconds. I have however looked at the How-To Geek's explanation and as a result I have downloaded it and given it a quick try. It looks like a very useful addition to my recovery options. Once again many thanks.

 

[whs]

Yeah, you are right. It got all ruined. It used to be very crisp and now it is all fuzzy. I wonder what those Vimeo people did to it. I have to upload it again. Will post the new link later.

 

[whs]

Here is the new tutorial link: Recover lost files with Shadow Explorer on Vimeo I also updated the original posting.

 

[kado897]

Thanks whs. That's really good now if a little outdated.

 

[whs]

The outdated part is only that it was done on Vista. Else the Shadow Explorer has not really changed. In fact, yesterday night I put the tutorial into our tutorial section. I thought that would be handier to refer to.
http://www.sevenforums.com/tutorials/132087-shadowexplorer-recover-lost-files-folders.html

 

[ElectricRider]

.
Hardware requirements

For any serious imaging you should have two additional physical disk drives – additional to the drive on which the OS resides. They can be 2 external disks or one external and one internal disk. An internal disk will obviously yield a faster speed when you image.
One external disk should be easily detachable (set off-line) and should be only on-line when in use. This will give you 100% certainty that nothing and nobody can access that disk and the images on it.
The space you need on the disks depends on the number of images you want to retain at any given time. The typical size of an image is approximately 50% of the data (not the partition) that is being imaged. If you have a 100GB OS partition but only 20GBs are occupied with data and 80GBs are free, your image of that partition would be 10GBs.
The 2 disks need not be dedicated to imaging – especially the internal disk (or the external disk that stays on-line). All you need is a defined folder on those disks and sufficient free space to hold the images you want to keep.

A couple of points here that may help those with Home Premium. Win 7's built in Imaging tool does Not allow you to create and restore from a network and does not always work well with external drives. I have found this out the hard way. I use dvd's to backup and restore my Images. I find they are just as solid and reliable as an external hard drive, as long as you keep them safe and in good condition. Windows 7 Professional and higher has support for networks and also has much better support for external hard drives. Windows 7 Home Premium can always work with your built in cd/dvd rom drive if you have one.

Software requirements

You do, of course, need an imaging program. There is a vast choice of free and paid programs. I like to break the available options into 4 categories:

1. The imaging facility that is built into Windows7. You access it through Control Panel\System and Security\Backup and Restore
2. Free programs which are usually versions of paid programs with reduced functionality. Free Macrium and free Paragon are examples.
3. Free programs that come with external disks of certain manufacturers. The Maxtor Manager is an example.
4. Paid programs are available from many providers. You can find a little selection on this link.

I recently had an issue where many of the popular free and paid for imaging programs would not work for one reason or another. Acronis True Image Home, Paragon Backup and Restore Advanced 2011, EaseUS ToDo Backup 2011, Macrium Reflect Free Edition, DriveImage XML, all of them failed where as the built in imaging tool of Windows 7 Home Premium worked flawlessly for creating the Image and restoring it. I encourage everyone to try the built in Windows 7 Imaging tool before spending time and or money downloading 3rd party apps. All of the above apps use Windows VSS technology to create their images anyway, the same as Win 7's built in Imaging tool so when you use those programs you are really using Windows 7 built in imaging tool anyway those apps just add some extra functionality that you really may not need.

 

[kado897]

I would agree with most of that. The problem with external disks is usually related to the restore CD not being able to find them or not having the correct drivers. The Linux based disks are problematic for me. I have never had a problem with WinPE based disks finding external USB hard drives.

While it is true that all third party backup solutions use VSS to create the image as far as I am aware Windows Backup is the only one that uses shadow storage to hold incremental backups. It is that many of us don't like. I suggest that using more than one backup product is a good idea and I use Windows Backup (Single Images) for that.

 

[pparks1]

I recently had an issue where many of the popular free and paid for imaging programs would not work for one reason or another. Acronis True Image Home, Paragon Backup and Restore Advanced 2011, EaseUS ToDo Backup 2011, Macrium Reflect Free Edition, DriveImage XML, all of them failed

Not intending any offense (and I did see your other thread), but if every single one of these 3rd party apps all failed on your system, it sounds like something is wrong with your system. In the other thread, you mentioned a number of services you disabled and tweak programs that you had run. I suspect something went afoul along the way with some of these "tweeks". I use Acronis True Image Home 2010 at home, I use Macrium and EaseUs at work and I haven't really experienced problems with any of them....except for a mouse problem with a Macrium Reflect free restore disk on one particular system.

I encourage everyone to try the built in Windows 7 Imaging tool before spending time and or money downloading 3rd party apps.

That's the one that I started with myself. It did the job and did it alright, but I wanted some more flexibility with storing multiple images, password protecting my images, etc. This is why I turned to third party apps.

 

[cluberti]

Third party tools are good, but don't forget Microsoft's tools either. For most non-enterprises (SCCM), this will be MDT.